452 files changed, 57002 insertions, 32003 deletions

diff --git a/Source/JavaScriptCore/API/APIShims.h b/Source/JavaScriptCore/API/APIShims.h
index 26db2dc..2e13851 100644
--- a/Source/JavaScriptCore/API/APIShims.h
+++ b/Source/JavaScriptCore/API/APIShims.h
@@ -42,7 +42,7 @@ protected:
         UNUSED_PARAM(registerThread);
 #if ENABLE(JSC_MULTIPLE_THREADS)
         if (registerThread)
-            globalData->heap.machineStackMarker().registerThread();
+            globalData->heap.machineThreads().addCurrentThread();
 #endif
         m_globalData->heap.activityCallback()->synchronize();
         m_globalData->timeoutChecker.start();
diff --git a/Source/JavaScriptCore/API/JSBase.h b/Source/JavaScriptCore/API/JSBase.h
index d962b01..fed54fe 100644
--- a/Source/JavaScriptCore/API/JSBase.h
+++ b/Source/JavaScriptCore/API/JSBase.h
@@ -80,6 +80,11 @@ typedef struct OpaqueJSValue* JSObjectRef;
 #define JS_EXPORT
 #endif /* defined(JS_NO_EXPORT) */
 
+/* JS tests uses WTF but has no config.h, so we need to set the export defines here. */
+#ifndef WTF_EXPORT_PRIVATE
+#define WTF_EXPORT_PRIVATE JS_EXPORT
+#endif
+
 #ifdef __cplusplus
 extern "C" {
 #endif
diff --git a/Source/JavaScriptCore/API/JSCallbackConstructor.cpp b/Source/JavaScriptCore/API/JSCallbackConstructor.cpp
index 66c6b88..fa9d216 100644
--- a/Source/JavaScriptCore/API/JSCallbackConstructor.cpp
+++ b/Source/JavaScriptCore/API/JSCallbackConstructor.cpp
@@ -36,13 +36,14 @@
 
 namespace JSC {
 
-const ClassInfo JSCallbackConstructor::info = { "CallbackConstructor", 0, 0, 0 };
+const ClassInfo JSCallbackConstructor::s_info = { "CallbackConstructor", &JSObjectWithGlobalObject::s_info, 0, 0 };
 
-JSCallbackConstructor::JSCallbackConstructor(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, JSClassRef jsClass, JSObjectCallAsConstructorCallback callback)
+JSCallbackConstructor::JSCallbackConstructor(JSGlobalObject* globalObject, Structure* structure, JSClassRef jsClass, JSObjectCallAsConstructorCallback callback)
     : JSObjectWithGlobalObject(globalObject, structure)
     , m_class(jsClass)
     , m_callback(callback)
 {
+    ASSERT(inherits(&s_info));
     if (m_class)
         JSClassRetain(jsClass);
 }
diff --git a/Source/JavaScriptCore/API/JSCallbackConstructor.h b/Source/JavaScriptCore/API/JSCallbackConstructor.h
index a6d64cc..64b237d 100644
--- a/Source/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/Source/JavaScriptCore/API/JSCallbackConstructor.h
@@ -33,15 +33,15 @@ namespace JSC {
 
 class JSCallbackConstructor : public JSObjectWithGlobalObject {
 public:
-    JSCallbackConstructor(JSGlobalObject*, NonNullPassRefPtr<Structure>, JSClassRef, JSObjectCallAsConstructorCallback);
+    JSCallbackConstructor(JSGlobalObject*, Structure*, JSClassRef, JSObjectCallAsConstructorCallback);
     virtual ~JSCallbackConstructor();
     JSClassRef classRef() const { return m_class; }
     JSObjectCallAsConstructorCallback callback() const { return m_callback; }
-    static const ClassInfo info;
-    
-    static PassRefPtr<Structure> createStructure(JSValue proto) 
-    { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+    static const ClassInfo s_info;
+
+    static Structure* createStructure(JSGlobalData& globalData, JSValue proto) 
+    {
+        return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
@@ -49,7 +49,6 @@ protected:
 
 private:
     virtual ConstructType getConstructData(ConstructData&);
-    virtual const ClassInfo* classInfo() const { return &info; }
 
     JSClassRef m_class;
     JSObjectCallAsConstructorCallback m_callback;
diff --git a/Source/JavaScriptCore/API/JSCallbackFunction.cpp b/Source/JavaScriptCore/API/JSCallbackFunction.cpp
index c488aa6..28b3419 100644
--- a/Source/JavaScriptCore/API/JSCallbackFunction.cpp
+++ b/Source/JavaScriptCore/API/JSCallbackFunction.cpp
@@ -40,12 +40,13 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSCallbackFunction);
 
-const ClassInfo JSCallbackFunction::info = { "CallbackFunction", &InternalFunction::info, 0, 0 };
+const ClassInfo JSCallbackFunction::s_info = { "CallbackFunction", &InternalFunction::s_info, 0, 0 };
 
 JSCallbackFunction::JSCallbackFunction(ExecState* exec, JSGlobalObject* globalObject, JSObjectCallAsFunctionCallback callback, const Identifier& name)
     : InternalFunction(&exec->globalData(), globalObject, globalObject->callbackFunctionStructure(), name)
     , m_callback(callback)
 {
+    ASSERT(inherits(&s_info));
 }
 
 EncodedJSValue JSCallbackFunction::call(ExecState* exec)
diff --git a/Source/JavaScriptCore/API/JSCallbackFunction.h b/Source/JavaScriptCore/API/JSCallbackFunction.h
index b119b97..55c9ed4 100644
--- a/Source/JavaScriptCore/API/JSCallbackFunction.h
+++ b/Source/JavaScriptCore/API/JSCallbackFunction.h
@@ -35,18 +35,17 @@ class JSCallbackFunction : public InternalFunction {
 public:
     JSCallbackFunction(ExecState*, JSGlobalObject*, JSObjectCallAsFunctionCallback, const Identifier& name);
 
-    static const ClassInfo info;
+    static const ClassInfo s_info;
     
     // InternalFunction mish-mashes constructor and function behavior -- we should 
     // refactor the code so this override isn't necessary
-    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    static Structure* createStructure(JSGlobalData& globalData, JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+        return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
     }
 
 private:
     virtual CallType getCallData(CallData&);
-    virtual const ClassInfo* classInfo() const { return &info; }
 
     static EncodedJSValue JSC_HOST_CALL call(ExecState*);
 
diff --git a/Source/JavaScriptCore/API/JSCallbackObject.cpp b/Source/JavaScriptCore/API/JSCallbackObject.cpp
index b8e5843..6a7462a 100644
--- a/Source/JavaScriptCore/API/JSCallbackObject.cpp
+++ b/Source/JavaScriptCore/API/JSCallbackObject.cpp
@@ -36,7 +36,19 @@ ASSERT_CLASS_FITS_IN_CELL(JSCallbackObject<JSObjectWithGlobalObject>);
 ASSERT_CLASS_FITS_IN_CELL(JSCallbackObject<JSGlobalObject>);
 
 // Define the two types of JSCallbackObjects we support.
-template <> const ClassInfo JSCallbackObject<JSObjectWithGlobalObject>::info = { "CallbackObject", 0, 0, 0 };
-template <> const ClassInfo JSCallbackObject<JSGlobalObject>::info = { "CallbackGlobalObject", 0, 0, 0 };
+template <> const ClassInfo JSCallbackObject<JSObjectWithGlobalObject>::s_info = { "CallbackObject", &JSObjectWithGlobalObject::s_info, 0, 0 };
+template <> const ClassInfo JSCallbackObject<JSGlobalObject>::s_info = { "CallbackGlobalObject", &JSGlobalObject::s_info, 0, 0 };
 
+void JSCallbackObjectData::finalize(Handle<Unknown> handle, void* context)
+{
+    JSClassRef jsClass = static_cast<JSClassRef>(context);
+    JSObjectRef thisRef = toRef(asObject(handle.get()));
+    
+    for (; jsClass; jsClass = jsClass->parentClass)
+        if (JSObjectFinalizeCallback finalize = jsClass->finalize)
+            finalize(thisRef);
+    HandleSlot slot = handle.slot();
+    HandleHeap::heapFor(slot)->deallocate(slot);
+}
+    
 } // namespace JSC
diff --git a/Source/JavaScriptCore/API/JSCallbackObject.h b/Source/JavaScriptCore/API/JSCallbackObject.h
index f47d0b1..d2e0dcb 100644
--- a/Source/JavaScriptCore/API/JSCallbackObject.h
+++ b/Source/JavaScriptCore/API/JSCallbackObject.h
@@ -34,7 +34,7 @@
 
 namespace JSC {
 
-struct JSCallbackObjectData {
+struct JSCallbackObjectData : WeakHandleOwner {
     JSCallbackObjectData(void* privateData, JSClassRef jsClass)
         : privateData(privateData)
         , jsClass(jsClass)
@@ -110,27 +110,27 @@ struct JSCallbackObjectData {
         PrivatePropertyMap m_propertyMap;
     };
     OwnPtr<JSPrivatePropertyMap> m_privateProperties;
+    virtual void finalize(Handle<Unknown>, void*);
 };
 
     
 template <class Base>
 class JSCallbackObject : public Base {
 public:
-    JSCallbackObject(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, JSClassRef, void* data);
-    JSCallbackObject(JSClassRef, NonNullPassRefPtr<Structure>);
-    virtual ~JSCallbackObject();
+    JSCallbackObject(ExecState*, JSGlobalObject*, Structure*, JSClassRef, void* data);
+    JSCallbackObject(JSGlobalData&, JSClassRef, Structure*);
 
     void setPrivate(void* data);
     void* getPrivate();
 
-    static const ClassInfo info;
+    static const ClassInfo s_info;
 
     JSClassRef classRef() const { return m_callbackObjectData->jsClass; }
     bool inherits(JSClassRef) const;
 
-    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    static Structure* createStructure(JSGlobalData& globalData, JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), Base::AnonymousSlotCount); 
+        return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), Base::AnonymousSlotCount, &s_info); 
     }
     
     JSValue getPrivateProperty(const Identifier& propertyName) const
@@ -171,7 +171,6 @@ private:
 
     virtual ConstructType getConstructData(ConstructData&);
     virtual CallType getCallData(CallData&);
-    virtual const ClassInfo* classInfo() const { return &info; }
 
     virtual void markChildren(MarkStack& markStack)
     {
diff --git a/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h b/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
index 59373ec..8639e1a 100644
--- a/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -45,25 +45,27 @@ namespace JSC {
 template <class Base>
 inline JSCallbackObject<Base>* JSCallbackObject<Base>::asCallbackObject(JSValue value)
 {
-    ASSERT(asObject(value)->inherits(&info));
+    ASSERT(asObject(value)->inherits(&s_info));
     return static_cast<JSCallbackObject*>(asObject(value));
 }
 
 template <class Base>
-JSCallbackObject<Base>::JSCallbackObject(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, JSClassRef jsClass, void* data)
+JSCallbackObject<Base>::JSCallbackObject(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, JSClassRef jsClass, void* data)
     : Base(globalObject, structure)
     , m_callbackObjectData(adoptPtr(new JSCallbackObjectData(data, jsClass)))
 {
+    ASSERT(Base::inherits(&s_info));
     init(exec);
 }
 
 // Global object constructor.
 // FIXME: Move this into a separate JSGlobalCallbackObject class derived from this one.
 template <class Base>
-JSCallbackObject<Base>::JSCallbackObject(JSClassRef jsClass, NonNullPassRefPtr<Structure> structure)
-    : Base(structure)
+JSCallbackObject<Base>::JSCallbackObject(JSGlobalData& globalData, JSClassRef jsClass, Structure* structure)
+    : Base(globalData, structure)
     , m_callbackObjectData(adoptPtr(new JSCallbackObjectData(0, jsClass)))
 {
+    ASSERT(Base::inherits(&s_info));
     ASSERT(Base::isGlobalObject());
     init(static_cast<JSGlobalObject*>(this)->globalExec());
 }
@@ -86,16 +88,16 @@ void JSCallbackObject<Base>::init(ExecState* exec)
         JSObjectInitializeCallback initialize = initRoutines[i];
         initialize(toRef(exec), toRef(this));
     }
-}
 
-template <class Base>
-JSCallbackObject<Base>::~JSCallbackObject()
-{
-    JSObjectRef thisRef = toRef(this);
-    
-    for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass)
-        if (JSObjectFinalizeCallback finalize = jsClass->finalize)
-            finalize(thisRef);
+    bool needsFinalizer = false;
+    for (JSClassRef jsClassPtr = classRef(); jsClassPtr && !needsFinalizer; jsClassPtr = jsClassPtr->parentClass)
+        needsFinalizer = jsClassPtr->finalize;
+    if (needsFinalizer) {
+        HandleSlot slot = exec->globalData().allocateGlobalHandle();
+        HandleHeap::heapFor(slot)->makeWeak(slot, m_callbackObjectData.get(), classRef());
+        HandleHeap::heapFor(slot)->writeBarrier(slot, this);
+        *slot = this;
+    }
 }
 
 template <class Base>
diff --git a/Source/JavaScriptCore/API/JSClassRef.cpp b/Source/JavaScriptCore/API/JSClassRef.cpp
index decf493..08dc721 100644
--- a/Source/JavaScriptCore/API/JSClassRef.cpp
+++ b/Source/JavaScriptCore/API/JSClassRef.cpp
@@ -84,8 +84,9 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
                 // Use a local variable here to sidestep an RVCT compiler bug.
                 StaticValueEntry* entry = new StaticValueEntry(staticValue->getProperty, staticValue->setProperty, staticValue->attributes);
                 StringImpl* impl = valueName.impl();
-                impl->ref();
-                m_staticValues->add(impl, entry);
+                StaticValueEntry* existingEntry = m_staticValues->get(impl);
+                m_staticValues->set(impl, entry);
+                delete existingEntry;
             }
             ++staticValue;
         }
@@ -99,8 +100,9 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
                 // Use a local variable here to sidestep an RVCT compiler bug.
                 StaticFunctionEntry* entry = new StaticFunctionEntry(staticFunction->callAsFunction, staticFunction->attributes);
                 StringImpl* impl = functionName.impl();
-                impl->ref();
-                m_staticFunctions->add(impl, entry);
+                StaticFunctionEntry* existingEntry = m_staticFunctions->get(impl);
+                m_staticFunctions->set(impl, entry);
+                delete existingEntry;
             }
             ++staticFunction;
         }
@@ -142,19 +144,12 @@ PassRefPtr<OpaqueJSClass> OpaqueJSClass::createNoAutomaticPrototype(const JSClas
     return adoptRef(new OpaqueJSClass(definition, 0));
 }
 
-static void clearReferenceToPrototype(JSObjectRef prototype)
-{
-    OpaqueJSClassContextData* jsClassData = static_cast<OpaqueJSClassContextData*>(JSObjectGetPrivate(prototype));
-    ASSERT(jsClassData);
-    jsClassData->cachedPrototype.clear(toJS(prototype));
-}
-
 PassRefPtr<OpaqueJSClass> OpaqueJSClass::create(const JSClassDefinition* clientDefinition)
 {
     JSClassDefinition definition = *clientDefinition; // Avoid modifying client copy.
 
     JSClassDefinition protoDefinition = kJSClassDefinitionEmpty;
-    protoDefinition.finalize = clearReferenceToPrototype;
+    protoDefinition.finalize = 0;
     swap(definition.staticFunctions, protoDefinition.staticFunctions); // Move static functions to the prototype.
     
     // We are supposed to use JSClassRetain/Release but since we know that we currently have
@@ -163,7 +158,7 @@ PassRefPtr<OpaqueJSClass> OpaqueJSClass::create(const JSClassDefinition* clientD
     return adoptRef(new OpaqueJSClass(&definition, protoClass.get()));
 }
 
-OpaqueJSClassContextData::OpaqueJSClassContextData(OpaqueJSClass* jsClass)
+OpaqueJSClassContextData::OpaqueJSClassContextData(JSC::JSGlobalData&, OpaqueJSClass* jsClass)
     : m_class(jsClass)
 {
     if (jsClass->m_staticValues) {
@@ -209,7 +204,7 @@ OpaqueJSClassContextData& OpaqueJSClass::contextData(ExecState* exec)
 {
     OpaqueJSClassContextData*& contextData = exec->globalData().opaqueJSClassData.add(this, 0).first->second;
     if (!contextData)
-        contextData = new OpaqueJSClassContextData(this);
+        contextData = new OpaqueJSClassContextData(exec->globalData(), this);
     return *contextData;
 }
 
@@ -256,10 +251,10 @@ JSObject* OpaqueJSClass::prototype(ExecState* exec)
 
     if (!jsClassData.cachedPrototype) {
         // Recursive, but should be good enough for our purposes
-        jsClassData.cachedPrototype = new (exec) JSCallbackObject<JSObjectWithGlobalObject>(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData); // set jsClassData as the object's private data, so it can clear our reference on destruction
+        jsClassData.cachedPrototype.set(exec->globalData(), new (exec) JSCallbackObject<JSObjectWithGlobalObject>(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData), 0); // set jsClassData as the object's private data, so it can clear our reference on destruction
         if (parentClass) {
             if (JSObject* prototype = parentClass->prototype(exec))
-                jsClassData.cachedPrototype->setPrototype(prototype);
+                jsClassData.cachedPrototype->setPrototype(exec->globalData(), prototype);
         }
     }
     return jsClassData.cachedPrototype.get();
diff --git a/Source/JavaScriptCore/API/JSClassRef.h b/Source/JavaScriptCore/API/JSClassRef.h
index 0971700..d346cc5 100644
--- a/Source/JavaScriptCore/API/JSClassRef.h
+++ b/Source/JavaScriptCore/API/JSClassRef.h
@@ -28,10 +28,10 @@
 
 #include "JSObjectRef.h"
 
-#include <runtime/JSObject.h>
-#include <runtime/Protect.h>
-#include <runtime/UString.h>
-#include <runtime/WeakGCPtr.h>
+#include "Weak.h"
+#include "JSObject.h"
+#include "Protect.h"
+#include "UString.h"
 #include <wtf/HashMap.h>
 
 struct StaticValueEntry {
@@ -69,7 +69,7 @@ struct OpaqueJSClass;
 struct OpaqueJSClassContextData {
     WTF_MAKE_NONCOPYABLE(OpaqueJSClassContextData); WTF_MAKE_FAST_ALLOCATED;
 public:
-    OpaqueJSClassContextData(OpaqueJSClass*);
+    OpaqueJSClassContextData(JSC::JSGlobalData&, OpaqueJSClass*);
     ~OpaqueJSClassContextData();
 
     // It is necessary to keep OpaqueJSClass alive because of the following rare scenario:
@@ -82,10 +82,10 @@ public:
 
     OpaqueJSClassStaticValuesTable* staticValues;
     OpaqueJSClassStaticFunctionsTable* staticFunctions;
-    JSC::WeakGCPtr<JSC::JSObject> cachedPrototype;
+    JSC::Weak<JSC::JSObject> cachedPrototype;
 };
 
-struct OpaqueJSClass : public ThreadSafeShared<OpaqueJSClass> {
+struct OpaqueJSClass : public ThreadSafeRefCounted<OpaqueJSClass> {
     static PassRefPtr<OpaqueJSClass> create(const JSClassDefinition*);
     static PassRefPtr<OpaqueJSClass> createNoAutomaticPrototype(const JSClassDefinition*);
     ~OpaqueJSClass();
diff --git a/Source/JavaScriptCore/API/JSContextRef.cpp b/Source/JavaScriptCore/API/JSContextRef.cpp
index ccab953..03d0622 100644
--- a/Source/JavaScriptCore/API/JSContextRef.cpp
+++ b/Source/JavaScriptCore/API/JSContextRef.cpp
@@ -93,16 +93,16 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
 #endif
 
     if (!globalObjectClass) {
-        JSGlobalObject* globalObject = new (globalData.get()) JSGlobalObject;
+        JSGlobalObject* globalObject = new (globalData.get()) JSGlobalObject(*globalData);
         return JSGlobalContextRetain(toGlobalRef(globalObject->globalExec()));
     }
 
-    JSGlobalObject* globalObject = new (globalData.get()) JSCallbackObject<JSGlobalObject>(globalObjectClass, JSCallbackObject<JSGlobalObject>::createStructure(jsNull()));
+    JSGlobalObject* globalObject = new (globalData.get()) JSCallbackObject<JSGlobalObject>(*globalData, globalObjectClass, JSCallbackObject<JSGlobalObject>::createStructure(*globalData, jsNull()));
     ExecState* exec = globalObject->globalExec();
     JSValue prototype = globalObjectClass->prototype(exec);
     if (!prototype)
         prototype = jsNull();
-    globalObject->resetPrototype(prototype);
+    globalObject->resetPrototype(*globalData, prototype);
     return JSGlobalContextRetain(toGlobalRef(exec));
 }
 
@@ -141,9 +141,10 @@ void JSGlobalContextRelease(JSGlobalContextRef ctx)
     //   it may  release a lot of GC memory - run the garbage collector now.
     // * If there are more references remaining the the global object, then do nothing
     //   (specifically that is more protects, which we assume come from other JSGlobalContextRefs).
-    if (releasingContextGroup)
+    if (releasingContextGroup) {
+        globalData.clearBuiltinStructures();
         globalData.heap.destroy();
-    else if (releasingGlobalObject)
+    } else if (releasingGlobalObject)
         globalData.heap.collectAllGarbage();
 
     globalData.deref();
diff --git a/Source/JavaScriptCore/API/JSObjectRef.cpp b/Source/JavaScriptCore/API/JSObjectRef.cpp
index d3c1993..2df010a 100644
--- a/Source/JavaScriptCore/API/JSObjectRef.cpp
+++ b/Source/JavaScriptCore/API/JSObjectRef.cpp
@@ -79,11 +79,11 @@ JSObjectRef JSObjectMake(JSContextRef ctx, JSClassRef jsClass, void* data)
     APIEntryShim entryShim(exec);
 
     if (!jsClass)
-        return toRef(new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure())); // slightly more efficient
+        return toRef(constructEmptyObject(exec));
 
     JSCallbackObject<JSObjectWithGlobalObject>* object = new (exec) JSCallbackObject<JSObjectWithGlobalObject>(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), jsClass, data);
     if (JSObject* prototype = jsClass->prototype(exec))
-        object->setPrototype(prototype);
+        object->setPrototype(exec->globalData(), prototype);
 
     return toRef(object);
 }
@@ -124,7 +124,7 @@ JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned pa
         args.append(jsString(exec, parameterNames[i]->ustring()));
     args.append(jsString(exec, body->ustring()));
 
-    JSObject* result = constructFunction(exec, args, nameID, sourceURL->ustring(), startingLineNumber);
+    JSObject* result = constructFunction(exec, exec->lexicalGlobalObject(), args, nameID, sourceURL->ustring(), startingLineNumber);
     if (exec->hadException()) {
         if (exception)
             *exception = toRef(exec, exec->exception());
@@ -168,7 +168,7 @@ JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSVal
     for (size_t i = 0; i < argumentCount; ++i)
         argList.append(toJS(exec, arguments[i]));
 
-    JSObject* result = constructDate(exec, argList);
+    JSObject* result = constructDate(exec, exec->lexicalGlobalObject(), argList);
     if (exec->hadException()) {
         if (exception)
             *exception = toRef(exec, exec->exception());
@@ -207,7 +207,7 @@ JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSV
     for (size_t i = 0; i < argumentCount; ++i)
         argList.append(toJS(exec, arguments[i]));
 
-    JSObject* result = constructRegExp(exec, argList);
+    JSObject* result = constructRegExp(exec, exec->lexicalGlobalObject(),  argList);
     if (exec->hadException()) {
         if (exception)
             *exception = toRef(exec, exec->exception());
@@ -235,7 +235,7 @@ void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value
     JSObject* jsObject = toJS(object);
     JSValue jsValue = toJS(exec, value);
 
-    jsObject->setPrototypeWithCycleCheck(jsValue.isObject() ? jsValue : jsNull());
+    jsObject->setPrototypeWithCycleCheck(exec->globalData(), jsValue.isObject() ? jsValue : jsNull());
 }
 
 bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
@@ -340,9 +340,9 @@ void* JSObjectGetPrivate(JSObjectRef object)
 {
     JSObject* jsObject = toJS(object);
     
-    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info))
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::s_info))
         return static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivate();
-    else if (jsObject->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::info))
+    if (jsObject->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::s_info))
         return static_cast<JSCallbackObject<JSObjectWithGlobalObject>*>(jsObject)->getPrivate();
     
     return 0;
@@ -352,10 +352,11 @@ bool JSObjectSetPrivate(JSObjectRef object, void* data)
 {
     JSObject* jsObject = toJS(object);
     
-    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info)) {
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::s_info)) {
         static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivate(data);
         return true;
-    } else if (jsObject->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::info)) {
+    }
+    if (jsObject->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::s_info)) {
         static_cast<JSCallbackObject<JSObjectWithGlobalObject>*>(jsObject)->setPrivate(data);
         return true;
     }
@@ -370,9 +371,9 @@ JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSSt
     JSObject* jsObject = toJS(object);
     JSValue result;
     Identifier name(propertyName->identifier(&exec->globalData()));
-    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info))
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::s_info))
         result = static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivateProperty(name);
-    else if (jsObject->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::info))
+    else if (jsObject->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::s_info))
         result = static_cast<JSCallbackObject<JSObjectWithGlobalObject>*>(jsObject)->getPrivateProperty(name);
     return toRef(exec, result);
 }
@@ -384,11 +385,11 @@ bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRe
     JSObject* jsObject = toJS(object);
     JSValue jsValue = value ? toJS(exec, value) : JSValue();
     Identifier name(propertyName->identifier(&exec->globalData()));
-    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info)) {
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::s_info)) {
         static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivateProperty(exec->globalData(), name, jsValue);
         return true;
     }
-    if (jsObject->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::info)) {
+    if (jsObject->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::s_info)) {
         static_cast<JSCallbackObject<JSObjectWithGlobalObject>*>(jsObject)->setPrivateProperty(exec->globalData(), name, jsValue);
         return true;
     }
@@ -401,11 +402,11 @@ bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStrin
     APIEntryShim entryShim(exec);
     JSObject* jsObject = toJS(object);
     Identifier name(propertyName->identifier(&exec->globalData()));
-    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::info)) {
+    if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::s_info)) {
         static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->deletePrivateProperty(name);
         return true;
     }
-    if (jsObject->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::info)) {
+    if (jsObject->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::s_info)) {
         static_cast<JSCallbackObject<JSObjectWithGlobalObject>*>(jsObject)->deletePrivateProperty(name);
         return true;
     }
diff --git a/Source/JavaScriptCore/API/JSValueRef.cpp b/Source/JavaScriptCore/API/JSValueRef.cpp
index faf4712..e2626be 100644
--- a/Source/JavaScriptCore/API/JSValueRef.cpp
+++ b/Source/JavaScriptCore/API/JSValueRef.cpp
@@ -129,9 +129,9 @@ bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsCla
     JSValue jsValue = toJS(exec, value);
     
     if (JSObject* o = jsValue.getObject()) {
-        if (o->inherits(&JSCallbackObject<JSGlobalObject>::info))
+        if (o->inherits(&JSCallbackObject<JSGlobalObject>::s_info))
             return static_cast<JSCallbackObject<JSGlobalObject>*>(o)->inherits(jsClass);
-        else if (o->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::info))
+        if (o->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::s_info))
             return static_cast<JSCallbackObject<JSObjectWithGlobalObject>*>(o)->inherits(jsClass);
     }
     return false;
diff --git a/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp b/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp
index 8182075..54dfda6 100644
--- a/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp
+++ b/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp
@@ -57,8 +57,8 @@ void JSWeakObjectMapSet(JSContextRef ctx, JSWeakObjectMapRef map, void* key, JSO
     JSObject* obj = toJS(object);
     if (!obj)
         return;
-    ASSERT(obj->inherits(&JSCallbackObject<JSGlobalObject>::info) || obj->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::info));
-    map->map().set(key, obj);
+    ASSERT(obj->inherits(&JSCallbackObject<JSGlobalObject>::s_info) || obj->inherits(&JSCallbackObject<JSObjectWithGlobalObject>::s_info));
+    map->map().set(exec->globalData(), key, obj);
 }
 
 JSObjectRef JSWeakObjectMapGet(JSContextRef ctx, JSWeakObjectMapRef map, void* key)
@@ -68,14 +68,11 @@ JSObjectRef JSWeakObjectMapGet(JSContextRef ctx, JSWeakObjectMapRef map, void* k
     return toRef(static_cast<JSObject*>(map->map().get(key)));
 }
 
-bool JSWeakObjectMapClear(JSContextRef ctx, JSWeakObjectMapRef map, void* key, JSObjectRef object)
+// We need to keep this function in the build to keep the nightlies running.
+JS_EXPORT bool JSWeakObjectMapClear(JSContextRef, JSWeakObjectMapRef, void*, JSObjectRef);
+bool JSWeakObjectMapClear(JSContextRef, JSWeakObjectMapRef, void*, JSObjectRef)
 {
-    ExecState* exec = toJS(ctx);
-    APIEntryShim entryShim(exec);
-    JSObject* obj = toJS(object);
-    if (map->map().uncheckedRemove(key, obj))
-        return true;
-    return false;
+    return true;
 }
 
 #ifdef __cplusplus
diff --git a/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.h b/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.h
index d36111c..01e0611 100644
--- a/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.h
+++ b/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.h
@@ -52,8 +52,7 @@ typedef void (*JSWeakMapDestroyedCallback)(JSWeakObjectMapRef map, void* data);
  @param destructor A function to call when the weak map is destroyed.
  @result A JSWeakObjectMapRef bound to the given context, data and destructor.
  @discussion The JSWeakObjectMapRef can be used as a storage mechanism to hold custom JS objects without forcing those objects to
- remain live as JSValueProtect would.  Any objects that are intended to be stored in a weak map must be user defined objects that
- remove themselves from the map in their finalizer.
+ remain live as JSValueProtect would.
  */
 JS_EXPORT JSWeakObjectMapRef JSWeakObjectMapCreate(JSContextRef ctx, void* data, JSWeakMapDestroyedCallback destructor);
 
@@ -77,17 +76,6 @@ JS_EXPORT void JSWeakObjectMapSet(JSContextRef ctx, JSWeakObjectMapRef map, void
  */
 JS_EXPORT JSObjectRef JSWeakObjectMapGet(JSContextRef ctx, JSWeakObjectMapRef map, void* key);
 
-/*!
- @function
- @abstract Clears the association between a key and an object in a JSWeakObjectMapRef
- @param ctx The execution context to use.
- @param map The map to clear the key association from.
- @param key The key to use.
- @param object The old object value.
- @result Returns true if the key/object association was present in map, and has been removed.
- */
-JS_EXPORT bool JSWeakObjectMapClear(JSContextRef ctx, JSWeakObjectMapRef map, void* key, JSObjectRef object);
-
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/JavaScriptCore/API/OpaqueJSString.h b/Source/JavaScriptCore/API/OpaqueJSString.h
index 473c815..69c0962 100644
--- a/Source/JavaScriptCore/API/OpaqueJSString.h
+++ b/Source/JavaScriptCore/API/OpaqueJSString.h
@@ -33,7 +33,7 @@ namespace JSC {
     class JSGlobalData;
 }
 
-struct OpaqueJSString : public ThreadSafeShared<OpaqueJSString> {
+struct OpaqueJSString : public ThreadSafeRefCounted<OpaqueJSString> {
 
     static PassRefPtr<OpaqueJSString> create() // null
     {
@@ -54,7 +54,7 @@ struct OpaqueJSString : public ThreadSafeShared<OpaqueJSString> {
     JSC::Identifier identifier(JSC::JSGlobalData*) const;
 
 private:
-    friend class WTF::ThreadSafeShared<OpaqueJSString>;
+    friend class WTF::ThreadSafeRefCounted<OpaqueJSString>;
 
     OpaqueJSString()
         : m_characters(0)
diff --git a/Source/JavaScriptCore/API/tests/testapi.c b/Source/JavaScriptCore/API/tests/testapi.c
index 1ecfc7e..28d47bb 100644
--- a/Source/JavaScriptCore/API/tests/testapi.c
+++ b/Source/JavaScriptCore/API/tests/testapi.c
@@ -32,6 +32,10 @@
 #include <wtf/Assertions.h>
 #include <wtf/UnusedParam.h>
 
+#if OS(WINDOWS)
+#include <windows.h>
+#endif
+
 #if COMPILER(MSVC)
 
 #include <wtf/MathExtras.h>
@@ -819,6 +823,13 @@ static bool checkForCycleInPrototypeChain()
 
 int main(int argc, char* argv[])
 {
+#if OS(WINDOWS)
+    // Cygwin calls ::SetErrorMode(SEM_FAILCRITICALERRORS), which we will inherit. This is bad for
+    // testing/debugging, as it causes the post-mortem debugger not to be invoked. We reset the
+    // error mode here to work around Cygwin's behavior. See <http://webkit.org/b/55222>.
+    ::SetErrorMode(0);
+#endif
+
     const char *scriptPath = "testapi.js";
     if (argc > 1) {
         scriptPath = argv[1];
diff --git a/Source/JavaScriptCore/Android.mk b/Source/JavaScriptCore/Android.mk
index 31d6fde..48f326a 100644
--- a/Source/JavaScriptCore/Android.mk
+++ b/Source/JavaScriptCore/Android.mk
@@ -25,7 +25,12 @@
 
 LOCAL_SRC_FILES := \
 	API/JSValueRef.cpp \
+	API/JSCallbackConstructor.cpp \
+	API/JSCallbackFunction.cpp \
 	API/JSCallbackObject.cpp \
+	API/JSClassRef.cpp \
+	API/JSObjectRef.cpp \
+	API/JSStringRef.cpp \
 	API/OpaqueJSString.cpp \
 	\
 	assembler/ARMv7Assembler.cpp \
@@ -43,6 +48,16 @@ LOCAL_SRC_FILES := \
 	debugger/DebuggerActivation.cpp \
 	debugger/DebuggerCallFrame.cpp \
 	\
+	heap/ConservativeRoots.cpp \
+	heap/HandleHeap.cpp \
+	heap/HandleStack.cpp \
+	heap/Heap.cpp \
+	heap/MachineStackMarker.cpp \
+	heap/MarkStack.cpp \
+	heap/MarkStackPosix.cpp \
+	heap/MarkedBlock.cpp \
+	heap/MarkedSpace.cpp \
+	\
 	interpreter/CallFrame.cpp \
 	interpreter/Interpreter.cpp \
 	interpreter/RegisterFile.cpp \
@@ -79,9 +94,6 @@ LOCAL_SRC_FILES := \
 	runtime/BooleanObject.cpp \
 	runtime/BooleanPrototype.cpp \
 	runtime/CallData.cpp \
-	runtime/MarkedBlock.cpp \
-	runtime/MarkedSpace.cpp \
-	runtime/Heap.cpp \
 	runtime/CommonIdentifiers.cpp \
 	runtime/Completion.cpp \
 	runtime/ConstructData.cpp \
@@ -98,9 +110,7 @@ LOCAL_SRC_FILES := \
 	runtime/FunctionConstructor.cpp \
 	runtime/FunctionPrototype.cpp \
 	runtime/GCActivityCallback.cpp \
-	runtime/GCHandle.cpp \
 	runtime/GetterSetter.cpp \
-	runtime/GlobalEvalFunction.cpp \
 	runtime/Identifier.cpp \
 	runtime/InitializeThreading.cpp \
 	runtime/InternalFunction.cpp \
@@ -109,14 +119,13 @@ LOCAL_SRC_FILES := \
 	runtime/JSArray.cpp \
 	runtime/JSByteArray.cpp \
 	runtime/JSCell.cpp \
+	runtime/JSChunk.cpp \
 	runtime/JSFunction.cpp \
 	runtime/JSGlobalData.cpp \
 	runtime/JSGlobalObject.cpp \
 	runtime/JSGlobalObjectFunctions.cpp \
-	runtime/JSImmediate.cpp \
 	runtime/JSLock.cpp \
 	runtime/JSNotAnObject.cpp \
-	runtime/JSNumberCell.cpp \
 	runtime/JSONObject.cpp \
 	runtime/JSObject.cpp \
 	runtime/JSObjectWithGlobalObject.cpp \
@@ -128,10 +137,6 @@ LOCAL_SRC_FILES := \
 	runtime/JSWrapperObject.cpp \
 	runtime/LiteralParser.cpp \
 	runtime/Lookup.cpp \
-	runtime/MachineStackMarker.cpp \
-	runtime/ConservativeSet.cpp \
-	runtime/MarkStack.cpp \
-	runtime/MarkStackPosix.cpp \
 	runtime/MathObject.cpp \
 	runtime/NativeErrorConstructor.cpp \
 	runtime/NativeErrorPrototype.cpp \
@@ -144,7 +149,6 @@ LOCAL_SRC_FILES := \
 	runtime/PropertyDescriptor.cpp \
 	runtime/PropertyNameArray.cpp \
 	runtime/PropertySlot.cpp \
-	runtime/PrototypeFunction.cpp \
 	runtime/RegExp.cpp \
 	runtime/RegExpCache.cpp \
 	runtime/RegExpConstructor.cpp \
@@ -179,6 +183,7 @@ LOCAL_SRC_FILES := \
 	wtf/PageBlock.cpp\
 	wtf/RandomNumber.cpp \
 	wtf/RefCountedLeakCounter.cpp \
+	wtf/SHA1.cpp \
 	wtf/StackBounds.cpp \
 	wtf/TCSystemAlloc.cpp \
 	wtf/ThreadIdentifierDataPthreads.cpp \
@@ -218,6 +223,7 @@ JSC_OBJECTS := $(addprefix $(intermediates)/runtime/, \
 				JSONObject.lut.h \
 				MathObject.lut.h \
 				NumberConstructor.lut.h \
+				ObjectConstructor.lut.h \
 				RegExpConstructor.lut.h \
 				RegExpObject.lut.h \
 				StringPrototype.lut.h \
diff --git a/Source/JavaScriptCore/Android.v8.wtf.mk b/Source/JavaScriptCore/Android.v8.wtf.mk
index 603c454..140186f 100644
--- a/Source/JavaScriptCore/Android.v8.wtf.mk
+++ b/Source/JavaScriptCore/Android.v8.wtf.mk
@@ -42,6 +42,7 @@ LOCAL_SRC_FILES := \
 	wtf/PageBlock.cpp \
 	wtf/RandomNumber.cpp \
 	wtf/RefCountedLeakCounter.cpp \
+	wtf/SHA1.cpp \
 	wtf/StackBounds.cpp \
 	wtf/TCSystemAlloc.cpp \
 	wtf/ThreadIdentifierDataPthreads.cpp \
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index f18826e..c994611 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -6,6 +6,7 @@ SET(JavaScriptCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/assembler"
     "${JAVASCRIPTCORE_DIR}/bytecode"
     "${JAVASCRIPTCORE_DIR}/bytecompiler"
+    "${JAVASCRIPTCORE_DIR}/heap"
     "${JAVASCRIPTCORE_DIR}/debugger"
     "${JAVASCRIPTCORE_DIR}/interpreter"
     "${JAVASCRIPTCORE_DIR}/jit"
@@ -40,6 +41,15 @@ SET(JavaScriptCore_SOURCES
     bytecompiler/BytecodeGenerator.cpp
     bytecompiler/NodesCodegen.cpp
 
+    heap/Heap.cpp
+    heap/HandleHeap.cpp
+    heap/HandleStack.cpp
+    heap/MachineStackMarker.cpp
+    heap/MarkedBlock.cpp
+    heap/MarkedSpace.cpp
+    heap/ConservativeRoots.cpp
+    heap/MarkStack.cpp
+
     debugger/Debugger.cpp
     debugger/DebuggerActivation.cpp
     debugger/DebuggerCallFrame.cpp
@@ -81,9 +91,6 @@ SET(JavaScriptCore_SOURCES
     runtime/BooleanObject.cpp
     runtime/BooleanPrototype.cpp
     runtime/CallData.cpp
-    runtime/MarkedBlock.cpp
-    runtime/MarkedSpace.cpp
-    runtime/Heap.cpp
     runtime/CommonIdentifiers.cpp
     runtime/Completion.cpp
     runtime/ConstructData.cpp
@@ -100,9 +107,7 @@ SET(JavaScriptCore_SOURCES
     runtime/FunctionConstructor.cpp
     runtime/FunctionPrototype.cpp
     runtime/GCActivityCallback.cpp
-    runtime/GCHandle.cpp
     runtime/GetterSetter.cpp
-    runtime/GlobalEvalFunction.cpp
     runtime/Identifier.cpp
     runtime/InitializeThreading.cpp
     runtime/InternalFunction.cpp
@@ -115,10 +120,8 @@ SET(JavaScriptCore_SOURCES
     runtime/JSGlobalData.cpp
     runtime/JSGlobalObject.cpp
     runtime/JSGlobalObjectFunctions.cpp
-    runtime/JSImmediate.cpp
     runtime/JSLock.cpp
     runtime/JSNotAnObject.cpp
-    runtime/JSNumberCell.cpp
     runtime/JSObject.cpp
     runtime/JSObjectWithGlobalObject.cpp
     runtime/JSONObject.cpp
@@ -131,9 +134,6 @@ SET(JavaScriptCore_SOURCES
     runtime/JSZombie.cpp
     runtime/LiteralParser.cpp
     runtime/Lookup.cpp
-    runtime/MachineStackMarker.cpp
-    runtime/ConservativeSet.cpp
-    runtime/MarkStack.cpp
     runtime/MathObject.cpp
     runtime/NativeErrorConstructor.cpp
     runtime/NativeErrorPrototype.cpp
@@ -146,7 +146,6 @@ SET(JavaScriptCore_SOURCES
     runtime/PropertyDescriptor.cpp
     runtime/PropertyNameArray.cpp
     runtime/PropertySlot.cpp
-    runtime/PrototypeFunction.cpp
     runtime/RegExp.cpp
     runtime/RegExpCache.cpp
     runtime/RegExpConstructor.cpp
@@ -182,6 +181,7 @@ SET(JavaScriptCore_LUT_FILES
     runtime/JSONObject.cpp
     runtime/MathObject.cpp
     runtime/NumberConstructor.cpp
+    runtime/ObjectConstructor.cpp
     runtime/RegExpConstructor.cpp
     runtime/RegExpObject.cpp
     runtime/StringPrototype.cpp
@@ -195,28 +195,29 @@ SET(JavaScriptCore_LIBRARIES
 # GENERATOR 1-A: LUT creator
 FOREACH (_file ${JavaScriptCore_LUT_FILES})
     GET_FILENAME_COMPONENT(_name ${_file} NAME_WE)
-    GENERATE_HASH_LUT(${JAVASCRIPTCORE_DIR}/${_file} ${DERIVED_SOURCES_DIR}/${_name}.lut.h)
-    LIST(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_DIR}/${_name}.lut.h)
+    GENERATE_HASH_LUT(${JAVASCRIPTCORE_DIR}/${_file} ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/${_name}.lut.h)
+    LIST(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/${_name}.lut.h)
 ENDFOREACH ()
 
 
 # GENERATOR 1-B: particular LUT creator (for 1 file only)
-GENERATE_HASH_LUT(${JAVASCRIPTCORE_DIR}/parser/Keywords.table ${DERIVED_SOURCES_DIR}/Lexer.lut.h MAIN_DEPENDENCY)
-LIST(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_DIR}/Lexer.lut.h)
+GENERATE_HASH_LUT(${JAVASCRIPTCORE_DIR}/parser/Keywords.table ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Lexer.lut.h MAIN_DEPENDENCY)
+LIST(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Lexer.lut.h)
 
 #GENERATOR: "RegExpJitTables.h": tables used by Yarr
 ADD_CUSTOM_COMMAND(
-    OUTPUT ${DERIVED_SOURCES_DIR}/RegExpJitTables.h
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/RegExpJitTables.h
     MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/create_regex_tables
-    COMMAND ${PYTHON_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/create_regex_tables > ${DERIVED_SOURCES_DIR}/RegExpJitTables.h
+    COMMAND ${PYTHON_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/create_regex_tables > ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/RegExpJitTables.h
     VERBATIM)
-ADD_SOURCE_DEPENDENCIES(${JAVASCRIPTCORE_DIR}/yarr/YarrPattern.cpp ${DERIVED_SOURCES_DIR}/RegExpJitTables.h)
+ADD_SOURCE_DEPENDENCIES(${JAVASCRIPTCORE_DIR}/yarr/YarrPattern.cpp ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/RegExpJitTables.h)
 
 
 
 IF (WTF_CPU_ARM)
     LIST(APPEND JavaScriptCore_SOURCES
         assembler/ARMAssembler.cpp
+        assembler/ARMv7Assembler.cpp
         assembler/MacroAssemblerARM.cpp
     )
 ELSEIF (WTF_CPU_MIPS)
diff --git a/Source/JavaScriptCore/CMakeListsEfl.txt b/Source/JavaScriptCore/CMakeListsEfl.txt
index 9d3c71e..cdc3fe2 100644
--- a/Source/JavaScriptCore/CMakeListsEfl.txt
+++ b/Source/JavaScriptCore/CMakeListsEfl.txt
@@ -1,7 +1,7 @@
 LIST(APPEND JavaScriptCore_SOURCES
     jit/ExecutableAllocatorFixedVMPool.cpp
     jit/ExecutableAllocator.cpp
-    runtime/MarkStackPosix.cpp
+    heap/MarkStackPosix.cpp
     wtf/OSAllocatorPosix.cpp
 )
 
diff --git a/Source/JavaScriptCore/CMakeListsWinCE.txt b/Source/JavaScriptCore/CMakeListsWinCE.txt
index 58a535e..d878863 100644
--- a/Source/JavaScriptCore/CMakeListsWinCE.txt
+++ b/Source/JavaScriptCore/CMakeListsWinCE.txt
@@ -1,7 +1,7 @@
 LIST(APPEND JavaScriptCore_SOURCES
     jit/ExecutableAllocator.cpp
 
-    runtime/MarkStackWin.cpp
+    heap/MarkStackWin.cpp
 )
 
 IF (ENABLE_JIT AND WTF_CPU_ARM)
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 12e0cfd..bb10264 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,9803 +1,4498 @@
-2011-02-13  Jeremy Moskovich  <jeremy@chromium.org>
+2011-04-19  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Adam Barth.
-
-        Add a compile-time option to completely disable WebArchive support.
-        https://bugs.webkit.org/show_bug.cgi?id=52712
-
-        Add an ENABLE(WEB_ARCHIVE) compile-time setting and use it for all WebArchive code.
-        Ports Affected:
-            WebArchive support is currently enabled for all ports that define PLATFORM(CF) apart from Qt.
-            This patch preserves this behavior except that it also disables support in the Chromium port.
-
-        * wtf/Platform.h: Add ENABLE_WEB_ARCHIVE definition and turn it off explicitly for Qt & Chromium ports.
-
-2011-02-13  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Bug 53760 - JSC fails to build with TOT Clang
-        https://bugs.webkit.org/show_bug.cgi?id=53760
-
-        Fix -Woverloaded-virtual warnings. This is also a 6% speedup on the v8 raytrace
-        benchmark; it is nothing-to-noise on everything else.
-
-        * API/JSCallbackObject.h: Remove pointlessly overloaded method.
-        * API/JSCallbackObjectFunctions.h: Ditto.
-        * runtime/Arguments.cpp: 
-        (JSC::Arguments::put): Change signature to match the base class. This implementation
-        was no longer being called by anyone. This wasn't noticed because it is merely an
-        optimization of the base class' implementation.
-        * runtime/Arguments.h: Ditto.
-
-2011-02-12  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Use /dev/urandom as the OSRandomSource on OS(DARWIN)
-        https://bugs.webkit.org/show_bug.cgi?id=54279
-
-        I'm not sure it makes much of a difference whether we use arc4random or
-        /dev/urandom on Mac.  However, there's some aesthetic benefit to using
-        the same underlying API on as many platforms as reasonable.
-
-        * config.h:
-        * wtf/OSRandomSource.cpp:
-        (WTF::cryptographicallyRandomValuesFromOS):
-
-2011-02-12  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Kenneth Russell.
-
-        Enable ArrayBuffers by default
-        https://bugs.webkit.org/show_bug.cgi?id=54310
-
-        Export the required functions.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2011-02-11  Daniel Bates  <dbates@rim.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Remove explicit disable ENABLE_ASSEMBLER_WX_EXCLUSIVE on non-iOS ports
-        https://bugs.webkit.org/show_bug.cgi?id=54107
-        
-        It is unnecessary to explicitly disable ENABLE_ASSEMBLER_WX_EXCLUSIVE
-        by the definition of ENABLE().
-
-        * wtf/Platform.h:
-
-2011-02-11  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-
-        Randomly touch some build files in the hopes of fixing the Qt build.
-
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.pro:
-
-2011-02-11  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Garbage collection timer cycles forever, even when nothing is happening
-        https://bugs.webkit.org/show_bug.cgi?id=54320
-        
-        (Rolling back in r78386 with the build fixed.)
-
-        * runtime/GCActivityCallbackCF.cpp:
-        (JSC::DefaultGCActivityCallbackPlatformData::trigger): Be sure to make
-        our timer inert after forcing a GC, to avoid GC'ing repeatedly.
-
-2011-02-11  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Used svn merge -r78386:78385 to roll out r78386 because it broke the build.
-
-        * runtime/GCActivityCallbackCF.cpp:
-        (JSC::DefaultGCActivityCallbackPlatformData::trigger):
-
-2011-02-11  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Garbage collection timer cycles forever, even when nothing is happening
-        https://bugs.webkit.org/show_bug.cgi?id=54320
-
-        * runtime/GCActivityCallbackCF.cpp:
-        (JSC::DefaultGCActivityCallbackPlatformData::trigger): Be sure to make
-        our timer inert after forcing a GC, to avoid GC'ing repeatedly.
-
-2011-02-11  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix the Windows build: added an exported symbol.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2011-02-11  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        A little more encapsulation for the heap: Removed CollectorHeapIterator
-        https://bugs.webkit.org/show_bug.cgi?id=54298
-        
-        CollectorHeapIterator is a God object that knows the internals of each
-        of the pieces of the heap. This undermines the encapsulation I'm trying
-        to achieve by splitting concepts into different classes.
-        
-        As an alternative, I've given each class a forEach iteration function,
-        which takes a functor as an argument. Now, each class just needs to
-        know how to iterate the things it knows about.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.exp:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Removed CollectorHeapIterator.
-
-        * debugger/Debugger.cpp:
-        (JSC::Recompiler::Recompiler):
-        (JSC::Recompiler::~Recompiler):
-        (JSC::Recompiler::operator()):
-        (JSC::Debugger::recompileAllJSFunctions): Updated to use forEach interface
-        instead of an iterator.
-
-        * runtime/CollectorHeapIterator.h: Removed.
-
-        * runtime/Heap.cpp:
-        (JSC::TypeCounter::TypeCounter):
-        (JSC::TypeCounter::typeName):
-        (JSC::TypeCounter::operator()):
-        (JSC::TypeCounter::take):
-        (JSC::Heap::protectedObjectTypeCounts):
-        (JSC::Heap::objectTypeCounts): Added forEach and removed iterator.
-
-        * runtime/Heap.h:
-        (JSC::Heap::forEach):
-        * runtime/JSGlobalData.cpp:
-        (JSC::Recompiler::operator()):
-        (JSC::JSGlobalData::recompileAllJSFunctions):
-
-        * runtime/MarkedBlock.h:
-        (JSC::MarkedBlock::forEach): Added forEach. Removed friend declaration
-        for CollectorHeapIterator. Now, we can make all our data private and
-        change it without breaking any other classes.
-
-        * runtime/MarkedSpace.cpp:
-        * runtime/MarkedSpace.h:
-        (JSC::MarkedSpace::forEach): Added forEach and removed iterator.
-
-2011-02-11  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Andreas Kling.
-
-        CryptographicRandomNumber has its threading ifdefs backwards
-        https://bugs.webkit.org/show_bug.cgi?id=54280
-
-        Turns out we want the mutex when thread is enabled.  :)
-
-        * wtf/CryptographicallyRandomNumber.cpp:
-        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomNumber):
-        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomValues):
-
-2011-02-10  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        WebKit should have a cryptographic RNG
-        https://bugs.webkit.org/show_bug.cgi?id=22049
-
-        Teach JavaScriptCore how to export this function.
-
-        * JavaScriptCore.exp:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2011-02-10  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        A little more encapsulation for MarkedBlock: Made all constants private
-        so clients don't know whether allocations are fixed-sized or not
-        https://bugs.webkit.org/show_bug.cgi?id=54270
-        
-        SunSpider reports no change.
-
-        * runtime/CollectorHeapIterator.h:
-        (JSC::CollectorHeapIterator::advance): Updated for removal of HeapConstants.
-
-        * runtime/Error.cpp: Switched to using ASSERT_CLASS_FITS_IN_CELL, like
-        all other classes.
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::allocate): Updated for removal of HeapConstants.
-        (JSC::Heap::reset): Updated to use size(), instead of calculating size
-        on our own.
-
-        * runtime/Heap.h: Moved the ASSERT here to MarkedBlock, since it enforces
-        on special knowledge of fixed-sizery, which only MarkedBlock is supposed
-        to know about.
-
-        * runtime/JSCell.h:
-        (JSC::JSCell::MarkedBlock::allocate): Updated for removal of HeapConstants.
-        Also changed to reset nextCell to 0 at the end of a block, since that
-        seems more consistent.
-
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::storeVPtrs): Changed to use a fixed array of char.
-        This hard-coded size is a little wonky, but the compiler will tell us
-        if it's ever wrong, so I think it's OK.
-
-        * runtime/MarkedBlock.cpp:
-        (JSC::MarkedBlock::destroy):
-        (JSC::MarkedBlock::MarkedBlock):
-        (JSC::MarkedBlock::sweep): Updated for removal of HeapConstants.
-
-        * runtime/MarkedBlock.h:
-        (JSC::MarkedBlock::isEmpty):
-        (JSC::MarkedBlock::clearMarks):
-        (JSC::MarkedBlock::size):
-        (JSC::MarkedBlock::capacity): Made constants private to this class.
-        Removed HeapConstants. Added size() and capacity() functions.
-
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::allocate):
-        (JSC::MarkedSpace::objectCount):
-        (JSC::MarkedSpace::size):
-        (JSC::MarkedSpace::capacity):
-        * runtime/MarkedSpace.h: Use MarkedBlock helper functions instead of
-        direct knowledge of MarkedBlock internals.
-
-2011-02-10  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        A little more encapsulation for MarkedBlock: Made mark bits private
-        https://bugs.webkit.org/show_bug.cgi?id=54264
-        
-        SunSpider reports no change.
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::markRoots):
-        (JSC::Heap::reset): Renamed clearMarkBits => clearMarks, since clients
-        don't need to know that marks are represented as bits. Renamed
-        markedCells => markCount, since clients don't need to know that blocks
-        are split into cells.
-
-        * runtime/MarkedBlock.h:
-        (JSC::MarkedBlock::isEmpty):
-        (JSC::MarkedBlock::clearMarks):
-        (JSC::MarkedBlock::markCount): New helper functions for encapsulating
-        the information clients actually need.
-
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::destroy):
-        (JSC::MarkedSpace::shrink):
-        (JSC::MarkedSpace::clearMarks):
-        (JSC::MarkedSpace::markCount):
-        (JSC::MarkedSpace::objectCount):
-        * runtime/MarkedSpace.h: Use new helper functions instead of accessing
-        MarkedBlock data directly.
-
-2011-02-10  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Cached JavaScript Parser Data Being Left in Memory Cache
-        https://bugs.webkit.org/show_bug.cgi?id=54245
-
-        Added clear method which removes SourceProviderCache items.
-        Cleaned up extraneous whitespace.
-
-        * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * parser/SourceProviderCache.cpp:
-        (JSC::SourceProviderCache::~SourceProviderCache):
-        (JSC::SourceProviderCache::clear):
-        (JSC::SourceProviderCache::byteSize):
-        (JSC::SourceProviderCache::add):
-        * parser/SourceProviderCache.h:
-
-2011-02-10  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Follow-up fix to r78291. I should pass (int) 0, not '0' to memset. 
-
-        * runtime/GCActivityCallbackCF.cpp:
-        (JSC::DefaultGCActivityCallback::commonConstructor): fix mistaken post-review change.
-
-2011-02-10  Joseph Pecoraro  <joepeck@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Make DefaultGCActivityCallback for PLATFORM(CF) Easier to Subclass
-        https://bugs.webkit.org/show_bug.cgi?id=54257
-
-        A subclass may want to specify the CFRunLoop that the Garbage Collection
-        will happen on. It was difficult to manipulate this in a subclass because
-        the current DefaultGCActivityCallback class does this in its constructor.
-        This patch generalizes things a bit more so that a specific run loop can
-        be passed in to the constructor. This makes it so all run loop management
-        can stay in DefaultGCActivityCallback and a subclass can specify any runloop.
-
-        * runtime/GCActivityCallback.h: expose a PLATFORM(CF) constructor that can
-        specify the runloop GC can be scheduled on.
-        * runtime/GCActivityCallbackCF.cpp:
-        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): two constructors,
-        one that specifies the run loop and passes that on to commonConstructor and
-        the old constructor defaults to the current run loop.
-        (JSC::DefaultGCActivityCallback::commonConstructor): do normal construction,
-        adding the timer to the given runloop.
-
-2011-02-10  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        A little more encapsulation for MarkedBlock: Moved allocate() and sweep() into MarkedBlock
-        https://bugs.webkit.org/show_bug.cgi?id=54253
-        
-        SunSpider reports no change.
-
-        * runtime/CollectorHeapIterator.h: Removed DeadObjectIterator, since it
-        is now unused.
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::reset): Moved the call to shrink() here, since it seems a
-        little more clear for MarkedSpace's client to tell it explicitly when to
-        shrink.
-
-        * runtime/JSCell.h:
-        (JSC::JSCell::MarkedBlock::allocate): Split out from MarkedSpace::allocate.
-
-        * runtime/MarkedBlock.cpp:
-        (JSC::MarkedBlock::sweep): Split out from MarkedSpace::sweep, and
-        converted to more directly iterate a MarkedBlock based on knowing its
-        internal structure.
-
-        * runtime/MarkedBlock.h:
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::allocate):
-        (JSC::MarkedSpace::sweep):
-        * runtime/MarkedSpace.h: Split out the code mentioned above.
-
-2011-02-10  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Andreas Kling.
-
-        Fix compilation error on OpenBSD
-        https://bugs.webkit.org/show_bug.cgi?id=53766
-
-        Add a HAVE_STRNSTR in Platform.h and define it only on Darwin and FreeBSD.
-
-        * wtf/Platform.h:
-        * wtf/StringExtras.h: Use HAVE(STRNSTR) now.
-
-2011-02-10  Adam Roben  <aroben@apple.com>
-
-        Print locations of assertions and logs in a way that Visual Studio understands
-
-        With this change, double-clicking one of these locations in Visual Studio's Output Window
-        will focus that line of code in the editor.
-
-        Fixes <http://webkit.org/b/54208> Double-clicking locations of assertions/logs in Visual
-        Studio's Output Window does nothing
-
-        Reviewed by Alexey Proskuryakov.
-
-        * wtf/Assertions.cpp:
-        (printCallSite): Use OS(WINDOWS) instead of the meaningless OS(WIN). When we aren't using
-        the debug CRT (and thus can't call _CrtDbgReport), print the file and line number using the
-        same format that cl.exe uses when it prints compiler errors.
-
-2011-02-10  Dan Bernstein  <mitz@apple.com>
+        Reviewed by Gavin Barraclough.
 
-        LLVM Compiler build fix.
+        Remove unneeded deprecated methods from MarkStack
+        https://bugs.webkit.org/show_bug.cgi?id=58853
 
-        * runtime/MarkedBlock.cpp:
-        (JSC::MarkedBlock::create):
+        Remove deprecated methods
 
-2011-02-10  Peter Varga  <pvarga@webkit.org>
+        * heap/MarkStack.h:
 
-        Reviewed by Csaba Osztrogonác.
+2011-04-19  Mark Rowe  <mrowe@apple.com>
 
-        Remove PCRE source from trunk
-        https://bugs.webkit.org/show_bug.cgi?id=54188
+        Things work best when the Xcode project refers to the file at a path that exists.
 
-        * Android.mk:
-        * Android.v8.wtf.mk:
-        * CMakeLists.txt:
-        * DerivedSources.make:
-        * DerivedSources.pro:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.order:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
-        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
-        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
         * JavaScriptCore.xcodeproj/project.pbxproj:
-        * pcre/AUTHORS: Removed.
-        * pcre/COPYING: Removed.
-        * pcre/dftables: Removed.
-        * pcre/pcre.h: Removed.
-        * pcre/pcre.pri: Removed.
-        * pcre/pcre_compile.cpp: Removed.
-        * pcre/pcre_exec.cpp: Removed.
-        * pcre/pcre_internal.h: Removed.
-        * pcre/pcre_tables.cpp: Removed.
-        * pcre/pcre_ucp_searchfuncs.cpp: Removed.
-        * pcre/pcre_xclass.cpp: Removed.
-        * pcre/ucpinternal.h: Removed.
-        * pcre/ucptable.cpp: Removed.
-        * wscript:
-
-2011-02-10  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Add randomValuesFromOS for OS(WINDOWS)
-        https://bugs.webkit.org/show_bug.cgi?id=54155
 
-        Use CryptGenRandom for generating cryptographically secure random numbers.
-        This will work on WinCE and MinGW too.
-
-        * config.h:
-        * wtf/OSRandomSource.cpp:
-        (WTF::randomValuesFromOS):
-
-2011-02-10  Jarred Nicholls  <jarred@sencha.com>
-
-        Reviewed by Adam Barth.
-
-        REGRESSION(r78149): Return value of read() shouldn't be ignored.
-        https://bugs.webkit.org/show_bug.cgi?id=54167
-        
-        stdio read should have its return value handled. Build error in gcc 4.4.5.
-
-        * wtf/OSRandomSource.cpp:
-        (WTF::randomValuesFromOS):
-
-2011-02-10  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Rename randomValuesFromOS to cryptographicallyRandomValuesFromOS
-        https://bugs.webkit.org/show_bug.cgi?id=54156
-
-        randomValuesFromOS generates random numbers of cryptographic quality.
-        Make this clear by adding "cryptographically" to the function name.
-
-        * wtf/CryptographicallyRandomNumber.cpp:
-        (WTF::ARC4Stream::ARC4RandomNumberGenerator::stir):
-        * wtf/OSRandomSource.cpp:
-        (WTF::cryptographicallyRandomValuesFromOS):
-        * wtf/OSRandomSource.h:
-
-2011-02-09  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        <rdar://problem/8805364> Malloc zone enumeration code should be safe in the face of errors from the memory reader.
-
-        * wtf/FastMalloc.cpp:
-        (WTF::PageHeapAllocator::recordAdministrativeRegions): Use the new helper function to walk the linked list safely.
-        (WTF::TCMalloc_ThreadCache_FreeList::enumerateFreeObjects): Ditto.
-        (WTF::TCMalloc_Central_FreeList::enumerateFreeObjects): Ditto.
-        (WTF::TCMallocStats::PageMapFreeObjectFinder::visit): Bail out if the span could not be read.
-        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::visit): Ditto.
-        * wtf/MallocZoneSupport.h:
-        (WTF::RemoteMemoryReader::operator()): Remove an assert that is not valid.
-        (WTF::RemoteMemoryReader::nextEntryInLinkedList): Add a helper function for retrieving the next entry in
-        a linked list. It maps a failed read of the remote memory in to a null pointer, which all callers can
-        handle gracefully.
-
-2011-02-09  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 54164 - Optimize global_var accesses on JSVALUE64
-
-        Directly embed the pointer to d->registers, optimize out the load
-        from the variable object, as we do already in JSVALUE32_64.
-
-        This is a ~1.5% win on sunspidey.
-
-        * jit/JIT.cpp:
-        * jit/JIT.h:
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_get_global_var):
-        (JSC::JIT::emit_op_put_global_var):
-        (JSC::JIT::emit_op_get_scoped_var):
-        (JSC::JIT::emit_op_put_scoped_var):
-
-2011-02-09  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        A little more encapsulation for MarkedBlock: Made MarkedBlock responsible
-        for its own initialization and destruction
-        https://bugs.webkit.org/show_bug.cgi?id=54137
-
-        * runtime/CollectorHeapIterator.h: Removed ObjectIterator since it is
-        now unused.
-
-        * runtime/JSCell.h: Maded MarkedBlock a friend so it can construct and
-        destruct JSCells.
-
-        * runtime/MarkedBlock.cpp:
-        (JSC::MarkedBlock::create):
-        (JSC::MarkedBlock::destroy):
-        (JSC::MarkedBlock::MarkedBlock): Migrated initialization and destruction
-        code from MarkedSpace, updating it not to use ObjectIterator. We don't
-        want to use an abstract iterator since iteration will be unique to each
-        block in the future.
-
-        * runtime/MarkedBlock.h: Made the consructor private and moved it into
-        the .cpp file because it's big now.
-
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::allocateBlock):
-        (JSC::MarkedSpace::freeBlock): Migrated code.
-
-        * runtime/MarkedSpace.h:
-        (JSC::CollectorHeap::collectorBlock): Keep a vector of MarkedBlock
-        pointers instead of aligned allocations -- how MarkedBlocks are allocated
-        is now an implementation detail of MarkedBlock.
-
-2011-02-09  Adam Barth  <abarth@webkit.org>
-
-        Another attempt to fix the Qt Windows build.
-
-        * config.h:
-        * wtf/OSRandomSource.cpp:
-        (WTF::randomValuesFromOS):
-
-2011-02-09  Adam Barth  <abarth@webkit.org>
-
-        Attempt to fix the Qt Windows build.
-
-        * wtf/OSRandomSource.cpp:
-        (WTF::randomValuesFromOS):
-
-2011-02-09  Adam Barth  <abarth@webkit.org>
+2011-04-19  Renata Hodovan  <reni@webkit.org>
 
         Reviewed by Eric Seidel.
 
-        Add WTF::cryptographicallyRandomNumber
-        https://bugs.webkit.org/show_bug.cgi?id=54083
+        Move the alignment related macros in Vector.h to new Alignment.h.
+        https://bugs.webkit.org/show_bug.cgi?id=56000
 
-        Introduce a cryptographically strong random number generator to WTF.
-        The random number generator is based on arc4random as found in:
-
-        http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/crypt/arc4random.c?rev=1.22
-
-        I've changed to source to WebKit style and abstracted the operating
-        system interaction to OSRandomSource.  We'll use this functionality to
-        expose a cryptographically strong random number generator to
-        JavaScript.
-
-        * Android.mk:
-        * Android.v8.wtf.mk:
-        * GNUmakefile.am:
         * JavaScriptCore.gypi:
         * JavaScriptCore.vcproj/WTF/WTF.vcproj:
         * JavaScriptCore.xcodeproj/project.pbxproj:
-        * config.h:
+        * wtf/Alignment.h: Added.
         * wtf/CMakeLists.txt:
-        * wtf/CryptographicallyRandomNumber.cpp: Added.
-        (WTF::initMutexIfNeeded):
-        (WTF::init):
-        (WTF::addRandomData):
-        (WTF::stir):
-        (WTF::stirIfNeeded):
-        (WTF::getByte):
-        (WTF::getWord):
-        (WTF::cryptographicallyRandomNumber):
-        (WTF::cryptographicallyRandomValues):
-        * wtf/CryptographicallyRandomNumber.h: Added.
-        * wtf/OSRandomSource.cpp: Added.
-        (WTF::randomValuesFromOS):
-        * wtf/OSRandomSource.h: Added.
-        * wtf/wtf.pri:
-
-2011-02-09  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix the build.
-
-        * wtf/Bitmap.h: Include string.h for memset. Not sure why this started
-        failing now.
-
-2011-02-09  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        A tiny bit of encapsulation for MarkedBlock: made its heap data member private
-        https://bugs.webkit.org/show_bug.cgi?id=54129
-
-        * runtime/MarkedBlock.h:
-        (JSC::MarkedBlock::isCellAligned):
-        (JSC::MarkedBlock::MarkedBlock):
-        (JSC::MarkedBlock::heap): Made the heap data member private, and provided
-        a constructor and an accessor.
-
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::allocateBlock):
-        * runtime/MarkedSpace.h:
-        (JSC::MarkedSpace::heap): Use the constructor and accessor.
+        * wtf/Vector.h:
 
-2011-02-09  Peter Varga  <pvarga@webkit.org>
+2011-04-19  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Gavin Barraclough.
 
-        Replace PCRE with Yarr in WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=53496
-
-        * JavaScriptCore.exp:
-        * JavaScriptCore.gyp/JavaScriptCore.gyp:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * create_regex_tables:
-        * runtime/RegExp.cpp:
-        * wtf/Platform.h:
-        * yarr/Yarr.h:
-        * yarr/YarrJIT.cpp:
-        * yarr/YarrJIT.h:
-        * yarr/YarrParser.h:
-        * yarr/YarrPattern.h:
-        * yarr/YarrSyntaxChecker.h:
-        * yarr/yarr.pri: Added.
-
-2011-02-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Removed some dead code from Heap
-        https://bugs.webkit.org/show_bug.cgi?id=54064
-
-        * runtime/MarkedSpace.cpp: Removed some now-unused constants and
-        declarations.
-
-        (JSC::MarkedSpace::allocate): Removed some ASSERTs that are also ASSERTed
-        by our caller. Removed redundant typedefs.
-
-2011-02-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Use a vector to track blocks in the Heap, instead of hand-rolled vector-like code
-        https://bugs.webkit.org/show_bug.cgi?id=54062
-        
-        SunSpider reports no change.
-
-        * runtime/CollectorHeapIterator.h:
-        (JSC::CollectorHeapIterator::isValid):
-        (JSC::CollectorHeapIterator::isLive): Updated for new mark invariant: To
-        know if an object is live, you just need to test its mark bit.
-
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::MarkedSpace): Moved waterMark and highWaterMark from
-        CollectorHeap into MarkedSpace, since they're global state. Removed call
-        to memset since CollectorHeap is a true class with its own constructor now.
-
-        (JSC::MarkedSpace::destroy): Change uses of m_heap.usedBlocks to
-        m_heap.blocks.size(), and m_heap.numBlocks to m_heap.blocks.capacity().
-
-        (JSC::MarkedSpace::allocateBlock):
-        (JSC::MarkedSpace::freeBlock): No need to manage our vector manually anymore.
-
-        (JSC::MarkedSpace::allocate):
-        (JSC::MarkedSpace::shrink):
-        (JSC::MarkedSpace::clearMarkBits):
-        (JSC::MarkedSpace::markedCells):
-        (JSC::MarkedSpace::sweep):
-        (JSC::MarkedSpace::objectCount):
-        (JSC::MarkedSpace::capacity):
-        (JSC::MarkedSpace::reset):
-        (JSC::MarkedSpace::primaryHeapEnd):
-        * runtime/MarkedSpace.h:
-        (JSC::CollectorHeap::CollectorHeap):
-        (JSC::MarkedSpace::highWaterMark):
-        (JSC::MarkedSpace::setHighWaterMark):
-        (JSC::MarkedSpace::contains): Same as above.
-
-2011-02-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Give each MarkedBlock enough mark bits to cover the whole block
-        https://bugs.webkit.org/show_bug.cgi?id=54029
-        
-        SunSpider reports no change.
-
-        This simplifies access to mark bits, since any cell-aligned pointer
-        into a block now has a valid mark bit to test.
-        
-        * runtime/MarkedBlock.h: Changed CELLS_PER_BLOCK to account for the extra
-        mark bits. This happens not to change its actual value.
-        (JSC::MarkedBlock::cellNumber):
-        (JSC::MarkedBlock::isMarked):
-        (JSC::MarkedBlock::testAndSetMarked):
-        (JSC::MarkedBlock::setMarked): Changed const JSCell* to const void* to
-        remove a cast from our caller, and to more accurately reflect the fact
-        that MarkedBlock is agnostic about the types pointed to by the pointers
-        you pass to it.
-
-        (JSC::MarkedBlock::isPossibleCell): Removed a null check. We now consider
-        the null pointer to be a possible cell with a 0 (impossible) block. This
-        removes a null check from marking.
-
-        * runtime/MarkedSpace.cpp:
-        * runtime/MarkedSpace.h:
-        (JSC::MarkedSpace::contains): Simplified the contains check, and inlined
-        the whole thing, now that it's so simple.
-
-2011-02-08  Daniel Bates  <dbates@rim.com>
-
-        Rubber-stamped by Martin Robinson.
-
-        Rename enum ProtectionSeting [sic] to ProtectionSetting.
-
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutableAllocator::reprotectRegion):
-        * jit/ExecutableAllocator.h:
-
-2011-02-08  Balazs Kelemen  <kbalazs@webkit.org>
-
-        Reviewed by Andreas Kling.
+        Remove DeprecatedPtr
+        https://bugs.webkit.org/show_bug.cgi?id=58718
 
-        [Qt] Should not always define USE_SYSTEM_MALLOC
-        https://bugs.webkit.org/show_bug.cgi?id=54007
-
-        * wtf/Platform.h:
-
-2011-02-08  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        LLVM Compiler build fix.
+        Remove the class an all functions that still exist to support it.
 
+        * heap/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/JSValue.h:
         * runtime/WriteBarrier.h:
-        (JSC::WriteBarrier::WriteBarrier):
 
-2011-02-07  Ryosuke Niwa  <rniwa@webkit.org>
+2011-04-19  Jungshik Shin  <jshin@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by David Levin
 
-        JSVariableObject::setRegisters should take PassOwnArrayPtr for registersArray.
-        https://bugs.webkit.org/show_bug.cgi?id=53902
+        Add U+FEFF (Zero width no-break space) to CharacterNames.h.
+        It's added to the list of characters to treat as zero-width
+        in WebCore.
 
-        * runtime/Arguments.h:
-        (JSC::JSActivation::copyRegisters): Uses OwnArrayPtr<Register> instead of Register*.
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::copyGlobalsFrom): Ditto.
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::setRegisters): Takes PassOwnArrayPtr<Register> instead of Register*
-        for registerArray.
-        * runtime/JSVariableObject.h:
-        (JSC::JSVariableObject::copyRegisterArray): Returns PassOwnArrayPtr<Register> instead of Register*.
-        (JSC::JSVariableObject::setRegisters): Takes PassOwnArrayPtr<Register> instead of Register*
-        for registerArray.
-
-2011-02-07  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
+        https://bugs.webkit.org/show_bug.cgi?id=48860
 
-        Removed some dead code from Heap
-        https://bugs.webkit.org/show_bug.cgi?id=53969
-        
-        SunSpider reports no change.
-
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::shrink):
-        (JSC::MarkedSpace::sweep):
-        * runtime/MarkedSpace.h: Removed resizeBlocks and growBlocks, and
-        renamed shrinkBlocks to shrink, making it unconditionally shrink as
-        much as possible.
-
-2011-02-07  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Simplified the marked space's mark invariant
-        https://bugs.webkit.org/show_bug.cgi?id=53968
-        
-        SunSpider reports no change.
-        
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::allocate): Mark objects when allocating them. This
-        means that, at all times other than the mark phase, an object is live
-        if and only if it is marked.
-
-        (JSC::MarkedSpace::containsSlowCase): Use the new mark invariant to
-        simplify testing whether an object is live.
-
-2011-02-07  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=53950
-        USE_WK_SCROLLBAR_PAINTER in ScrollbarThemeMac should be in
-        Platform.h instead
-
-        * wtf/Platform.h:
-
-2011-02-07  Darin Adler  <darin@apple.com>
-
-        Reviewed by Antti Koivisto.
+        * wtf/unicode/CharacterNames.h:
 
-        Add built-in decoder for UTF-8 for improved performance
-        https://bugs.webkit.org/show_bug.cgi?id=53898
+2011-04-19  Csaba Osztrogonác  <ossy@webkit.org>
 
-        * wtf/unicode/UnicodeMacrosFromICU.h: Added U8_MAX_LENGTH and
-        U8_APPEND_UNSAFE. Also fixed header.
+        [Qt] REGRESSION(84176): http/tests/xmlhttprequest/event-listener-gc.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=58871
 
-2011-02-07  Adam Roben  <aroben@apple.com>
+        Unreviewed, rolling out r84176, r84178, r84186, r84212 and r84231.
+        http://trac.webkit.org/changeset/84176 (original patch)
+        http://trac.webkit.org/changeset/84178 (original patch - part 2)
+        http://trac.webkit.org/changeset/84186 (build fix)
+        http://trac.webkit.org/changeset/84212
+        http://trac.webkit.org/changeset/84231 (skip failing test)
 
-        Delete precompiled headers whenever any .vsprops file changes
+        original bugs:
+         - https://bugs.webkit.org/show_bug.cgi?id=58718
+         - https://bugs.webkit.org/show_bug.cgi?id=58853
 
-        Precompiled headers need to be rebuilt if, e.g., an ENABLE_* macro is changed in one of our
-        .vsprops files. Unfortunately, Visual Studio isn't smart enough to figure this out, so we
-        give it some assistance by deleting the precompiled headers whenever any .vsprops file
-        changes.
-
-        I also made some drive-by fixes while I was in the area.
-
-        Fixes <http://webkit.org/b/53826> react-to-vsprops-changes.py doesn't force precompiled
-        headers to be rebuilt, but should
+        * heap/MarkStack.h:
+        (JSC::MarkStack::deprecatedAppendValues):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::deprecatedAppend):
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::operator==):
 
-        Reviewed by David Kilzer.
+2011-04-18  Oliver Hunt  <oliver@apple.com>
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Stop ignoring the
-        return code from react-to-vsprops-changes.py so we will notice when errors are introduced.
-        But skip the script entirely in production builds, where it is both unnecessary and can't
-        function correctly (due to not having the entire source tree available to it).
+        Reviewed by Gavin Barraclough.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
-        (main): Removed an extra '*' in the glob for finding manifest files. The extra '*' was
-        leftover from before we rearranged WebKitBuild in r75138. Moved code to delete an old file
-        to the new delete_if_older_than function. Added code to delete any precompiled headers older
-        than the newest .vsprops file.
-        (delete_if_older_than): Added. Code came from main.
+        Remove unneeded deprecated methods from MarkStack
+        https://bugs.webkit.org/show_bug.cgi?id=58853
 
-2011-02-07  Antti Koivisto  <antti@apple.com>
+        Remove deprecated methods
 
-        Not reviewed.
-        
-        ASSERTS_DISABLED -> ASSERT_DISABLED
+        * heap/MarkStack.h:
 
-        * wtf/BloomFilter.h:
+2011-04-18  Oliver Hunt  <oliver@apple.com>
 
-2011-02-06  Ryosuke Niwa  <rniwa@webkit.org>
+        Reviewed by Adam Roben.
 
-        Unreviewed; speculative Qt build fix.
+        Off by one initialising repeat callframe
+        https://bugs.webkit.org/show_bug.cgi?id=58838
+        <rdar://problem/8756810>
 
-        * JavaScriptCore.pro:
+        If the end of a callframe made for a repeat call landed on
+        a page boundary the following page may not have been committed
+        which means that the off by one could lead to a crash.  However
+        it could only happen in this case and only on windows which is
+        why it was so hard to repro.  Alas given the steps needed to
+        reproduce are such that it's not really possible to make a
+        testcase.
 
-2011-02-06  Ryosuke Niwa  <rniwa@webkit.org>
+        This fix makes the code a little less squirrely by not trying
+        to avoid the unnecessary initialisation of |this|.
 
-        Reviewed by Darin Adler.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall):
 
-        OwnArraryPtr.h uses deleteOwnedPtr but doesn’t include OwnPtrCommon.h
-        https://bugs.webkit.org/show_bug.cgi?id=52867
+2011-04-18  Gavin Barraclough  <barraclough@apple.com>
 
-        Removed LOOSE_OWN_ARRAY_PTR and OwnArrayPtr<T>::set. Replaced all calls to OwnArrayPtr::set
-        and loose instantiation of OwnArrayPtr by calls to operator= and adoptArrayPtr. Also removed
-        OwnArrayPtrCommon.h since PassOwnArrayPtr.h needs to include OwnArrayPtr.h and there is
-        no point in putting deleteOwnedArrayPtr into a separate header.
-        
-        Note: if this patch breaks build, the code is either instiantiating OwnArrayPtr
-        without calling adoptArrayPtr or calling set on ArrayOwnPtr instead of operator=.
-
-        No tests are added since this is a refactoring.
+        Reviewed by Geoff Garen.
 
-        * API/JSStringRefCF.cpp:
-        (JSStringCreateWithCFString): Calls adoptArrayPtr.
-        * GNUmakefile.am: Removed OwnArrayPtrCommon.h
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::deleteProperty): Calls adoptArrayPtr.
-        * runtime/Arguments.h:
-        (JSC::Arguments::copyRegisters): Ditto.
-        * runtime/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::JSPropertyNameIterator): Ditto.
-        * runtime/JSVariableObject.h:
-        (JSC::JSVariableObject::setRegisters): Calls operator= instead of set.
-        * runtime/StructureChain.cpp:
-        (JSC::StructureChain::StructureChain): Ditto.
-        * wtf/CMakeLists.txt:
-        * wtf/DateMath.h:
-        (JSC::GregorianDateTime::GregorianDateTime): No longer instnatiates OwnArrayPtr
-        with a null pointer.
-        * wtf/OwnArrayPtr.h:
-        * wtf/OwnArrayPtrCommon.h: Removed.
-        * wtf/PassOwnArrayPtr.h: No longer includes OwnArrayCommon.h
-        (WTF::deleteOwnedArrayPtr): Moved from OwnArrayPtrCommon.h
+        Bug 58829 - DFG JIT - Optimize add/sub immediate, multiply.
 
-2011-02-06  Antti Koivisto  <antti@apple.com>
+        Add code generation for add/subtract instruction with immediate operands
+        (where a child is a constant), and don't bail to non-speculative if an
+        integer multiple results in a +0 result (only if it should be generating -0).
 
-        Reviewed by Maciej Stachowiak.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isDoubleConstantWithInt32Value):
 
-        Use bloom filter for descendant selector filtering
-        https://bugs.webkit.org/show_bug.cgi?id=53880
-        
-        Implement a bloom filter with k=2 and 8 bit counting.
+2011-04-18  Gavin Barraclough  <barraclough@apple.com>
 
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/BloomFilter.h: Added.
-        (WTF::BloomFilter::maximumCount):
-        (WTF::BloomFilter::BloomFilter):
-        (WTF::BloomFilter::mayContain):
-        (WTF::BloomFilter::add):
-        (WTF::BloomFilter::remove):
-        (WTF::BloomFilter::firstSlot):
-        (WTF::BloomFilter::secondSlot):
-        (WTF::::add):
-        (WTF::::remove):
-        (WTF::::clear):
-        (WTF::::likelyEmpty):
-        (WTF::::isClear):
-
-2011-02-04  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Rolled back in r77612 with ASSERT/crash fixed.
-        https://bugs.webkit.org/show_bug.cgi?id=53759
-        
-        Don't shrink the heap to 0 unconditionally. Instead, shrink to 1 if
-        necessary. For now, the heap assumes that it always has at least one
-        block live.
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::Heap):
-        (JSC::Heap::reset):
-        * runtime/Heap.h:
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::allocate):
-        (JSC::MarkedSpace::shrinkBlocks):
-        (JSC::MarkedSpace::sweep):
-        (JSC::MarkedSpace::reset):
-        * runtime/MarkedSpace.h:
-        (JSC::MarkedSpace::highWaterMark):
-        (JSC::MarkedSpace::setHighWaterMark):
+        Reviewed by Geoff Garen.
 
-2011-02-04  David Kilzer  <ddkilzer@apple.com>
+        Bug 58817 - DFG JIT - if speculative compilation fails, throw away code.
 
-        BUILD FIX: REALLY remove the last vestiges of JSVALUE32!
+        If we detect a logical conflict, throw away generated code,
+        and only compile through the NonSpeculativeJIT.
 
-        <rdar://problem/8957409> Remove last vestiges of JSVALUE32
-        <http://webkit.org/b/53779>
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::rewindToLabel):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::rewindToOffset):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::rewindToLabel):
+        (JSC::X86Assembler::X86InstructionFormatter::rewindToLabel):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkSpeculationChecks):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculationCheckIndexIterator::SpeculationCheckIndexIterator):
+
+2011-04-18  Oliver Hunt  <oliver@apple.com>
 
-        * DerivedSources.make: Removed dependency on
-        JavaScriptCore.JSVALUE32.exp.
+        Reviewed by Gavin Barraclough.
 
-2011-02-04  David Kilzer  <ddkilzer@apple.com>
+        Remove DeprecatedPtr
+        https://bugs.webkit.org/show_bug.cgi?id=58718
 
-        <rdar://problem/8957409> Remove last vestiges of JSVALUE32
-        <http://webkit.org/b/53779>
+        As simple as it sounds.
 
-        Reviewed by Darin Adler.
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
 
-        Support for JSVALUE32 was originaly removed in r70111.
+2011-04-17  Cameron Zwarich  <zwarich@apple.com>
 
-        * Configurations/JavaScriptCore.xcconfig: Changed armv6 to use
-        JavaScriptCore.JSVALUE32_64.exp and ppc64 to use
-        JavaScriptCore.JSVALUE64.exp to match Platform.h.
-        * DerivedSources.make: Removed rule for
-        JavaScriptCore.JSVALUE32.exp.
-        * JavaScriptCore.JSVALUE32only.exp: Removed.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Removed references
-        to JavaScriptCore.JSVALUE32only.exp.
+        Reviewed by Dan Bernstein.
 
-2011-02-04  David Kilzer  <ddkilzer@apple.com>
+        JSC no longer builds with Clang due to -Woverloaded-virtual warning
+        https://bugs.webkit.org/show_bug.cgi?id=58760
 
-        Use static_cast and other style cleanup in YarrInterpreter.cpp
-        <http://webkit.org/b/53772>
+        Rename Structure's specificValue overload of put to putSpecificValue to avoid
+        Clang's warning for overloading a virtual function.
 
-        Reviewed by John Sullivan.
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::putSpecificValue):
+        * runtime/Structure.h:
 
-        * yarr/YarrInterpreter.cpp:
-        (JSC::Yarr::Interpreter::InputStream::readChecked): Use
-        static_cast.
-        (JSC::Yarr::Interpreter::InputStream::checkInput): Remove
-        unnecessary else block.
-        (JSC::Yarr::Interpreter::matchAssertionEOL): Ditto.
-        (JSC::Yarr::Interpreter::backtrackBackReference): Ditto.
-        (JSC::Yarr::ByteCompiler::emitDisjunction): Use static_cast.
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
 
-2011-02-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+        Reviewed by Adam Barth.
 
-        Unreviewed, rolling out r77625 and r77626.
-        http://trac.webkit.org/changeset/77625
-        http://trac.webkit.org/changeset/77626
-        https://bugs.webkit.org/show_bug.cgi?id=53765
+        Remove WTF_PLATFORM_SGL
+        https://bugs.webkit.org/show_bug.cgi?id=58743
 
-        It broke Windows builds (Requested by Ossy_ on #webkit).
+        WTF_PLATFORM_SGL and PLATFORM(SGL) are not used in the code anywhere.
 
-        * JavaScriptCore.exp:
-        * JavaScriptCore.gyp/JavaScriptCore.gyp:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * create_regex_tables:
-        * runtime/RegExp.cpp:
         * wtf/Platform.h:
-        * yarr/Yarr.h:
-        * yarr/YarrJIT.cpp:
-        * yarr/YarrJIT.h:
-        * yarr/YarrParser.h:
-        * yarr/YarrPattern.h:
-        * yarr/YarrSyntaxChecker.h:
-        * yarr/yarr.pri: Removed.
-
-2011-02-04  Jessie Berlin  <jberlin@apple.com>
 
-        Windows build fix. Unreviewed.
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
-
-2011-02-04  Peter Varga  <pvarga@webkit.org>
-
-        Reviewed by Gavin Barraclough.
+        Reviewed by Adam Barth.
 
-        Replace PCRE with Yarr in WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=53496
+        Rename PLATFORM(CA) to USE(CA)
+        https://bugs.webkit.org/show_bug.cgi?id=58742
 
-        * JavaScriptCore.exp:
-        * JavaScriptCore.gyp/JavaScriptCore.gyp:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * create_regex_tables:
-        * runtime/RegExp.cpp:
         * wtf/Platform.h:
-        * yarr/Yarr.h:
-        * yarr/YarrJIT.cpp:
-        * yarr/YarrJIT.h:
-        * yarr/YarrParser.h:
-        * yarr/YarrPattern.h:
-        * yarr/YarrSyntaxChecker.h:
-        * yarr/yarr.pri: Added.
-
-2011-02-04  Ilya Tikhonovsky  <loislo@chromium.org>
-
-        Unreviewed rollout two patches r77614 and r77612.
-
-        REGRESSION: Snow Leopard Intel Release anumber of failing tests.
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::Heap):
-        (JSC::Heap::reset):
-        * runtime/Heap.h:
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::allocate):
-        (JSC::MarkedSpace::sweep):
-        (JSC::MarkedSpace::reset):
-        * runtime/MarkedSpace.h:
-
-2011-02-04  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix 32bit build.
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::reset): Use an explicit cast to avoid shortening warnings,
-        since 1.5 is double (64bit), and the result is size_t (32bit).
-
-2011-02-03  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Changed MarkedSpace to delegate grow/shrink decisions to Heap
-        https://bugs.webkit.org/show_bug.cgi?id=53759
-        
-        SunSpider reports no change.
-        
-        * runtime/Heap.cpp:
-        (JSC::Heap::Heap):
-        (JSC::Heap::reset):
-        * runtime/Heap.h: Reorganized a few data members for better cache locality.
-        Added a grow policy.
-        
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::allocate):
-        (JSC::MarkedSpace::sweep):
-        (JSC::MarkedSpace::reset): Don't shrink automatically. Instead, wait for
-        the heap to make an explicit sweep call.
-
-        * runtime/MarkedSpace.h:
-        (JSC::MarkedSpace::highWaterMark):
-        (JSC::MarkedSpace::setHighWaterMark): Use a watermark to determine how
-        many bytes to allocate before failing and giving the heap an opportunity
-        to collect garbage. This also means that we allocate blocks on demand,
-        instead of ahead of time.
-
-2011-02-03  James Kozianski  <koz@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add navigator.registerProtocolHandler behind a flag.
-        https://bugs.webkit.org/show_bug.cgi?id=52609
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2011-02-03  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Not all blocks are freed when the heap is freed (counting is hard!)
-        https://bugs.webkit.org/show_bug.cgi?id=53732
-
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::destroy): Freeing a block compacts the list, so just
-        keep freeing block 0 until there are no blocks left.
-
-2011-02-03  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix the Mac build.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj: The new MarkedBlock.h header
-        needs to be private, not project, so other projects can include headers
-        that depend on it.
-
-2011-02-03  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Start using MarkedBlock instead of CollectorBlock
-        https://bugs.webkit.org/show_bug.cgi?id=53693
-        
-        SunSpider reports no change.
-        
-        * runtime/MarkedBlock.h:
-        (JSC::MarkedBlock::blockFor):
-        (JSC::MarkedBlock::setMarked):
-        (JSC::MarkedBlock::isCellAligned):
-        (JSC::MarkedBlock::isPossibleCell): Updated for const-ness.
-
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::allocateBlock):
-        (JSC::MarkedSpace::containsSlowCase):
-        (JSC::MarkedSpace::clearMarkBits): Updated for const-ness.
-
-        * runtime/MarkedSpace.h:
-        (JSC::CollectorHeap::collectorBlock):
-        (JSC::MarkedSpace::heap):
-        (JSC::MarkedSpace::isMarked):
-        (JSC::MarkedSpace::testAndSetMarked):
-        (JSC::MarkedSpace::setMarked):
-        (JSC::MarkedSpace::contains): Switched from CollectorBlock to MarkedBlock,
-        and deleted dead CollectorBlock-related code.
-
-2011-02-03  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Avoid strlen() in AtomicString::fromUTF8
-        https://bugs.webkit.org/show_bug.cgi?id=50516
 
-        Add an overload to calculateStringHashFromUTF8 to get
-        strlen() of the input data with only one call.
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
 
-        This change shows about 3% performance win on the xml-parser benchmark.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * wtf/text/AtomicString.cpp:
-        (WTF::AtomicString::fromUTF8):
-        * wtf/unicode/UTF8.cpp:
-        (WTF::Unicode::calculateStringHashAndLengthFromUTF8Internal):
-        (WTF::Unicode::calculateStringHashFromUTF8):
-        (WTF::Unicode::calculateStringHashAndLengthFromUTF8):
-        * wtf/unicode/UTF8.h:
-
-2011-02-02  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2011-02-02  Gavin Barraclough  <barraclough@apple.com>
-
-        oops, build fix!
-
-        * wtf/Assertions.cpp:
-
-2011-02-02  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 53650 - Add a BACKTRACE macro to Assertions.h
-
-        Add a BACKTRACE macro to Assertions.h, which will print a backtrace on
-        debug Mac builds, make CRASH (and thus ASSERT) automatically call this.
+        Reviewed by Adam Barth.
 
-        * JavaScriptCore.exp:
-        * wtf/Assertions.cpp:
-        * wtf/Assertions.h:
+        Rename PLATFORM(CG) to USE(CG)
+        https://bugs.webkit.org/show_bug.cgi?id=58729
 
-2011-02-02  Michael Saboff  <msaboff@apple.com>
+        * wtf/Platform.h:
 
-        Reviewed by Gavin Barraclough.
+2011-04-16  Patrick Gansterer  <paroga@webkit.org>
 
-        Improper backtrack of nested non-capturing greedy paren to prior paren
-        https://bugs.webkit.org/show_bug.cgi?id=53261
+        Reviewed by Eric Seidel.
 
-        A paren that follows a non-capturing greedy paren nested within a 
-        non-capturing fixed paren was back tracking to the last paren 
-        processed instead of the immediately prior paren.
-        Refactored default backtracking of parens to prior paren to work for
-        both nested (within) and immediately prior (after) parens.
+        Rename PLATFORM(CAIRO) to USE(CAIRO)
+        https://bugs.webkit.org/show_bug.cgi?id=55192
 
-        * yarr/YarrJIT.cpp:
-        (JSC::Yarr::YarrGenerator::GenerationState::addParenthesesTail):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::TermGenerationState):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::setJumpListToPriorParen):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::getJumpListToPriorParen):
-        (JSC::Yarr::YarrGenerator::ParenthesesTail::ParenthesesTail):
-        (JSC::Yarr::YarrGenerator::ParenthesesTail::generateCode):
-        (JSC::Yarr::YarrGenerator::generateParenthesesDisjunction):
-        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
-        (JSC::Yarr::YarrGenerator::generateDisjunction):
+        * wtf/Platform.h:
+        * wtf/gobject/GTypedefs.h:
 
-2011-02-02  Jeff Miller  <jeffm@apple.com>
+2011-04-15  Sheriff Bot  <webkit.review.bot@gmail.com>
 
-        Reviewed by Darin Adler and Steve Falkenburg.
+        Unreviewed, rolling out r84067.
+        http://trac.webkit.org/changeset/84067
+        https://bugs.webkit.org/show_bug.cgi?id=58724
 
-        Add DerivedSources.make to some Visual Studio projects
-        https://bugs.webkit.org/show_bug.cgi?id=53607
+        qt build are failing. (Requested by loislo2 on #webkit).
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Add DerivedSources.make.
+        * heap/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::operator==):
 
-2011-02-02  Steve Lacey  <sjl@chromium.org>
+2011-04-15  Shishir Agrawal  <shishir@chromium.org>
 
-        Reviewed by Eric Carlson.
+        Reviewed by James Robinson.
 
-        Implement basic media statistics on media elements.
-        https://bugs.webkit.org/show_bug.cgi?id=53322
+        Add a flag to guard Page Visibility API changes.
+        https://bugs.webkit.org/show_bug.cgi?id=58464
 
         * Configurations/FeatureDefines.xcconfig:
 
-2011-02-02  Kevin Ollivier  <kevino@theolliviers.com>
-
-        [wx] Build fixes for wxWebKit.
-
-        * wtf/wx/StringWx.cpp:
-        (WTF::String::String):
-
-2011-02-01  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        A little more Heap refactoring
-        https://bugs.webkit.org/show_bug.cgi?id=53577
-        
-        SunSpider reports no change.
-        
-        Split out MarkedBlock into its own file / class.
-        
-        Did the following renames:
-            isCellMarked => isMarked
-            checkMarkCell => testAndSetMarked
-            markCell => setMarked
-            cellOffset => cellNumber
-            collectorBlock => blockFor
-
-        * Android.mk:
-        * CMakeLists.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/Heap.cpp:
-        (JSC::WeakGCHandlePool::update):
-        * runtime/Heap.h:
-        (JSC::Heap::isMarked):
-        (JSC::Heap::testAndSetMarked):
-        (JSC::Heap::setMarked):
-        * runtime/JSArray.h:
-        (JSC::MarkStack::markChildren):
-        (JSC::MarkStack::drain):
-        * runtime/JSCell.h:
-        (JSC::JSCell::MarkStack::internalAppend):
-        * runtime/MarkedBlock.cpp: Added.
-        * runtime/MarkedBlock.h: Added.
-        (JSC::MarkedBlock::blockFor):
-        (JSC::MarkedBlock::cellNumber):
-        (JSC::MarkedBlock::isMarked):
-        (JSC::MarkedBlock::testAndSetMarked):
-        (JSC::MarkedBlock::setMarked):
-        (JSC::MarkedBlock::isCellAligned):
-        (JSC::MarkedBlock::isPossibleCell):
-        * runtime/MarkedSpace.h:
-        (JSC::MarkedSpace::isMarked):
-        (JSC::MarkedSpace::testAndSetMarked):
-        (JSC::MarkedSpace::setMarked):
-        * runtime/SmallStrings.cpp:
-        (JSC::isMarked):
-        * runtime/WeakGCMap.h:
-        (JSC::WeakGCMap::isValid):
-        (JSC::::get):
-        (JSC::::take):
-        (JSC::::set):
-
-2011-02-02  Sam Weinig  <sam@webkit.org>
-
-        Fix windows clean build.
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
 
-        * DerivedSources.make:
-
-2011-02-02  Alejandro G. Castro  <alex@igalia.com>
+        Errrk! - build fix from !x86-64.
 
-        Reviewed by Martin Robinson.
+        * dfg/DFGNode.h:
 
-        [GTK] Fix dist compilation
-        https://bugs.webkit.org/show_bug.cgi?id=53579
+2011-04-15  David Levin  <levin@chromium.org>
 
-        * GNUmakefile.am: Added WriteBarrier.h to the sources, it was
-        added in r77151
+        Revert of r83974.
 
-2011-02-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+        JavaScriptCore shouldn't depend on ../ThirdParty/gtest/xcode/gtest.xcodeproj
+        https://bugs.webkit.org/show_bug.cgi?id=58716
 
-        Unreviewed, rolling out r77297.
-        http://trac.webkit.org/changeset/77297
-        https://bugs.webkit.org/show_bug.cgi?id=53538
-
-        caused leopard crashes (Requested by paroga on #webkit).
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * wtf/text/AtomicString.cpp:
-        (WTF::AtomicString::fromUTF8):
-        * wtf/unicode/UTF8.cpp:
-        (WTF::Unicode::calculateStringHashFromUTF8):
-        * wtf/unicode/UTF8.h:
-
-2011-02-01  Sam Weinig  <sam@webkit.org>
-
-        Fix Mac production builds.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2011-02-01  Sam Weinig  <sam@webkit.org>
-
-        Try to fix the windows build.
-
-        * DerivedSources.make:
-
-2011-02-01  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Avoid strlen() in AtomicString::fromUTF8
-        https://bugs.webkit.org/show_bug.cgi?id=50516
-
-        Add an overload to calculateStringHashFromUTF8 to get
-        strlen() of the input data with only one call.
-
-        This change shows about 3% performance win on the xml-parser benchmark.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * wtf/text/AtomicString.cpp:
-        (WTF::AtomicString::fromUTF8):
-        * wtf/unicode/UTF8.cpp:
-        (WTF::Unicode::calculateStringHashAndLengthFromUTF8Internal):
-        (WTF::Unicode::calculateStringHashFromUTF8):
-        (WTF::Unicode::calculateStringHashAndLengthFromUTF8):
-        * wtf/unicode/UTF8.h:
-
-2011-02-01  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Beth Dakin.
-
-        Part 2 for <rdar://problem/8492788>
-        Adopt WKScrollbarPainterController
-
-        Use header detection to define scrollbar painting controller #define.
-
-        * DerivedSources.make:
         * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/tests/RunAllWtfTests.cpp: Removed.
+        * wtf/tests/StringTests.cpp: Removed.
 
-2011-02-01  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Refactor JSGlobalObject-related tear-down
-        https://bugs.webkit.org/show_bug.cgi?id=53478
-        
-        While investigating crashes caused by r77082, I noticed some strange
-        destructor-time behaviors. This patch makes them less strange.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::CodeBlock::markAggregate):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::globalObject):
-        (JSC::GlobalCodeBlock::GlobalCodeBlock):
-        (JSC::GlobalCodeBlock::~GlobalCodeBlock): Store the set of global code
-        blocks on the Heap, instead of on independent global objects. The heap
-        is guaranteed to outlast any GC-owned data structure. The heap is also
-        a natural place to store objects that needs out-of-band marking, since
-        the heap is responsible for marking all roots.
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::markRoots):
-        (JSC::Heap::globalObjectCount):
-        (JSC::Heap::protectedGlobalObjectCount):
-        * runtime/Heap.h:
-        (JSC::Heap::codeBlocks):
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * runtime/JSGlobalData.h:
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::~JSGlobalObject):
-        (JSC::JSGlobalObject::init):
-        (JSC::JSGlobalObject::markChildren):
-        * runtime/JSGlobalObject.h:
-        * runtime/MarkedSpace.cpp: Store the set of global objects in a weak map
-        owned by JSGlobalData, instead of an instrusive circular linked list.
-        This is simpler, and it avoids destructor-time access between garbage
-        collected objects, which is hard to get right.
-
-        (JSC::MarkedSpace::destroy): Make sure to clear mark bits before tearing
-        everything down. Otherwise, weak data structures will incorrectly report
-        that objects pending destruction are still alive.
-
-2011-02-01  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        REGRESSION(77082): GC-related crashes seen: on WebKit2 bot; on GTK 32bit
-        bot; loading trac pages; typing in search field
-        https://bugs.webkit.org/show_bug.cgi?id=53519
-        
-        The crashes were all caused by failure to run an object's destructor.
-
-        * runtime/CollectorHeapIterator.h:
-        (JSC::ObjectIterator::ObjectIterator): Don't skip forward upon
-        construction. The iterator class used to do that when it was designed
-        for prior-to-beginning initialization. I forgot to remove this line
-        of code when I changed the iterator to normal initialization.
-        
-        Skipping forward upon construction was causing the heap to skip running
-        the destructor for the very first object in a block when destroying the
-        block. This usually did not crash, since block destruction is rare and
-        most objects have pretty trivial destructors. However, in the rare case
-        when the heap would destroy a block whose first object was a global
-        object or a DOM node, BOOM.
-
-2011-01-31  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Update JSObject storage for new marking API
-        https://bugs.webkit.org/show_bug.cgi?id=53467
-
-        JSObject no longer uses EncodedJSValue for its property storage.
-        This produces a stream of mechanical changes to PropertySlot and
-        anonymous storage APIs.
-
-        * JavaScriptCore.exp:
-        * runtime/ArrayPrototype.cpp:
-        (JSC::ArrayPrototype::ArrayPrototype):
-        * runtime/BooleanConstructor.cpp:
-        (JSC::constructBoolean):
-        (JSC::constructBooleanFromImmediateBoolean):
-        * runtime/BooleanObject.cpp:
-        (JSC::BooleanObject::BooleanObject):
-        * runtime/BooleanObject.h:
-        * runtime/BooleanPrototype.cpp:
-        (JSC::BooleanPrototype::BooleanPrototype):
-        * runtime/DateInstance.cpp:
-        (JSC::DateInstance::DateInstance):
-        * runtime/DatePrototype.cpp:
-        (JSC::DatePrototype::DatePrototype):
-        * runtime/JSActivation.cpp:
-        (JSC::JSActivation::getOwnPropertySlot):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::getOwnPropertySlot):
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::getOwnPropertySlot):
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObject):
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::fillGetterPropertySlot):
-        * runtime/JSObject.h:
-        (JSC::JSObject::getDirectLocation):
-        (JSC::JSObject::offsetForLocation):
-        (JSC::JSObject::putAnonymousValue):
-        (JSC::JSObject::clearAnonymousValue):
-        (JSC::JSObject::getAnonymousValue):
-        (JSC::JSObject::putThisToAnonymousValue):
-        (JSC::JSObject::locationForOffset):
-        (JSC::JSObject::inlineGetOwnPropertySlot):
-        * runtime/JSObjectWithGlobalObject.cpp:
-        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
-        * runtime/JSWrapperObject.h:
-        (JSC::JSWrapperObject::JSWrapperObject):
-        (JSC::JSWrapperObject::setInternalValue):
-        * runtime/Lookup.cpp:
-        (JSC::setUpStaticFunctionSlot):
-        * runtime/NumberConstructor.cpp:
-        (JSC::constructWithNumberConstructor):
-        * runtime/NumberObject.cpp:
-        (JSC::NumberObject::NumberObject):
-        (JSC::constructNumber):
-        * runtime/NumberObject.h:
-        * runtime/NumberPrototype.cpp:
-        (JSC::NumberPrototype::NumberPrototype):
-        * runtime/PropertySlot.h:
-        (JSC::PropertySlot::getValue):
-        (JSC::PropertySlot::setValue):
-        (JSC::PropertySlot::setRegisterSlot):
-        * runtime/StringObject.cpp:
-        (JSC::StringObject::StringObject):
-        * runtime/StringPrototype.cpp:
-        (JSC::StringPrototype::StringPrototype):
-        * runtime/WriteBarrier.h:
-        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
-
-2011-02-01  Daniel Bates  <dbates@rim.com>
-
-        Reviewed by Antonio Gomes.
-
-        Modify RandomNumberSeed.h to use USE(MERSENNE_TWISTER_19937)
-        https://bugs.webkit.org/show_bug.cgi?id=53506
-
-        Currently, use of the Mersenne Twister pseudorandom number generator
-        is hardcoded to the Windows CE port. With the passing of bug #53253,
-        we can generalize support for this PRNG to all ports that use srand(3)
-        and rand(3), including Windows CE.
-
-        * wtf/RandomNumberSeed.h:
-        (WTF::initializeRandomNumberGenerator):
-
-2011-02-01  Dave Tapuska  <dtapuska@rim.com>
+2011-04-15  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Gavin Barraclough.
 
-        MacroAssemblerARM would generate code that did 32bit loads
-        on addresses that were not aligned. More specifically it would
-        generate a ldr r8,[r1, #7] which isn't valid on ARMv5 and lower.
-        The intended instruction really is ldrb r8,[r1, #7]; ensure we
-        call load8 instead of load32.
-
-        https://bugs.webkit.org/show_bug.cgi?id=46095
-
-        * assembler/MacroAssemblerARM.h:
-        (JSC::MacroAssemblerARM::set32Test32):
-        (JSC::MacroAssemblerARM::set32Test8):
-
-2011-02-01  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Fix some Visual Studio compiler warnings.
-        https://bugs.webkit.org/show_bug.cgi?id=53476
-
-        * wtf/MathExtras.h:
-        (clampToInteger):
-        (clampToPositiveInteger):
-        * wtf/ThreadingWin.cpp:
-        (WTF::absoluteTimeToWaitTimeoutInterval):
-
-2011-01-31  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bogus callframe during stack unwinding
-        https://bugs.webkit.org/show_bug.cgi?id=53454
+        Remove DeprecatedPtr
+        https://bugs.webkit.org/show_bug.cgi?id=58718
 
-        Trying to access a callframe's globalData after destroying its
-        ScopeChain is not a good thing.  While we could access the
-        globalData directly through the (known valid) scopechain we're
-        holding on to, it feels fragile.  Instead we push the valid
-        ScopeChain onto the callframe again to ensure that the callframe
-        itself remains valid.
+        As simple as it sounds.
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::unwindCallFrame):
-
-2011-01-31  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Geoffrey Garen.
+        * heap/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
 
-        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
-        https://bugs.webkit.org/show_bug.cgi?id=53271
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
 
-        Reapplying this change again.
-        Changed isValid() to use .get() as a result of change r77151.
+        Reviewed by Oliver Hunt.
 
-        Added new isValid() methods to check if a contained object in
-        a WeakGCMap is valid when using an unchecked iterator.
+        Add a simple tool to gather statistics on whether functions
+        are completed through the new or old JIT.
 
-        * runtime/WeakGCMap.h:
-        (JSC::WeakGCMap::isValid):
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
 
-2011-01-31  Oliver Hunt  <oliver@apple.com>
+2011-04-15  Oliver Hunt  <oliver@apple.com>
 
-        Convert markstack to a slot visitor API
-        https://bugs.webkit.org/show_bug.cgi?id=53219
+        GC allocate Structure
+        https://bugs.webkit.org/show_bug.cgi?id=58483
 
-        rolling r77098, r77099, r77100, r77109, and
-        r77111 back in, along with a few more Qt fix attempts.
+        Rolling r83894 r83827 r83810 r83809 r83808 back in with
+        a workaround for the gcc bug seen by the gtk bots
 
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
         * API/JSCallbackObject.h:
-        (JSC::JSCallbackObjectData::setPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
-        (JSC::JSCallbackObject::setPrivateProperty):
+        (JSC::JSCallbackObject::createStructure):
         * API/JSCallbackObjectFunctions.h:
-        (JSC::::put):
-        (JSC::::staticFunctionGetter):
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeConstructor):
-        (JSObjectSetPrivateProperty):
-        * API/JSWeakObjectMapRefInternal.h:
+        (JSC::::JSCallbackObject):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.JSVALUE32_64only.exp:
+        * JavaScriptCore.JSVALUE64only.exp:
         * JavaScriptCore.exp:
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
         * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::markStructures):
         (JSC::CodeBlock::markAggregate):
         * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::globalObject):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
-        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
-        (JSC::BytecodeGenerator::findScopedProperty):
-        * debugger/Debugger.cpp:
-        (JSC::evaluateInGlobalCallFrame):
+        (JSC::MethodCallLinkInfo::setSeen):
+        (JSC::GlobalResolveInfo::GlobalResolveInfo):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::markAggregate):
+        (JSC::Instruction::Instruction):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::markAggregate):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
         * debugger/DebuggerActivation.cpp:
         (JSC::DebuggerActivation::DebuggerActivation):
-        (JSC::DebuggerActivation::markChildren):
         * debugger/DebuggerActivation.h:
-        * debugger/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate):
-        * interpreter/CallFrame.h:
-        (JSC::ExecState::exception):
+        (JSC::DebuggerActivation::createStructure):
+        * heap/Handle.h:
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::markChildren):
+        (JSC::MarkStack::drain):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep):
+        * heap/Strong.h:
+        (JSC::Strong::Strong):
+        (JSC::Strong::set):
         * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::resolve):
-        (JSC::Interpreter::resolveSkip):
         (JSC::Interpreter::resolveGlobal):
         (JSC::Interpreter::resolveGlobalDynamic):
-        (JSC::Interpreter::resolveBaseAndProperty):
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::appendSourceToError):
-        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::uncachePutByID):
         (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::uncacheGetByID):
         (JSC::Interpreter::privateExecute):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
         * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
         (JSC::JITThunks::tryCacheGetByID):
         (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::storePtrWithWriteBarrier):
         * jsc.cpp:
-        (GlobalObject::GlobalObject):
-        * runtime/ArgList.cpp:
-        (JSC::MarkedArgumentBuffer::markLists):
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::markChildren):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::getOwnPropertyDescriptor):
-        (JSC::Arguments::put):
+        (cleanupGlobalData):
         * runtime/Arguments.h:
-        (JSC::Arguments::setActivation):
+        (JSC::Arguments::createStructure):
         (JSC::Arguments::Arguments):
+        (JSC::JSActivation::copyRegisters):
         * runtime/ArrayConstructor.cpp:
         (JSC::ArrayConstructor::ArrayConstructor):
         (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayConstructor.h:
         * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
         (JSC::arrayProtoFuncSplice):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
         * runtime/BatchedTransitionOptimizer.h:
         (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
-        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
         * runtime/BooleanConstructor.cpp:
         (JSC::BooleanConstructor::BooleanConstructor):
-        (JSC::constructBoolean):
-        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
         * runtime/BooleanPrototype.cpp:
         (JSC::BooleanPrototype::BooleanPrototype):
-        * runtime/ConservativeSet.cpp:
-        (JSC::ConservativeSet::grow):
-        * runtime/ConservativeSet.h:
-        (JSC::ConservativeSet::~ConservativeSet):
-        (JSC::ConservativeSet::mark):
+        * runtime/BooleanPrototype.h:
         * runtime/DateConstructor.cpp:
         (JSC::DateConstructor::DateConstructor):
+        * runtime/DateConstructor.h:
         * runtime/DateInstance.cpp:
         (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
         * runtime/DatePrototype.cpp:
-        (JSC::dateProtoFuncSetTime):
-        (JSC::setNewValueFromTimeArgs):
-        (JSC::setNewValueFromDateArgs):
-        (JSC::dateProtoFuncSetYear):
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
         * runtime/ErrorConstructor.cpp:
         (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorConstructor.h:
         * runtime/ErrorInstance.cpp:
         (JSC::ErrorInstance::ErrorInstance):
+        (JSC::ErrorInstance::create):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::createStructure):
         * runtime/ErrorPrototype.cpp:
         (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError):
+        (JSC::TerminatedExecutionError::TerminatedExecutionError):
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::createStructure):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
         * runtime/FunctionConstructor.cpp:
         (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionConstructor.h:
         * runtime/FunctionPrototype.cpp:
         (JSC::FunctionPrototype::FunctionPrototype):
-        * runtime/GetterSetter.cpp:
-        (JSC::GetterSetter::markChildren):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
         * runtime/GetterSetter.h:
         (JSC::GetterSetter::GetterSetter):
-        (JSC::GetterSetter::getter):
-        (JSC::GetterSetter::setGetter):
-        (JSC::GetterSetter::setter):
-        (JSC::GetterSetter::setSetter):
-        * runtime/GlobalEvalFunction.cpp:
-        (JSC::GlobalEvalFunction::GlobalEvalFunction):
-        (JSC::GlobalEvalFunction::markChildren):
-        * runtime/GlobalEvalFunction.h:
-        (JSC::GlobalEvalFunction::cachedGlobalObject):
-        * runtime/Heap.cpp:
-        (JSC::Heap::markProtectedObjects):
-        (JSC::Heap::markTempSortVectors):
-        (JSC::Heap::markRoots):
+        (JSC::GetterSetter::createStructure):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
         * runtime/InternalFunction.cpp:
         (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
         * runtime/JSAPIValueWrapper.h:
-        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::createStructure):
         (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
         * runtime/JSActivation.cpp:
-        (JSC::JSActivation::markChildren):
-        (JSC::JSActivation::put):
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
         * runtime/JSArray.cpp:
         (JSC::JSArray::JSArray):
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::deleteProperty):
-        (JSC::JSArray::increaseVectorLength):
-        (JSC::JSArray::setLength):
-        (JSC::JSArray::pop):
-        (JSC::JSArray::push):
-        (JSC::JSArray::unshiftCount):
-        (JSC::JSArray::sort):
-        (JSC::JSArray::fillArgList):
-        (JSC::JSArray::copyToRegisters):
-        (JSC::JSArray::compactForSorting):
         * runtime/JSArray.h:
-        (JSC::JSArray::getIndex):
-        (JSC::JSArray::setIndex):
-        (JSC::JSArray::uncheckedSetIndex):
-        (JSC::JSArray::markChildrenDirect):
+        (JSC::JSArray::createStructure):
         * runtime/JSByteArray.cpp:
         (JSC::JSByteArray::JSByteArray):
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.cpp:
+        (JSC::isZombie):
         * runtime/JSCell.h:
-        (JSC::JSCell::MarkStack::append):
-        (JSC::JSCell::MarkStack::internalAppend):
-        (JSC::JSCell::MarkStack::deprecatedAppend):
+        (JSC::JSCell::JSCell::JSCell):
+        (JSC::JSCell::JSCell::addressOfStructure):
+        (JSC::JSCell::JSCell::structure):
+        (JSC::JSCell::JSCell::markChildren):
+        (JSC::JSCell::JSValue::isZombie):
         * runtime/JSFunction.cpp:
         (JSC::JSFunction::JSFunction):
-        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::clearBuiltinStructures):
+        (JSC::JSGlobalData::createLeaked):
         * runtime/JSGlobalData.h:
+        (JSC::allocateGlobalHandle):
         * runtime/JSGlobalObject.cpp:
-        (JSC::markIfNeeded):
         (JSC::JSGlobalObject::reset):
-        (JSC::JSGlobalObject::resetPrototype):
         (JSC::JSGlobalObject::markChildren):
+        (JSC::JSGlobalObject::copyGlobalsFrom):
         * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
-        (JSC::JSGlobalObject::regExpConstructor):
-        (JSC::JSGlobalObject::errorConstructor):
-        (JSC::JSGlobalObject::evalErrorConstructor):
-        (JSC::JSGlobalObject::rangeErrorConstructor):
-        (JSC::JSGlobalObject::referenceErrorConstructor):
-        (JSC::JSGlobalObject::syntaxErrorConstructor):
-        (JSC::JSGlobalObject::typeErrorConstructor):
-        (JSC::JSGlobalObject::URIErrorConstructor):
-        (JSC::JSGlobalObject::evalFunction):
-        (JSC::JSGlobalObject::objectPrototype):
-        (JSC::JSGlobalObject::functionPrototype):
-        (JSC::JSGlobalObject::arrayPrototype):
-        (JSC::JSGlobalObject::booleanPrototype):
-        (JSC::JSGlobalObject::stringPrototype):
-        (JSC::JSGlobalObject::numberPrototype):
-        (JSC::JSGlobalObject::datePrototype):
-        (JSC::JSGlobalObject::regExpPrototype):
-        (JSC::JSGlobalObject::methodCallDummy):
-        (JSC::Structure::prototypeForLookup):
-        (JSC::constructArray):
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::Structure::prototypeChain):
+        (JSC::Structure::isValid):
+        (JSC::constructEmptyArray):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::JSNotAnObject):
+        (JSC::JSNotAnObject::createStructure):
         * runtime/JSONObject.cpp:
-        (JSC::Stringifier::Holder::object):
-        (JSC::Stringifier::Holder::objectSlot):
-        (JSC::Stringifier::markAggregate):
-        (JSC::Stringifier::stringify):
-        (JSC::Stringifier::Holder::appendNextProperty):
-        (JSC::Walker::callReviver):
-        (JSC::Walker::walk):
+        (JSC::JSONObject::JSONObject):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
         * runtime/JSObject.cpp:
         (JSC::JSObject::defineGetter):
         (JSC::JSObject::defineSetter):
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
         (JSC::JSObject::removeDirect):
-        (JSC::JSObject::putDirectFunction):
-        (JSC::JSObject::putDirectFunctionWithoutTransition):
-        (JSC::putDescriptor):
-        (JSC::JSObject::defineOwnProperty):
+        (JSC::JSObject::createInheritorID):
         * runtime/JSObject.h:
-        (JSC::JSObject::getDirectOffset):
-        (JSC::JSObject::putDirectOffset):
-        (JSC::JSObject::putUndefinedAtDirectOffset):
-        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::createStructure):
+        (JSC::JSObject::JSObject):
+        (JSC::JSNonFinalObject::createStructure):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSFinalObject::create):
+        (JSC::JSFinalObject::createStructure):
+        (JSC::JSFinalObject::JSFinalObject):
+        (JSC::constructEmptyObject):
+        (JSC::createEmptyObjectStructure):
+        (JSC::JSObject::~JSObject):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::setStructure):
+        (JSC::JSObject::inheritorID):
         (JSC::JSObject::putDirectInternal):
-        (JSC::JSObject::putDirect):
-        (JSC::JSObject::putDirectFunction):
-        (JSC::JSObject::putDirectWithoutTransition):
-        (JSC::JSObject::putDirectFunctionWithoutTransition):
-        (JSC::JSValue::putDirect):
-        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::transitionTo):
         (JSC::JSObject::markChildrenDirect):
+        * runtime/JSObjectWithGlobalObject.cpp:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSObjectWithGlobalObject.h:
+        (JSC::JSObjectWithGlobalObject::createStructure):
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
         * runtime/JSPropertyNameIterator.cpp:
         (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
         (JSC::JSPropertyNameIterator::get):
         * runtime/JSPropertyNameIterator.h:
-        * runtime/JSStaticScopeObject.cpp:
-        (JSC::JSStaticScopeObject::markChildren):
-        * runtime/JSString.cpp:
-        (JSC::StringObject::create):
+        (JSC::JSPropertyNameIterator::createStructure):
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+        (JSC::Structure::setEnumerationCache):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::createStructure):
+        * runtime/JSType.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
         * runtime/JSValue.h:
-        * runtime/JSWrapperObject.cpp:
-        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        (JSC::JSVariableObject::JSVariableObject):
+        (JSC::JSVariableObject::copyRegisterArray):
         * runtime/JSWrapperObject.h:
-        (JSC::JSWrapperObject::internalValue):
-        (JSC::JSWrapperObject::setInternalValue):
-        * runtime/LiteralParser.cpp:
-        (JSC::LiteralParser::parse):
-        * runtime/Lookup.cpp:
-        (JSC::setUpStaticFunctionSlot):
-        * runtime/Lookup.h:
-        (JSC::lookupPut):
-        * runtime/MarkStack.h:
-        (JSC::MarkStack::MarkStack):
-        (JSC::MarkStack::deprecatedAppendValues):
-        (JSC::MarkStack::appendValues):
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/JSZombie.cpp:
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::JSZombie):
+        (JSC::JSZombie::createStructure):
         * runtime/MathObject.cpp:
         (JSC::MathObject::MathObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
         * runtime/NativeErrorConstructor.cpp:
         (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        (JSC::NativeErrorConstructor::markChildren):
+        (JSC::constructWithNativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::createStructure):
         * runtime/NativeErrorPrototype.cpp:
         (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NativeErrorPrototype.h:
         * runtime/NumberConstructor.cpp:
         (JSC::NumberConstructor::NumberConstructor):
-        (JSC::constructWithNumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
         * runtime/NumberObject.cpp:
-        (JSC::constructNumber):
+        (JSC::NumberObject::NumberObject):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
         * runtime/NumberPrototype.cpp:
         (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
         * runtime/ObjectConstructor.cpp:
         (JSC::ObjectConstructor::ObjectConstructor):
-        (JSC::objectConstructorGetOwnPropertyDescriptor):
-        * runtime/Operations.h:
-        (JSC::normalizePrototypeChain):
-        (JSC::resolveBase):
-        * runtime/PrototypeFunction.cpp:
-        (JSC::PrototypeFunction::PrototypeFunction):
-        * runtime/PutPropertySlot.h:
-        (JSC::PutPropertySlot::setExistingProperty):
-        (JSC::PutPropertySlot::setNewProperty):
-        (JSC::PutPropertySlot::base):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::PropertyTable):
         * runtime/RegExpConstructor.cpp:
         (JSC::RegExpConstructor::RegExpConstructor):
-        * runtime/ScopeChain.cpp:
-        (JSC::ScopeChainNode::print):
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
         * runtime/ScopeChain.h:
-        (JSC::ScopeChainNode::~ScopeChainNode):
-        (JSC::ScopeChainIterator::operator*):
-        (JSC::ScopeChainIterator::operator->):
-        (JSC::ScopeChain::top):
-        * runtime/ScopeChainMark.h:
-        (JSC::ScopeChain::markAggregate):
-        * runtime/SmallStrings.cpp:
-        (JSC::isMarked):
-        (JSC::SmallStrings::markChildren):
-        * runtime/SmallStrings.h:
-        (JSC::SmallStrings::emptyString):
-        (JSC::SmallStrings::singleCharacterString):
-        (JSC::SmallStrings::singleCharacterStrings):
+        (JSC::ScopeChainNode::ScopeChainNode):
+        (JSC::ScopeChainNode::createStructure):
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
         * runtime/StringConstructor.cpp:
         (JSC::StringConstructor::StringConstructor):
+        * runtime/StringConstructor.h:
         * runtime/StringObject.cpp:
         (JSC::StringObject::StringObject):
         * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
         * runtime/StringPrototype.cpp:
         (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::createStructure):
         * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
         (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
         (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
         (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
         (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::markChildren):
         * runtime/Structure.h:
-        (JSC::Structure::storedPrototype):
-        (JSC::Structure::storedPrototypeSlot):
+        (JSC::Structure::create):
+        (JSC::Structure::setPrototypeWithoutTransition):
+        (JSC::Structure::createStructure):
+        (JSC::JSCell::createDummyStructure):
+        (JSC::StructureTransitionTable::keyForWeakGCMapFinalizer):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        (JSC::StructureChain::markChildren):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::head):
+        (JSC::StructureChain::createStructure):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::WeakGCMapFinalizerCallback::finalizerContextFor):
+        (JSC::StructureTransitionTable::WeakGCMapFinalizerCallback::keyForFinalizer):
+        (JSC::StructureTransitionTable::~StructureTransitionTable):
+        (JSC::StructureTransitionTable::slot):
+        (JSC::StructureTransitionTable::setMap):
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::clearSingleTransition):
+        (JSC::StructureTransitionTable::setSingleTransition):
         * runtime/WeakGCMap.h:
-        (JSC::WeakGCMap::uncheckedGet):
-        (JSC::WeakGCMap::uncheckedGetSlot):
-        (JSC::::get):
-        (JSC::::take):
-        (JSC::::set):
-        (JSC::::uncheckedRemove):
-        * runtime/WriteBarrier.h: Added.
-        (JSC::DeprecatedPtr::DeprecatedPtr):
-        (JSC::DeprecatedPtr::get):
-        (JSC::DeprecatedPtr::operator*):
-        (JSC::DeprecatedPtr::operator->):
-        (JSC::DeprecatedPtr::slot):
-        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
-        (JSC::DeprecatedPtr::operator!):
+        (JSC::DefaultWeakGCMapFinalizerCallback::finalizerContextFor):
+        (JSC::DefaultWeakGCMapFinalizerCallback::keyForFinalizer):
+        (JSC::WeakGCMap::contains):
+        (JSC::WeakGCMap::find):
+        (JSC::WeakGCMap::remove):
+        (JSC::WeakGCMap::add):
+        (JSC::WeakGCMap::set):
+        (JSC::WeakGCMap::finalize):
+        * runtime/WriteBarrier.h:
+        (JSC::writeBarrier):
         (JSC::WriteBarrierBase::set):
-        (JSC::WriteBarrierBase::get):
         (JSC::WriteBarrierBase::operator*):
         (JSC::WriteBarrierBase::operator->):
-        (JSC::WriteBarrierBase::clear):
-        (JSC::WriteBarrierBase::slot):
-        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
-        (JSC::WriteBarrierBase::operator!):
-        (JSC::WriteBarrier::WriteBarrier):
-        (JSC::operator==):
-
-2011-01-31  Dan Winship  <danw@gnome.org>
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
 
-        Reviewed by Gustavo Noronha Silva.
+2011-04-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
 
-        wss (websockets ssl) support for gtk via new gio TLS support
-        https://bugs.webkit.org/show_bug.cgi?id=50344
+        Reviewed by Gavin Barraclough.
 
-        Add a GPollableOutputStream typedef for TLS WebSockets support
+        Correctly prefix symbols. Since gcc 4.5.0, Windows x64 symbols
+        are not prefixed by underscore anymore. This is consistent with
+        what MSVC does.
+        https://bugs.webkit.org/show_bug.cgi?id=58573
 
-        * wtf/gobject/GTypedefs.h:
+        * jit/JITStubs.cpp:
 
-2011-01-31  Gavin Barraclough  <barraclough@apple.com>
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Geoff Garen.
 
-        https://bugs.webkit.org/show_bug.cgi?id=53352
-        Heavy external fragmentation in FixedVMPoolAllocator can lead to a CRASH().
-
-        The FixedVMPoolAllocator currently uses a best fix policy -
-        switch to first fit, this is less prone to external fragmentation.
-
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::AllocationTableSizeClass::AllocationTableSizeClass):
-        (JSC::AllocationTableSizeClass::blockSize):
-        (JSC::AllocationTableSizeClass::blockCount):
-        (JSC::AllocationTableSizeClass::blockAlignment):
-        (JSC::AllocationTableSizeClass::size):
-        (JSC::AllocationTableLeaf::AllocationTableLeaf):
-        (JSC::AllocationTableLeaf::~AllocationTableLeaf):
-        (JSC::AllocationTableLeaf::allocate):
-        (JSC::AllocationTableLeaf::free):
-        (JSC::AllocationTableLeaf::isEmpty):
-        (JSC::AllocationTableLeaf::isFull):
-        (JSC::AllocationTableLeaf::size):
-        (JSC::AllocationTableLeaf::classForSize):
-        (JSC::AllocationTableLeaf::dump):
-        (JSC::LazyAllocationTable::LazyAllocationTable):
-        (JSC::LazyAllocationTable::~LazyAllocationTable):
-        (JSC::LazyAllocationTable::allocate):
-        (JSC::LazyAllocationTable::free):
-        (JSC::LazyAllocationTable::isEmpty):
-        (JSC::LazyAllocationTable::isFull):
-        (JSC::LazyAllocationTable::size):
-        (JSC::LazyAllocationTable::dump):
-        (JSC::LazyAllocationTable::classForSize):
-        (JSC::AllocationTableDirectory::AllocationTableDirectory):
-        (JSC::AllocationTableDirectory::~AllocationTableDirectory):
-        (JSC::AllocationTableDirectory::allocate):
-        (JSC::AllocationTableDirectory::free):
-        (JSC::AllocationTableDirectory::isEmpty):
-        (JSC::AllocationTableDirectory::isFull):
-        (JSC::AllocationTableDirectory::size):
-        (JSC::AllocationTableDirectory::classForSize):
-        (JSC::AllocationTableDirectory::dump):
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
-        (JSC::FixedVMPoolAllocator::alloc):
-        (JSC::FixedVMPoolAllocator::free):
-        (JSC::FixedVMPoolAllocator::allocated):
-        (JSC::FixedVMPoolAllocator::isValid):
-        (JSC::FixedVMPoolAllocator::classForSize):
-        (JSC::FixedVMPoolAllocator::offsetToPointer):
-        (JSC::FixedVMPoolAllocator::pointerToOffset):
-        (JSC::ExecutableAllocator::committedByteCount):
-        (JSC::ExecutableAllocator::isValid):
-        (JSC::ExecutableAllocator::underMemoryPressure):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::PageReservation):
-        (WTF::PageReservation::commit):
-        (WTF::PageReservation::decommit):
-        (WTF::PageReservation::committed):
-
-2011-01-31  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r76969.
-        http://trac.webkit.org/changeset/76969
-        https://bugs.webkit.org/show_bug.cgi?id=53418
-
-        "It is causing crashes in GTK+ and Leopard bots" (Requested by
-        alexg__ on #webkit).
-
-        * runtime/WeakGCMap.h:
-
-2011-01-30  Csaba Osztrogonác  <ossy@webkit.org>
+        Bug 58705 - DFG JIT Add support for flow control (branch, jump).
+
+        Add support for control flow by breaking the CodeBlock up into multiple
+        basic blocks, generating code for each basic block in turn through the
+        speculative JIT & then the non-speculative JIT.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setTemporary):
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (JSC::DFG::BasicBlock::getBytecodeOffset):
+        (JSC::DFG::Graph::blockIndexForBytecodeOffset):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::JITCodeGenerator):
+        (JSC::DFG::JITCodeGenerator::addBranch):
+        (JSC::DFG::JITCodeGenerator::linkBranches):
+        (JSC::DFG::JITCodeGenerator::BranchRecord::BranchRecord):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::isJump):
+        (JSC::DFG::Node::isBranch):
+        (JSC::DFG::Node::takenBytecodeOffset):
+        (JSC::DFG::Node::notTakenBytecodeOffset):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
 
-        Unreviewed, rolling out r77098, r77099, r77100, r77109, and
-        r77111.
-        http://trac.webkit.org/changeset/77098
-        http://trac.webkit.org/changeset/77099
-        http://trac.webkit.org/changeset/77100
-        http://trac.webkit.org/changeset/77109
-        http://trac.webkit.org/changeset/77111
-        https://bugs.webkit.org/show_bug.cgi?id=53219
+        Reviewed by Geoff Garen.
 
-        Qt build is broken
+        Bug 58701 - DFG JIT - add GetLocal/SetLocal nodes
+
+        Use these for both access to arguments & local variables, adds ability
+        to set locals, such that values will persist between basic blocks.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::getVariable):
+        (JSC::DFG::ByteCodeParser::setVariable):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::getThis):
+        (JSC::DFG::ByteCodeParser::setThis):
+        (JSC::DFG::ByteCodeParser::VariableRecord::VariableRecord):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::derefChildren):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::ref):
+        (JSC::DFG::Graph::deref):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasLocal):
+        (JSC::DFG::Node::local):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
 
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObjectData::setPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
-        (JSC::JSCallbackObject::setPrivateProperty):
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::put):
-        (JSC::::staticFunctionGetter):
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeConstructor):
-        (JSObjectSetPrivateProperty):
-        * API/JSWeakObjectMapRefInternal.h:
-        * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::markAggregate):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::globalObject):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
-        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
-        (JSC::BytecodeGenerator::findScopedProperty):
-        * debugger/Debugger.cpp:
-        (JSC::evaluateInGlobalCallFrame):
-        * debugger/DebuggerActivation.cpp:
-        (JSC::DebuggerActivation::DebuggerActivation):
-        (JSC::DebuggerActivation::markChildren):
-        * debugger/DebuggerActivation.h:
-        * debugger/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate):
-        * interpreter/CallFrame.h:
-        (JSC::ExecState::exception):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::resolve):
-        (JSC::Interpreter::resolveSkip):
-        (JSC::Interpreter::resolveGlobal):
-        (JSC::Interpreter::resolveGlobalDynamic):
-        (JSC::Interpreter::resolveBaseAndProperty):
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::appendSourceToError):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::tryCacheGetByID):
-        (JSC::Interpreter::privateExecute):
-        * jit/JITStubs.cpp:
-        (JSC::JITThunks::tryCacheGetByID):
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jsc.cpp:
-        (GlobalObject::GlobalObject):
-        * runtime/ArgList.cpp:
-        (JSC::MarkedArgumentBuffer::markLists):
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::markChildren):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::getOwnPropertyDescriptor):
-        (JSC::Arguments::put):
-        * runtime/Arguments.h:
-        (JSC::Arguments::setActivation):
-        (JSC::Arguments::Arguments):
-        * runtime/ArrayConstructor.cpp:
-        (JSC::ArrayConstructor::ArrayConstructor):
-        (JSC::constructArrayWithSizeQuirk):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncSplice):
-        * runtime/BatchedTransitionOptimizer.h:
-        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
-        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
-        * runtime/BooleanConstructor.cpp:
-        (JSC::BooleanConstructor::BooleanConstructor):
-        (JSC::constructBoolean):
-        (JSC::constructBooleanFromImmediateBoolean):
-        * runtime/BooleanPrototype.cpp:
-        (JSC::BooleanPrototype::BooleanPrototype):
-        * runtime/ConservativeSet.cpp:
-        (JSC::ConservativeSet::grow):
-        * runtime/ConservativeSet.h:
-        (JSC::ConservativeSet::~ConservativeSet):
-        (JSC::ConservativeSet::mark):
-        * runtime/DateConstructor.cpp:
-        (JSC::DateConstructor::DateConstructor):
-        * runtime/DateInstance.cpp:
-        (JSC::DateInstance::DateInstance):
-        * runtime/DatePrototype.cpp:
-        (JSC::dateProtoFuncSetTime):
-        (JSC::setNewValueFromTimeArgs):
-        (JSC::setNewValueFromDateArgs):
-        (JSC::dateProtoFuncSetYear):
-        * runtime/ErrorConstructor.cpp:
-        (JSC::ErrorConstructor::ErrorConstructor):
-        * runtime/ErrorInstance.cpp:
-        (JSC::ErrorInstance::ErrorInstance):
-        * runtime/ErrorPrototype.cpp:
-        (JSC::ErrorPrototype::ErrorPrototype):
-        * runtime/FunctionConstructor.cpp:
-        (JSC::FunctionConstructor::FunctionConstructor):
-        * runtime/FunctionPrototype.cpp:
-        (JSC::FunctionPrototype::FunctionPrototype):
-        * runtime/GetterSetter.cpp:
-        (JSC::GetterSetter::markChildren):
-        * runtime/GetterSetter.h:
-        (JSC::GetterSetter::GetterSetter):
-        (JSC::GetterSetter::getter):
-        (JSC::GetterSetter::setGetter):
-        (JSC::GetterSetter::setter):
-        (JSC::GetterSetter::setSetter):
-        * runtime/GlobalEvalFunction.cpp:
-        (JSC::GlobalEvalFunction::GlobalEvalFunction):
-        (JSC::GlobalEvalFunction::markChildren):
-        * runtime/GlobalEvalFunction.h:
-        (JSC::GlobalEvalFunction::cachedGlobalObject):
-        * runtime/Heap.cpp:
-        (JSC::Heap::markProtectedObjects):
-        (JSC::Heap::markTempSortVectors):
-        (JSC::Heap::markRoots):
-        * runtime/InternalFunction.cpp:
-        (JSC::InternalFunction::InternalFunction):
-        * runtime/JSAPIValueWrapper.h:
-        (JSC::JSAPIValueWrapper::value):
-        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
-        * runtime/JSActivation.cpp:
-        (JSC::JSActivation::markChildren):
-        (JSC::JSActivation::put):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::JSArray):
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::deleteProperty):
-        (JSC::JSArray::increaseVectorLength):
-        (JSC::JSArray::setLength):
-        (JSC::JSArray::pop):
-        (JSC::JSArray::push):
-        (JSC::JSArray::unshiftCount):
-        (JSC::JSArray::sort):
-        (JSC::JSArray::fillArgList):
-        (JSC::JSArray::copyToRegisters):
-        (JSC::JSArray::compactForSorting):
-        * runtime/JSArray.h:
-        (JSC::JSArray::getIndex):
-        (JSC::JSArray::setIndex):
-        (JSC::JSArray::uncheckedSetIndex):
-        (JSC::JSArray::markChildrenDirect):
-        * runtime/JSByteArray.cpp:
-        (JSC::JSByteArray::JSByteArray):
-        * runtime/JSCell.h:
-        (JSC::JSCell::JSValue::toThisObject):
-        (JSC::JSCell::MarkStack::append):
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
-        (JSC::JSFunction::getOwnPropertySlot):
-        * runtime/JSGlobalData.h:
-        * runtime/JSGlobalObject.cpp:
-        (JSC::markIfNeeded):
-        (JSC::JSGlobalObject::reset):
-        (JSC::JSGlobalObject::resetPrototype):
-        (JSC::JSGlobalObject::markChildren):
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
-        (JSC::JSGlobalObject::regExpConstructor):
-        (JSC::JSGlobalObject::errorConstructor):
-        (JSC::JSGlobalObject::evalErrorConstructor):
-        (JSC::JSGlobalObject::rangeErrorConstructor):
-        (JSC::JSGlobalObject::referenceErrorConstructor):
-        (JSC::JSGlobalObject::syntaxErrorConstructor):
-        (JSC::JSGlobalObject::typeErrorConstructor):
-        (JSC::JSGlobalObject::URIErrorConstructor):
-        (JSC::JSGlobalObject::evalFunction):
-        (JSC::JSGlobalObject::objectPrototype):
-        (JSC::JSGlobalObject::functionPrototype):
-        (JSC::JSGlobalObject::arrayPrototype):
-        (JSC::JSGlobalObject::booleanPrototype):
-        (JSC::JSGlobalObject::stringPrototype):
-        (JSC::JSGlobalObject::numberPrototype):
-        (JSC::JSGlobalObject::datePrototype):
-        (JSC::JSGlobalObject::regExpPrototype):
-        (JSC::JSGlobalObject::methodCallDummy):
-        (JSC::Structure::prototypeForLookup):
-        (JSC::constructArray):
-        * runtime/JSONObject.cpp:
-        (JSC::Stringifier::Holder::object):
-        (JSC::Stringifier::markAggregate):
-        (JSC::Stringifier::stringify):
-        (JSC::Stringifier::Holder::appendNextProperty):
-        (JSC::Walker::callReviver):
-        (JSC::Walker::walk):
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::defineGetter):
-        (JSC::JSObject::defineSetter):
-        (JSC::JSObject::removeDirect):
-        (JSC::JSObject::putDirectFunction):
-        (JSC::JSObject::putDirectFunctionWithoutTransition):
-        (JSC::putDescriptor):
-        (JSC::JSObject::defineOwnProperty):
-        * runtime/JSObject.h:
-        (JSC::JSObject::getDirectOffset):
-        (JSC::JSObject::putDirectOffset):
-        (JSC::JSObject::flattenDictionaryObject):
-        (JSC::JSObject::putDirectInternal):
-        (JSC::JSObject::putDirect):
-        (JSC::JSObject::putDirectFunction):
-        (JSC::JSObject::putDirectWithoutTransition):
-        (JSC::JSObject::putDirectFunctionWithoutTransition):
-        (JSC::JSValue::putDirect):
-        (JSC::JSObject::allocatePropertyStorageInline):
-        (JSC::JSObject::markChildrenDirect):
-        * runtime/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::get):
-        * runtime/JSPropertyNameIterator.h:
-        * runtime/JSStaticScopeObject.cpp:
-        (JSC::JSStaticScopeObject::markChildren):
-        * runtime/JSString.cpp:
-        (JSC::StringObject::create):
-        * runtime/JSValue.h:
-        * runtime/JSWrapperObject.cpp:
-        (JSC::JSWrapperObject::markChildren):
-        * runtime/JSWrapperObject.h:
-        (JSC::JSWrapperObject::internalValue):
-        (JSC::JSWrapperObject::setInternalValue):
-        * runtime/LiteralParser.cpp:
-        (JSC::LiteralParser::parse):
-        * runtime/Lookup.cpp:
-        (JSC::setUpStaticFunctionSlot):
-        * runtime/Lookup.h:
-        (JSC::lookupPut):
-        * runtime/MarkStack.h:
-        (JSC::MarkStack::appendValues):
-        * runtime/MathObject.cpp:
-        (JSC::MathObject::MathObject):
-        * runtime/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::NativeErrorConstructor):
-        * runtime/NativeErrorPrototype.cpp:
-        (JSC::NativeErrorPrototype::NativeErrorPrototype):
-        * runtime/NumberConstructor.cpp:
-        (JSC::NumberConstructor::NumberConstructor):
-        (JSC::constructWithNumberConstructor):
-        * runtime/NumberObject.cpp:
-        (JSC::constructNumber):
-        * runtime/NumberPrototype.cpp:
-        (JSC::NumberPrototype::NumberPrototype):
-        * runtime/ObjectConstructor.cpp:
-        (JSC::ObjectConstructor::ObjectConstructor):
-        (JSC::objectConstructorGetOwnPropertyDescriptor):
-        * runtime/Operations.h:
-        (JSC::normalizePrototypeChain):
-        (JSC::resolveBase):
-        * runtime/PrototypeFunction.cpp:
-        (JSC::PrototypeFunction::PrototypeFunction):
-        * runtime/PutPropertySlot.h:
-        (JSC::PutPropertySlot::setExistingProperty):
-        (JSC::PutPropertySlot::setNewProperty):
-        (JSC::PutPropertySlot::base):
-        * runtime/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor):
-        * runtime/ScopeChain.cpp:
-        (JSC::ScopeChainNode::print):
-        * runtime/ScopeChain.h:
-        (JSC::ScopeChainNode::~ScopeChainNode):
-        (JSC::ScopeChainIterator::operator*):
-        (JSC::ScopeChainIterator::operator->):
-        (JSC::ScopeChain::top):
-        * runtime/ScopeChainMark.h:
-        (JSC::ScopeChain::markAggregate):
-        * runtime/SmallStrings.cpp:
-        (JSC::isMarked):
-        (JSC::SmallStrings::markChildren):
-        * runtime/SmallStrings.h:
-        (JSC::SmallStrings::emptyString):
-        (JSC::SmallStrings::singleCharacterString):
-        (JSC::SmallStrings::singleCharacterStrings):
-        * runtime/StringConstructor.cpp:
-        (JSC::StringConstructor::StringConstructor):
-        * runtime/StringObject.cpp:
-        (JSC::StringObject::StringObject):
-        * runtime/StringObject.h:
-        * runtime/StringPrototype.cpp:
-        (JSC::StringPrototype::StringPrototype):
-        * runtime/Structure.cpp:
-        (JSC::Structure::Structure):
-        (JSC::Structure::addPropertyTransition):
-        (JSC::Structure::toDictionaryTransition):
-        (JSC::Structure::flattenDictionaryStructure):
-        * runtime/Structure.h:
-        (JSC::Structure::storedPrototype):
-        * runtime/WeakGCMap.h:
-        (JSC::WeakGCMap::uncheckedGet):
-        (JSC::WeakGCMap::isValid):
-        (JSC::::get):
-        (JSC::::take):
-        (JSC::::set):
-        (JSC::::uncheckedRemove):
-        * runtime/WriteBarrier.h: Removed.
+        Reviewed by Sam Weinig.
 
-2011-01-30  Simon Fraser  <simon.fraser@apple.com>
+        Bug 58696 - DFG JIT split handling of vars/temporaries
+
+        Presently all callee registers are treated as having single block scope,
+        since the DFG JIT can only compile single block functions. In order to
+        expand the JIT to support control flow we will need to change to retaining
+        locals (but not temporaries) across basic block boundaries.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::getVariable):
+        (JSC::DFG::ByteCodeParser::setVariable):
+        (JSC::DFG::ByteCodeParser::getTemporary):
+        (JSC::DFG::ByteCodeParser::setTemporary):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::getInt32Constant):
+        (JSC::DFG::ByteCodeParser::getDoubleConstant):
+        (JSC::DFG::ByteCodeParser::getJSConstant):
+        (JSC::DFG::ByteCodeParser::constantUndefined):
+        (JSC::DFG::ByteCodeParser::constantNull):
+        (JSC::DFG::ByteCodeParser::one):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        (JSC::DFG::parse):
+        * dfg/DFGNode.h:
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::ScoreBoard):
+        (JSC::DFG::ScoreBoard::~ScoreBoard):
+        (JSC::DFG::ScoreBoard::allocate):
+        (JSC::DFG::ScoreBoard::use):
+
+2011-04-15  Michael Saboff  <msaboff@apple.com>
 
-        Build fix the build fix. I assume Oliver meant m_cell, not m_value.
+        Reviewed by Oliver Hunt.
 
-        * runtime/WriteBarrier.h:
-        (JSC::WriteBarrierBase::clear):
+        globalObject moved to JSObjectWithGlobalObject.cpp inhibits inlining
+        https://bugs.webkit.org/show_bug.cgi?id=58677
 
-2011-01-30  Oliver Hunt  <oliver@apple.com>
+        Moved JSObjectWithGlobalObject::globalObject() to 
+        runtime/JSObjectWithGlobalObject.h to allow the compiler to inline
+        it for a performance benefit.  An equivalent instance had been in
+        a header file before r60057.
 
-        More Qt build fixes
+        * JavaScriptCore.exp:
+        * runtime/JSObjectWithGlobalObject.cpp:
+        * runtime/JSObjectWithGlobalObject.h:
+        (JSC::JSObjectWithGlobalObject::globalObject):
 
-        * runtime/WriteBarrier.h:
-        (JSC::WriteBarrierBase::clear):
+2011-04-14  Oliver Hunt  <oliver@apple.com>
 
-2011-01-30  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Geoffrey Garen.
 
-        Convert markstack to a slot visitor API
-        https://bugs.webkit.org/show_bug.cgi?id=53219
+        Make JSNodeFilterCondition handle its lifetime correctly
+        https://bugs.webkit.org/show_bug.cgi?id=58622
 
-        rolling r77006 and r77020 back in.
+        Add export
 
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObjectData::setPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
-        (JSC::JSCallbackObject::setPrivateProperty):
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::put):
-        (JSC::::staticFunctionGetter):
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeConstructor):
-        (JSObjectSetPrivateProperty):
-        * API/JSWeakObjectMapRefInternal.h:
         * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::markAggregate):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::globalObject):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
-        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
-        (JSC::BytecodeGenerator::findScopedProperty):
-        * debugger/Debugger.cpp:
-        (JSC::evaluateInGlobalCallFrame):
-        * debugger/DebuggerActivation.cpp:
-        (JSC::DebuggerActivation::DebuggerActivation):
-        (JSC::DebuggerActivation::markChildren):
-        * debugger/DebuggerActivation.h:
-        * debugger/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate):
-        * interpreter/CallFrame.h:
-        (JSC::ExecState::exception):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::resolve):
-        (JSC::Interpreter::resolveSkip):
-        (JSC::Interpreter::resolveGlobal):
-        (JSC::Interpreter::resolveGlobalDynamic):
-        (JSC::Interpreter::resolveBaseAndProperty):
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::appendSourceToError):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::tryCacheGetByID):
-        (JSC::Interpreter::privateExecute):
-        * jit/JITStubs.cpp:
-        (JSC::JITThunks::tryCacheGetByID):
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jsc.cpp:
-        (GlobalObject::GlobalObject):
-        * runtime/ArgList.cpp:
-        (JSC::MarkedArgumentBuffer::markLists):
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::markChildren):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::getOwnPropertyDescriptor):
-        (JSC::Arguments::put):
-        * runtime/Arguments.h:
-        (JSC::Arguments::setActivation):
-        (JSC::Arguments::Arguments):
-        * runtime/ArrayConstructor.cpp:
-        (JSC::ArrayConstructor::ArrayConstructor):
-        (JSC::constructArrayWithSizeQuirk):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncSplice):
-        * runtime/BatchedTransitionOptimizer.h:
-        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
-        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
-        * runtime/BooleanConstructor.cpp:
-        (JSC::BooleanConstructor::BooleanConstructor):
-        (JSC::constructBoolean):
-        (JSC::constructBooleanFromImmediateBoolean):
-        * runtime/BooleanPrototype.cpp:
-        (JSC::BooleanPrototype::BooleanPrototype):
-        * runtime/ConservativeSet.cpp:
-        (JSC::ConservativeSet::grow):
-        * runtime/ConservativeSet.h:
-        (JSC::ConservativeSet::~ConservativeSet):
-        (JSC::ConservativeSet::mark):
-        * runtime/DateConstructor.cpp:
-        (JSC::DateConstructor::DateConstructor):
-        * runtime/DateInstance.cpp:
-        (JSC::DateInstance::DateInstance):
-        * runtime/DatePrototype.cpp:
-        (JSC::dateProtoFuncSetTime):
-        (JSC::setNewValueFromTimeArgs):
-        (JSC::setNewValueFromDateArgs):
-        (JSC::dateProtoFuncSetYear):
-        * runtime/ErrorConstructor.cpp:
-        (JSC::ErrorConstructor::ErrorConstructor):
-        * runtime/ErrorInstance.cpp:
-        (JSC::ErrorInstance::ErrorInstance):
-        * runtime/ErrorPrototype.cpp:
-        (JSC::ErrorPrototype::ErrorPrototype):
-        * runtime/FunctionConstructor.cpp:
-        (JSC::FunctionConstructor::FunctionConstructor):
-        * runtime/FunctionPrototype.cpp:
-        (JSC::FunctionPrototype::FunctionPrototype):
-        * runtime/GetterSetter.cpp:
-        (JSC::GetterSetter::markChildren):
-        * runtime/GetterSetter.h:
-        (JSC::GetterSetter::GetterSetter):
-        (JSC::GetterSetter::getter):
-        (JSC::GetterSetter::setGetter):
-        (JSC::GetterSetter::setter):
-        (JSC::GetterSetter::setSetter):
-        * runtime/GlobalEvalFunction.cpp:
-        (JSC::GlobalEvalFunction::GlobalEvalFunction):
-        (JSC::GlobalEvalFunction::markChildren):
-        * runtime/GlobalEvalFunction.h:
-        (JSC::GlobalEvalFunction::cachedGlobalObject):
-        * runtime/Heap.cpp:
-        (JSC::Heap::markProtectedObjects):
-        (JSC::Heap::markTempSortVectors):
-        (JSC::Heap::markRoots):
-        * runtime/InternalFunction.cpp:
-        (JSC::InternalFunction::InternalFunction):
-        * runtime/JSAPIValueWrapper.h:
-        (JSC::JSAPIValueWrapper::value):
-        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
-        * runtime/JSActivation.cpp:
-        (JSC::JSActivation::markChildren):
-        (JSC::JSActivation::put):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::JSArray):
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::deleteProperty):
-        (JSC::JSArray::increaseVectorLength):
-        (JSC::JSArray::setLength):
-        (JSC::JSArray::pop):
-        (JSC::JSArray::push):
-        (JSC::JSArray::unshiftCount):
-        (JSC::JSArray::sort):
-        (JSC::JSArray::fillArgList):
-        (JSC::JSArray::copyToRegisters):
-        (JSC::JSArray::compactForSorting):
-        * runtime/JSArray.h:
-        (JSC::JSArray::getIndex):
-        (JSC::JSArray::setIndex):
-        (JSC::JSArray::uncheckedSetIndex):
-        (JSC::JSArray::markChildrenDirect):
-        * runtime/JSByteArray.cpp:
-        (JSC::JSByteArray::JSByteArray):
-        * runtime/JSCell.h:
-        (JSC::JSCell::MarkStack::append):
-        (JSC::JSCell::MarkStack::internalAppend):
-        (JSC::JSCell::MarkStack::deprecatedAppend):
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
-        (JSC::JSFunction::getOwnPropertySlot):
-        * runtime/JSGlobalData.h:
-        * runtime/JSGlobalObject.cpp:
-        (JSC::markIfNeeded):
-        (JSC::JSGlobalObject::reset):
-        (JSC::JSGlobalObject::resetPrototype):
-        (JSC::JSGlobalObject::markChildren):
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
-        (JSC::JSGlobalObject::regExpConstructor):
-        (JSC::JSGlobalObject::errorConstructor):
-        (JSC::JSGlobalObject::evalErrorConstructor):
-        (JSC::JSGlobalObject::rangeErrorConstructor):
-        (JSC::JSGlobalObject::referenceErrorConstructor):
-        (JSC::JSGlobalObject::syntaxErrorConstructor):
-        (JSC::JSGlobalObject::typeErrorConstructor):
-        (JSC::JSGlobalObject::URIErrorConstructor):
-        (JSC::JSGlobalObject::evalFunction):
-        (JSC::JSGlobalObject::objectPrototype):
-        (JSC::JSGlobalObject::functionPrototype):
-        (JSC::JSGlobalObject::arrayPrototype):
-        (JSC::JSGlobalObject::booleanPrototype):
-        (JSC::JSGlobalObject::stringPrototype):
-        (JSC::JSGlobalObject::numberPrototype):
-        (JSC::JSGlobalObject::datePrototype):
-        (JSC::JSGlobalObject::regExpPrototype):
-        (JSC::JSGlobalObject::methodCallDummy):
-        (JSC::Structure::prototypeForLookup):
-        (JSC::constructArray):
-        * runtime/JSONObject.cpp:
-        (JSC::Stringifier::Holder::object):
-        (JSC::Stringifier::Holder::objectSlot):
-        (JSC::Stringifier::markAggregate):
-        (JSC::Stringifier::stringify):
-        (JSC::Stringifier::Holder::appendNextProperty):
-        (JSC::Walker::callReviver):
-        (JSC::Walker::walk):
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::defineGetter):
-        (JSC::JSObject::defineSetter):
-        (JSC::JSObject::removeDirect):
-        (JSC::JSObject::putDirectFunction):
-        (JSC::JSObject::putDirectFunctionWithoutTransition):
-        (JSC::putDescriptor):
-        (JSC::JSObject::defineOwnProperty):
-        * runtime/JSObject.h:
-        (JSC::JSObject::getDirectOffset):
-        (JSC::JSObject::putDirectOffset):
-        (JSC::JSObject::putUndefinedAtDirectOffset):
-        (JSC::JSObject::flattenDictionaryObject):
-        (JSC::JSObject::putDirectInternal):
-        (JSC::JSObject::putDirect):
-        (JSC::JSObject::putDirectFunction):
-        (JSC::JSObject::putDirectWithoutTransition):
-        (JSC::JSObject::putDirectFunctionWithoutTransition):
-        (JSC::JSValue::putDirect):
-        (JSC::JSObject::allocatePropertyStorageInline):
-        (JSC::JSObject::markChildrenDirect):
-        * runtime/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::get):
-        * runtime/JSPropertyNameIterator.h:
-        * runtime/JSStaticScopeObject.cpp:
-        (JSC::JSStaticScopeObject::markChildren):
-        * runtime/JSString.cpp:
-        (JSC::StringObject::create):
-        * runtime/JSValue.h:
-        * runtime/JSWrapperObject.cpp:
-        (JSC::JSWrapperObject::markChildren):
-        * runtime/JSWrapperObject.h:
-        (JSC::JSWrapperObject::internalValue):
-        (JSC::JSWrapperObject::setInternalValue):
-        * runtime/LiteralParser.cpp:
-        (JSC::LiteralParser::parse):
-        * runtime/Lookup.cpp:
-        (JSC::setUpStaticFunctionSlot):
-        * runtime/Lookup.h:
-        (JSC::lookupPut):
-        * runtime/MarkStack.h:
-        (JSC::MarkStack::MarkStack):
-        (JSC::MarkStack::deprecatedAppendValues):
-        (JSC::MarkStack::appendValues):
-        * runtime/MathObject.cpp:
-        (JSC::MathObject::MathObject):
-        * runtime/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::NativeErrorConstructor):
-        * runtime/NativeErrorPrototype.cpp:
-        (JSC::NativeErrorPrototype::NativeErrorPrototype):
-        * runtime/NumberConstructor.cpp:
-        (JSC::NumberConstructor::NumberConstructor):
-        (JSC::constructWithNumberConstructor):
-        * runtime/NumberObject.cpp:
-        (JSC::constructNumber):
-        * runtime/NumberPrototype.cpp:
-        (JSC::NumberPrototype::NumberPrototype):
-        * runtime/ObjectConstructor.cpp:
-        (JSC::ObjectConstructor::ObjectConstructor):
-        (JSC::objectConstructorGetOwnPropertyDescriptor):
-        * runtime/Operations.h:
-        (JSC::normalizePrototypeChain):
-        (JSC::resolveBase):
-        * runtime/PrototypeFunction.cpp:
-        (JSC::PrototypeFunction::PrototypeFunction):
-        * runtime/PutPropertySlot.h:
-        (JSC::PutPropertySlot::setExistingProperty):
-        (JSC::PutPropertySlot::setNewProperty):
-        (JSC::PutPropertySlot::base):
-        * runtime/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor):
-        * runtime/ScopeChain.cpp:
-        (JSC::ScopeChainNode::print):
-        * runtime/ScopeChain.h:
-        (JSC::ScopeChainNode::~ScopeChainNode):
-        (JSC::ScopeChainIterator::operator*):
-        (JSC::ScopeChainIterator::operator->):
-        (JSC::ScopeChain::top):
-        * runtime/ScopeChainMark.h:
-        (JSC::ScopeChain::markAggregate):
-        * runtime/SmallStrings.cpp:
-        (JSC::isMarked):
-        (JSC::SmallStrings::markChildren):
-        * runtime/SmallStrings.h:
-        (JSC::SmallStrings::emptyString):
-        (JSC::SmallStrings::singleCharacterString):
-        (JSC::SmallStrings::singleCharacterStrings):
-        * runtime/StringConstructor.cpp:
-        (JSC::StringConstructor::StringConstructor):
-        * runtime/StringObject.cpp:
-        (JSC::StringObject::StringObject):
-        * runtime/StringObject.h:
-        * runtime/StringPrototype.cpp:
-        (JSC::StringPrototype::StringPrototype):
-        * runtime/Structure.cpp:
-        (JSC::Structure::Structure):
-        (JSC::Structure::addPropertyTransition):
-        (JSC::Structure::toDictionaryTransition):
-        (JSC::Structure::flattenDictionaryStructure):
-        * runtime/Structure.h:
-        (JSC::Structure::storedPrototype):
-        (JSC::Structure::storedPrototypeSlot):
-        * runtime/WeakGCMap.h:
-        (JSC::WeakGCMap::uncheckedGet):
-        (JSC::WeakGCMap::uncheckedGetSlot):
-        (JSC::WeakGCMap::isValid):
-        (JSC::::get):
-        (JSC::::take):
-        (JSC::::set):
-        (JSC::::uncheckedRemove):
-        * runtime/WriteBarrier.h: Added.
-        (JSC::DeprecatedPtr::DeprecatedPtr):
-        (JSC::DeprecatedPtr::get):
-        (JSC::DeprecatedPtr::operator*):
-        (JSC::DeprecatedPtr::operator->):
-        (JSC::DeprecatedPtr::slot):
-        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
-        (JSC::DeprecatedPtr::operator!):
-        (JSC::WriteBarrierBase::set):
-        (JSC::WriteBarrierBase::get):
-        (JSC::WriteBarrierBase::operator*):
-        (JSC::WriteBarrierBase::operator->):
-        (JSC::WriteBarrierBase::slot):
-        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
-        (JSC::WriteBarrierBase::operator!):
-        (JSC::WriteBarrier::WriteBarrier):
-        (JSC::operator==):
 
-2011-01-30  Geoffrey Garen  <ggaren@apple.com>
+2011-04-14  Alexey Proskuryakov  <ap@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Dan Bernstein.
 
-        Filter all Heap collection through a common reset function, in
-        preparation for adding features triggered by collection.
-        https://bugs.webkit.org/show_bug.cgi?id=53396
-        
-        SunSpider reports no change.
+        WebKit2: Password field input does not switch to ASCII-compatible source
+        https://bugs.webkit.org/show_bug.cgi?id=58583
+        <rdar://problem/9059651>
 
-        * runtime/Heap.cpp:
-        (JSC::Heap::reportExtraMemoryCostSlowCase): When we're over the extraCost
-        limit, just call collectAllGarbage() instead of rolling our own special
-        way of resetting the heap. In theory, this may be slower in some cases,
-        but it also fixes cases of pathological heap growth that we've seen,
-        where the only objects being allocated are temporary and huge
-        (<rdar://problem/8885843>).
+        * wtf/Platform.h: Removed WTF_USE_CARBON_SECURE_INPUT_MODE. It's now only used by Chromium,
+        and shouldn't be enabled on any other platforms, so there is no reason to make it
+        configurable via Platform.h.
 
-        (JSC::Heap::allocate):
-        (JSC::Heap::collectAllGarbage): Use the shared reset function.
+2011-04-15  Dmitry Lomov  <dslomov@google.com>
 
-        (JSC::Heap::reset):
-        * runtime/Heap.h: Carved a new shared reset function out of the old
-        collectAllGarbage.
-
-2011-01-30  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r77025.
-        http://trac.webkit.org/changeset/77025
-        https://bugs.webkit.org/show_bug.cgi?id=53401
-
-        It made js1_5/Regress/regress-159334.js fail on 64 bit Linux
-        (Requested by Ossy on #webkit).
-
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FreeListEntry::FreeListEntry):
-        (JSC::AVLTreeAbstractorForFreeList::get_less):
-        (JSC::AVLTreeAbstractorForFreeList::set_less):
-        (JSC::AVLTreeAbstractorForFreeList::get_greater):
-        (JSC::AVLTreeAbstractorForFreeList::set_greater):
-        (JSC::AVLTreeAbstractorForFreeList::get_balance_factor):
-        (JSC::AVLTreeAbstractorForFreeList::set_balance_factor):
-        (JSC::AVLTreeAbstractorForFreeList::null):
-        (JSC::AVLTreeAbstractorForFreeList::compare_key_key):
-        (JSC::AVLTreeAbstractorForFreeList::compare_key_node):
-        (JSC::AVLTreeAbstractorForFreeList::compare_node_node):
-        (JSC::reverseSortFreeListEntriesByPointer):
-        (JSC::reverseSortCommonSizedAllocations):
-        (JSC::FixedVMPoolAllocator::release):
-        (JSC::FixedVMPoolAllocator::reuse):
-        (JSC::FixedVMPoolAllocator::addToFreeList):
-        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
-        (JSC::FixedVMPoolAllocator::alloc):
-        (JSC::FixedVMPoolAllocator::free):
-        (JSC::FixedVMPoolAllocator::isValid):
-        (JSC::FixedVMPoolAllocator::allocInternal):
-        (JSC::FixedVMPoolAllocator::isWithinVMPool):
-        (JSC::FixedVMPoolAllocator::addToCommittedByteCount):
-        (JSC::ExecutableAllocator::committedByteCount):
-        (JSC::maybeModifyVMPoolSize):
-        (JSC::ExecutableAllocator::isValid):
-        (JSC::ExecutableAllocator::underMemoryPressure):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::PageReservation):
-        (WTF::PageReservation::commit):
-        (WTF::PageReservation::decommit):
-
-2011-01-30  Leo Yang  <leo.yang@torchmobile.com.cn>
-
-        Reviewed by Daniel Bates.
-
-        Code style issue in JavaScriptCore/wtf/CurrentTime.h
-        https://bugs.webkit.org/show_bug.cgi?id=53394
-
-        According to rule #3 at http://webkit.org/coding/coding-style.html,
-        This patch fix style issue in CurrentTime.h.
-
-        No functionality change, no new tests.
-
-        * wtf/CurrentTime.h:
-        (WTF::currentTimeMS):
-        (WTF::getLocalTime):
-
-2011-01-30  Benjamin Poulain  <ikipou@gmail.com>
+        Reviewed by David Levin.
 
-        Reviewed by Kenneth Rohde Christiansen.
+        Add a sample test case for GTest framework
+        https://bugs.webkit.org/show_bug.cgi?id=58509
 
-        [Qt] JavaScriptCore does not link on Mac if building WebKit 2
-        https://bugs.webkit.org/show_bug.cgi?id=53377
+        Add an example of GTest testcase, complete with a runner, to JavaScriptCore.
 
-        The option "-whole-archive" is not availabe with the libtool of Mac OS X,
-        instead, we can use "-all_load" on Mac.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/tests/RunAllWtfTests.cpp: Added.
+        (main):
+        * wtf/tests/StringTests.cpp: Added.
 
-        * JavaScriptCore.pri:
+2011-04-15  Anna Cavender  <annacc@chromium.org>
 
-2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Eric Carlson.
 
-        Sorry Leopard bot -- I committed a change by accident.
+        Renaming TRACK feature define to VIDEO_TRACK
+        https://bugs.webkit.org/show_bug.cgi?id=53556
 
-        * JavaScriptCore.exp: You may have your symbols back now.
+        * Configurations/FeatureDefines.xcconfig:
 
-2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+2011-04-14  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Cameron Zwarich.
+        Rubber stamped by Geoffrey Garen.
 
-        Simplified Heap iteration
-        https://bugs.webkit.org/show_bug.cgi?id=53393
-
-        * runtime/CollectorHeapIterator.h:
-        (JSC::CollectorHeapIterator::isValid):
-        (JSC::CollectorHeapIterator::isLive):
-        (JSC::CollectorHeapIterator::advance): Removed "max" argument to
-        advance because it's a constant.
-        (JSC::LiveObjectIterator::LiveObjectIterator):
-        (JSC::LiveObjectIterator::operator++):
-        (JSC::DeadObjectIterator::DeadObjectIterator):
-        (JSC::DeadObjectIterator::operator++):
-        (JSC::ObjectIterator::ObjectIterator):
-        (JSC::ObjectIterator::operator++): Factored out common checks into
-        two helper functions -- isValid() for "Am I past the end?" and isLive()
-        for "Is the cell I'm pointing to live?".
+        Hide DFG_JIT_RESTRICTIONS behind ARITHMETIC_OP() macro, and rename
+        m_regressionGuard to m_parseFailed, such that it can be reused for
+        other failure cases.
 
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::freeBlock):
-        (JSC::MarkedSpace::sweep): Always sweep from the beginning of the heap
-        to the end, to avoid making sweep subtly reliant on internal Heap state.
-        (JSC::MarkedSpace::primaryHeapBegin):
-        (JSC::MarkedSpace::primaryHeapEnd): Always be explicit about where
-        iteration begins.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parse):
 
-2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+2011-04-14  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Cameron Zwarich.
-
-        Simplified heap destruction
-        https://bugs.webkit.org/show_bug.cgi?id=53392
+        Reviewed by Geoffrey Garen.
 
-        * JavaScriptCore.exp:
-        * runtime/Heap.cpp:
-        (JSC::Heap::destroy):
-        * runtime/Heap.h:
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::destroy):
-        * runtime/MarkedSpace.h: Don't go out of our way to destroy GC-protected
-        cells last -- the difficult contortions required to do so just don't seem
-        justified. We make no guarantees about GC protection after the client
-        throws away JSGlobalData, and it doesn't seem like any meaningful
-        guarantee is even possible.
+        Bug 58620 - DFG JIT - loading of arguments should not be lazy
+
+        This optimization is overly simplistic. It only works because we never
+        write out definitions to arguments (since we currently only compile
+        single block functions). Revert this for now, we may want to reintroduce
+        something like this again in the future, but it will need to be aware
+        how to schedule definitions to arguments versus lazy loads that have not
+        yet been performed.
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::needsSpill):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::initConstantInfo):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::fillNumericToDouble):
+        (JSC::DFG::JITCompiler::fillInt32ToInteger):
+        (JSC::DFG::JITCompiler::fillToJS):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::isKnownInteger):
+        (JSC::DFG::NonSpeculativeJIT::isKnownNumeric):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-04-14  Gavin Barraclough  <barraclough@apple.com>
 
-2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Maciej Stachowiak.
+        Bug 58600 - DFG JIT bugs in ValueToInt, PutByVal
 
-        Switched heap to use the Bitmap class and removed CollectorBitmap
-        https://bugs.webkit.org/show_bug.cgi?id=53391
-        
-        SunSpider says 1.005x as fast. Seems like a fluke.
+        The bug in PutByVal is that an operand is in JSValueOperand - when this
+        locks an integer into a register it will always retag the value without
+        checking if the register is already locked. This is a problem where the
+        value being stored by a PutByVal is the same as the subscript.
+        The subscript is locked into a register first, as a strict integer.
+        Locking the value results in the subscript being modified.
 
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::allocate): Updated for rename and returning a value
-        rather than taking a value by reference.
+        The bug in ValueToInt related to the function of sillentFillAllRegisters.
+        The problem is that this method will restore all register values from
+        prior to the call, overwriting the result of the call out. Allow a
+        register to be passed to specifically be excluded from being preserved.
 
-        * runtime/MarkedSpace.h: Code reuse is good.
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::debugOffset):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::debugOffset):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::debugOffset):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::debugOffset):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::debugAddress):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::debugOffset):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::orPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::debugOffset):
+        (JSC::X86Assembler::X86InstructionFormatter::debugOffset):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGenerationInfo.h:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::isConstant):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::isConstant):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::valueToNumber):
+        (JSC::DFG::NonSpeculativeJIT::valueToInt32):
+        (JSC::DFG::NonSpeculativeJIT::numberToInt32):
+        (JSC::DFG::NonSpeculativeJIT::isKnownInteger):
+        (JSC::DFG::NonSpeculativeJIT::isKnownNumeric):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+        (JSC::DFG::NonSpeculativeJIT::silentSpillGPR):
+        (JSC::DFG::NonSpeculativeJIT::silentSpillFPR):
+        (JSC::DFG::NonSpeculativeJIT::silentFillGPR):
+        (JSC::DFG::NonSpeculativeJIT::silentFillFPR):
+        (JSC::DFG::NonSpeculativeJIT::silentSpillAllRegisters):
+        (JSC::DFG::NonSpeculativeJIT::silentFillAllRegisters):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-04-14  Geoffrey Garen  <ggaren@apple.com>
 
-        * wtf/Bitmap.h:
-        (WTF::::testAndSet): Added, since this is the one thing Bitmap was missing
-        which CollectorBitmap had. (Renamed from the less conventional "getset".)
+        Reviewed by Oliver Hunt.
 
-        (WTF::::nextPossiblyUnset): Renamed and changed to return a value for
-        clarity. It's all the same with inlining.
+        Drain the mark stack while marking weak handles, not after.
+        https://bugs.webkit.org/show_bug.cgi?id=58574
 
-2011-01-28  Geoffrey Garen  <ggaren@apple.com>
+        Otherwise, items that would have caused more weak handle marking are
+        processed after all weak handle marking has finished, and referenced
+        weak handles get recycled.
 
-        Reviewed by Maciej Stachowiak.
+        * heap/HandleHeap.cpp:
+        (JSC::HandleHeap::markWeakHandles): Removed looping from here, since we
+        want Heap::markRoots to be responsible for draining the mark stack.
 
-        Some more Heap cleanup.
-        https://bugs.webkit.org/show_bug.cgi?id=53357
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots): Moved looping to here, as explained above.
         
-        * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated exported symbols.
+        For efficiency's sake, drain the mark stack before starting to mark weak
+        handles. Otherwise, items drained while marking weak handles may force
+        an extra trip through the weak handle list.
 
-        * runtime/Heap.cpp:
-        (JSC::Heap::reportExtraMemoryCostSlowCase): Renamed recordExtraCost to 
-        reportExtraMemoryCostSlowCase to match our naming conventions.
+        For correctness's sake, drain the mark stack each time through the weak
+        handle list. Otherwise, opaque roots that would make weak handles reachable
+        are not discovered until after weak handle marking is over.
 
-        (JSC::Heap::capacity): Renamed size to capacity because this function
-        returns the capacity of the heap, including unused portions.
+2011-04-14  Oliver Hunt  <oliver@apple.com>
 
-        * runtime/Heap.h:
-        (JSC::Heap::globalData):
-        (JSC::Heap::markedSpace):
-        (JSC::Heap::machineStackMarker):
-        (JSC::Heap::reportExtraMemoryCost): Moved statics to the top of the file.
-        Moved ctor and dtor to the beginning of the class definition. Grouped
-        functions by purpose.
+        Reviewed by Geoffrey Garen.
 
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::capacity): Renamed size to capacity because this
-        function returns the capacity of the heap, including unused portions.
+        Make protected object list in caches window reflect reality
+        https://bugs.webkit.org/show_bug.cgi?id=58565
 
-        * runtime/MarkedSpace.h: Removed statistics and the Statistics class because
-        the same information can be gotten just by calling size() and capacity().
+        Make sure the heap includes objects protected by Strong handles
+        in its list of protected objects.
 
-        * runtime/MemoryStatistics.cpp:
-        * runtime/MemoryStatistics.h: Ditto.
+        * heap/HandleHeap.h:
+        * heap/Heap.cpp:
+        (JSC::HandleHeap::protectedObjectTypeCounts):
 
-2011-01-29  Daniel Bates  <dbates@rim.com>
+2011-04-14  Satish Sampath  <satish@chromium.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Anders Carlsson.
 
-        Move wince/mt19937ar.c to ThirdParty and make it a policy choice
-        https://bugs.webkit.org/show_bug.cgi?id=53253
+        Don't emit RegExp tables for chromium where they are not used
+        https://bugs.webkit.org/show_bug.cgi?id=58544
 
-        Make inclusion of MT19937 a policy decision.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * create_regex_tables: Added the "--notables" command line argument.
 
-        Currently, we hardcoded to  use MT19937 when building for
-        Windows CE. Instead, we should make this a policy decision
-        with the Windows CE port using this by default.
+2011-04-13  Geoffrey Garen  <ggaren@apple.com>
 
-        * JavaScriptCore.pri: Append Source/ThirdParty to the end
-        of the list include directories.
-        * wtf/CMakeLists.txt: Ditto.
-        * wtf/Platform.h: Defined WTF_USE_MERSENNE_TWISTER_19937 when
-        building for Windows CE.
-        * wtf/RandomNumber.cpp:
-        (WTF::randomNumber): Substituted USE(MERSENNE_TWISTER_19937) for OS(WINCE).
+        Try to fix ASSERTs seen on Windows bots.
+
+        * wtf/HashTable.h:
+        (WTF::hashTableSwap): Force MSVC to use the right version of swap.
 
-2011-01-29  Cameron Zwarich  <zwarich@apple.com>
+2011-04-13  Ryuan Choi  <ryuan.choi@samsung.com>
 
-        Reviewed by David Kilzer.
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Bug 53374 - Remove uses of unsafe string functions in debugging code
-        https://bugs.webkit.org/show_bug.cgi?id=53374
+        [CMAKE] Separate DerivedSources.
+        https://bugs.webkit.org/show_bug.cgi?id=58427
 
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::printTraceData):
+        * CMakeLists.txt: Change DERIVED_SOURCES_DIR to DERIVED_SOURCES_JAVASCRIPTCORE_DIR.
 
-2011-01-29  Cameron Zwarich  <zwarich@apple.com>
+2011-04-13  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        JavaScriptCoreUseJIT environment variable broken
-        https://bugs.webkit.org/show_bug.cgi?id=53372
-
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Check the actual value in the string returned
-        by getenv() rather than just doing a NULL check on the return value.
+        Switched DOM wrappers to use HashMap of Weak<T> instead of WeakGCMap<T>
+        https://bugs.webkit.org/show_bug.cgi?id=58482
+        
+        This will allow wrappers to make individual decisions about their lifetimes.
 
-2011-01-29  Patrick Gansterer  <paroga@webkit.org>
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::copyWeak): New function for copying a weak handle.
+        It's wasn't previously possible to perform this operation using HandleHeap
+        API because the HandleHeap doesn't expose its underlying Node structure.
 
-        Reviewed by David Kilzer.
+        * heap/Local.h:
+        (JSC::::set):
+        * heap/Strong.h:
+        (JSC::Strong::set): Added ASSERTs to verify that dead objects are not
+        resurrected by placement into handles.
 
-        Move CharacterNames.h into WTF directory
-        https://bugs.webkit.org/show_bug.cgi?id=49618
+        (JSC::swap): Added a swap helper, so use of Strong<T> inside a hash table
+        is efficient.
 
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/CMakeLists.txt:
-        * wtf/unicode/CharacterNames.h: Renamed from WebCore/platform/text/CharacterNames.h.
-        * wtf/unicode/UTF8.cpp:
+        * heap/Weak.h:
+        (JSC::Weak::Weak): Fixed a bug where copying a weak pointer would not
+        copy its weak callback and context.
 
-2011-01-28  Simon Fraser  <simon.fraser@apple.com>
+        (JSC::Weak::operator=): Added an assignment operator, since the default
+        C++ assignment operator did the wrong thing.
 
-        Reviewed by Gavin Barraclough.
+        (JSC::Weak::set): Added ASSERTs to verify that dead objects are not
+        resurrected by placement into handles.
 
-        Add various clampToInt() methods to MathExtras.h
-        https://bugs.webkit.org/show_bug.cgi?id=52910
-        
-        Add functions for clamping doubles and floats to valid int
-        ranges, for signed and positive integers.
+        (JSC::swap): Added a swap helper, so use of Strong<T> inside a hash table
+        is efficient, and can be done without copying, which is illegal during
+        the handle finalization phase.
 
-        * wtf/MathExtras.h:
-        (clampToInteger):
-        (clampToPositiveInteger):
+2011-04-13  Oliver Hunt  <oliver@apple.com>
 
-2011-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+        Reviewed by Gavin Barraclough.
 
-        Unreviewed, rolling out r77006 and r77020.
-        http://trac.webkit.org/changeset/77006
-        http://trac.webkit.org/changeset/77020
-        https://bugs.webkit.org/show_bug.cgi?id=53360
+        Make PropertyMapEntry use a WriteBarrier for specificValue
+        https://bugs.webkit.org/show_bug.cgi?id=58407
 
-        "Broke Windows tests" (Requested by rniwa on #webkit).
+        Make PropertyMapEntry use a WriteBarrier for specificValue, and then
+        propagate the required JSGlobalData through all the methods it ends
+        up being needed.
 
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObjectData::setPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
-        (JSC::JSCallbackObject::setPrivateProperty):
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::put):
-        (JSC::::staticFunctionGetter):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/JSContextRef.cpp:
         * API/JSObjectRef.cpp:
-        (JSObjectMakeConstructor):
-        (JSObjectSetPrivateProperty):
-        * API/JSWeakObjectMapRefInternal.h:
+        (JSObjectMake):
+        (JSObjectSetPrototype):
         * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::markAggregate):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::globalObject):
         * bytecompiler/BytecodeGenerator.cpp:
         (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
-        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
-        (JSC::BytecodeGenerator::findScopedProperty):
-        * debugger/Debugger.cpp:
-        (JSC::evaluateInGlobalCallFrame):
-        * debugger/DebuggerActivation.cpp:
-        (JSC::DebuggerActivation::DebuggerActivation):
-        (JSC::DebuggerActivation::markChildren):
-        * debugger/DebuggerActivation.h:
-        * debugger/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate):
-        * interpreter/CallFrame.h:
-        (JSC::ExecState::exception):
         * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::resolve):
-        (JSC::Interpreter::resolveSkip):
-        (JSC::Interpreter::resolveGlobal):
-        (JSC::Interpreter::resolveGlobalDynamic):
-        (JSC::Interpreter::resolveBaseAndProperty):
-        (JSC::Interpreter::unwindCallFrame):
         (JSC::appendSourceToError):
-        (JSC::Interpreter::execute):
         (JSC::Interpreter::tryCacheGetByID):
         (JSC::Interpreter::privateExecute):
         * jit/JITStubs.cpp:
         (JSC::JITThunks::tryCacheGetByID):
         (JSC::DEFINE_STUB_FUNCTION):
-        * jsc.cpp:
-        (GlobalObject::GlobalObject):
-        * runtime/ArgList.cpp:
-        (JSC::MarkedArgumentBuffer::markLists):
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::markChildren):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::getOwnPropertyDescriptor):
-        (JSC::Arguments::put):
-        * runtime/Arguments.h:
-        (JSC::Arguments::setActivation):
-        (JSC::Arguments::Arguments):
-        * runtime/ArrayConstructor.cpp:
-        (JSC::ArrayConstructor::ArrayConstructor):
-        (JSC::constructArrayWithSizeQuirk):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncSplice):
         * runtime/BatchedTransitionOptimizer.h:
         (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
-        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
-        * runtime/BooleanConstructor.cpp:
-        (JSC::BooleanConstructor::BooleanConstructor):
-        (JSC::constructBoolean):
-        (JSC::constructBooleanFromImmediateBoolean):
-        * runtime/BooleanPrototype.cpp:
-        (JSC::BooleanPrototype::BooleanPrototype):
-        * runtime/ConservativeSet.cpp:
-        (JSC::ConservativeSet::grow):
-        * runtime/ConservativeSet.h:
-        (JSC::ConservativeSet::~ConservativeSet):
-        (JSC::ConservativeSet::mark):
-        * runtime/DateConstructor.cpp:
-        (JSC::DateConstructor::DateConstructor):
-        * runtime/DateInstance.cpp:
-        (JSC::DateInstance::DateInstance):
-        * runtime/DatePrototype.cpp:
-        (JSC::dateProtoFuncSetTime):
-        (JSC::setNewValueFromTimeArgs):
-        (JSC::setNewValueFromDateArgs):
-        (JSC::dateProtoFuncSetYear):
-        * runtime/ErrorConstructor.cpp:
-        (JSC::ErrorConstructor::ErrorConstructor):
-        * runtime/ErrorInstance.cpp:
-        (JSC::ErrorInstance::ErrorInstance):
-        * runtime/ErrorPrototype.cpp:
-        (JSC::ErrorPrototype::ErrorPrototype):
-        * runtime/FunctionConstructor.cpp:
-        (JSC::FunctionConstructor::FunctionConstructor):
-        * runtime/FunctionPrototype.cpp:
-        (JSC::FunctionPrototype::FunctionPrototype):
-        * runtime/GetterSetter.cpp:
-        (JSC::GetterSetter::markChildren):
-        * runtime/GetterSetter.h:
-        (JSC::GetterSetter::GetterSetter):
-        (JSC::GetterSetter::getter):
-        (JSC::GetterSetter::setGetter):
-        (JSC::GetterSetter::setter):
-        (JSC::GetterSetter::setSetter):
-        * runtime/GlobalEvalFunction.cpp:
-        (JSC::GlobalEvalFunction::GlobalEvalFunction):
-        (JSC::GlobalEvalFunction::markChildren):
-        * runtime/GlobalEvalFunction.h:
-        (JSC::GlobalEvalFunction::cachedGlobalObject):
-        * runtime/Heap.cpp:
-        (JSC::Heap::markProtectedObjects):
-        (JSC::Heap::markTempSortVectors):
-        (JSC::Heap::markRoots):
         * runtime/InternalFunction.cpp:
-        (JSC::InternalFunction::InternalFunction):
-        * runtime/JSAPIValueWrapper.h:
-        (JSC::JSAPIValueWrapper::value):
-        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
         * runtime/JSActivation.cpp:
-        (JSC::JSActivation::markChildren):
-        (JSC::JSActivation::put):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::JSArray):
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::deleteProperty):
-        (JSC::JSArray::increaseVectorLength):
-        (JSC::JSArray::setLength):
-        (JSC::JSArray::pop):
-        (JSC::JSArray::push):
-        (JSC::JSArray::unshiftCount):
-        (JSC::JSArray::sort):
-        (JSC::JSArray::fillArgList):
-        (JSC::JSArray::copyToRegisters):
-        (JSC::JSArray::compactForSorting):
-        * runtime/JSArray.h:
-        (JSC::JSArray::getIndex):
-        (JSC::JSArray::setIndex):
-        (JSC::JSArray::uncheckedSetIndex):
-        (JSC::JSArray::markChildrenDirect):
-        * runtime/JSByteArray.cpp:
-        (JSC::JSByteArray::JSByteArray):
-        * runtime/JSCell.h:
-        (JSC::JSCell::JSValue::toThisObject):
-        (JSC::JSCell::MarkStack::append):
+        (JSC::JSActivation::getOwnPropertySlot):
         * runtime/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::name):
+        (JSC::JSFunction::displayName):
         (JSC::JSFunction::getOwnPropertySlot):
-        * runtime/JSGlobalData.h:
         * runtime/JSGlobalObject.cpp:
-        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::putWithAttributes):
         (JSC::JSGlobalObject::reset):
         (JSC::JSGlobalObject::resetPrototype):
-        (JSC::JSGlobalObject::markChildren):
         * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
-        (JSC::JSGlobalObject::regExpConstructor):
-        (JSC::JSGlobalObject::errorConstructor):
-        (JSC::JSGlobalObject::evalErrorConstructor):
-        (JSC::JSGlobalObject::rangeErrorConstructor):
-        (JSC::JSGlobalObject::referenceErrorConstructor):
-        (JSC::JSGlobalObject::syntaxErrorConstructor):
-        (JSC::JSGlobalObject::typeErrorConstructor):
-        (JSC::JSGlobalObject::URIErrorConstructor):
-        (JSC::JSGlobalObject::evalFunction):
-        (JSC::JSGlobalObject::objectPrototype):
-        (JSC::JSGlobalObject::functionPrototype):
-        (JSC::JSGlobalObject::arrayPrototype):
-        (JSC::JSGlobalObject::booleanPrototype):
-        (JSC::JSGlobalObject::stringPrototype):
-        (JSC::JSGlobalObject::numberPrototype):
-        (JSC::JSGlobalObject::datePrototype):
-        (JSC::JSGlobalObject::regExpPrototype):
-        (JSC::JSGlobalObject::methodCallDummy):
-        (JSC::Structure::prototypeForLookup):
-        (JSC::constructArray):
-        * runtime/JSONObject.cpp:
-        (JSC::Stringifier::Holder::object):
-        (JSC::Stringifier::markAggregate):
-        (JSC::Stringifier::stringify):
-        (JSC::Stringifier::Holder::appendNextProperty):
-        (JSC::Walker::callReviver):
-        (JSC::Walker::walk):
         * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
         (JSC::JSObject::defineGetter):
         (JSC::JSObject::defineSetter):
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        (JSC::JSObject::getPropertySpecificValue):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
         (JSC::JSObject::removeDirect):
-        (JSC::JSObject::putDirectFunction):
-        (JSC::JSObject::putDirectFunctionWithoutTransition):
-        (JSC::putDescriptor):
+        (JSC::JSObject::getOwnPropertyDescriptor):
         (JSC::JSObject::defineOwnProperty):
         * runtime/JSObject.h:
-        (JSC::JSObject::getDirectOffset):
-        (JSC::JSObject::putDirectOffset):
-        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::isSealed):
+        (JSC::JSObject::isFrozen):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
         (JSC::JSObject::putDirectInternal):
-        (JSC::JSObject::putDirect):
-        (JSC::JSObject::putDirectFunction):
         (JSC::JSObject::putDirectWithoutTransition):
         (JSC::JSObject::putDirectFunctionWithoutTransition):
-        (JSC::JSValue::putDirect):
-        (JSC::JSObject::allocatePropertyStorageInline):
-        (JSC::JSObject::markChildrenDirect):
-        * runtime/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::get):
-        * runtime/JSPropertyNameIterator.h:
-        * runtime/JSStaticScopeObject.cpp:
-        (JSC::JSStaticScopeObject::markChildren):
-        * runtime/JSString.cpp:
-        (JSC::StringObject::create):
-        * runtime/JSValue.h:
-        * runtime/JSWrapperObject.cpp:
-        (JSC::JSWrapperObject::markChildren):
-        * runtime/JSWrapperObject.h:
-        (JSC::JSWrapperObject::internalValue):
-        (JSC::JSWrapperObject::setInternalValue):
-        * runtime/LiteralParser.cpp:
-        (JSC::LiteralParser::parse):
         * runtime/Lookup.cpp:
         (JSC::setUpStaticFunctionSlot):
-        * runtime/Lookup.h:
-        (JSC::lookupPut):
-        * runtime/MarkStack.h:
-        (JSC::MarkStack::appendValues):
-        * runtime/MathObject.cpp:
-        (JSC::MathObject::MathObject):
-        * runtime/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::NativeErrorConstructor):
-        * runtime/NativeErrorPrototype.cpp:
-        (JSC::NativeErrorPrototype::NativeErrorPrototype):
-        * runtime/NumberConstructor.cpp:
-        (JSC::NumberConstructor::NumberConstructor):
-        (JSC::constructWithNumberConstructor):
-        * runtime/NumberObject.cpp:
-        (JSC::constructNumber):
-        * runtime/NumberPrototype.cpp:
-        (JSC::NumberPrototype::NumberPrototype):
         * runtime/ObjectConstructor.cpp:
-        (JSC::ObjectConstructor::ObjectConstructor):
-        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorCreate):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorPreventExtensions):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
         * runtime/Operations.h:
         (JSC::normalizePrototypeChain):
-        (JSC::resolveBase):
-        * runtime/PrototypeFunction.cpp:
-        (JSC::PrototypeFunction::PrototypeFunction):
-        * runtime/PutPropertySlot.h:
-        (JSC::PutPropertySlot::setExistingProperty):
-        (JSC::PutPropertySlot::setNewProperty):
-        (JSC::PutPropertySlot::base):
-        * runtime/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor):
-        * runtime/ScopeChain.cpp:
-        (JSC::ScopeChainNode::print):
-        * runtime/ScopeChain.h:
-        (JSC::ScopeChainNode::~ScopeChainNode):
-        (JSC::ScopeChainIterator::operator*):
-        (JSC::ScopeChainIterator::operator->):
-        (JSC::ScopeChain::top):
-        * runtime/ScopeChainMark.h:
-        (JSC::ScopeChain::markAggregate):
-        * runtime/SmallStrings.cpp:
-        (JSC::isMarked):
-        (JSC::SmallStrings::markChildren):
-        * runtime/SmallStrings.h:
-        (JSC::SmallStrings::emptyString):
-        (JSC::SmallStrings::singleCharacterString):
-        (JSC::SmallStrings::singleCharacterStrings):
-        * runtime/StringConstructor.cpp:
-        (JSC::StringConstructor::StringConstructor):
-        * runtime/StringObject.cpp:
-        (JSC::StringObject::StringObject):
-        * runtime/StringObject.h:
-        * runtime/StringPrototype.cpp:
-        (JSC::StringPrototype::StringPrototype):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        (JSC::PropertyTable::PropertyTable):
+        (JSC::PropertyTable::copy):
         * runtime/Structure.cpp:
-        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::despecifyDictionaryFunction):
         (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
         (JSC::Structure::toDictionaryTransition):
-        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::despecifyAllFunctions):
+        (JSC::Structure::put):
+        (JSC::Structure::getPropertyNames):
         * runtime/Structure.h:
-        (JSC::Structure::storedPrototype):
-        * runtime/WeakGCMap.h:
-        (JSC::WeakGCMap::uncheckedGet):
-        (JSC::WeakGCMap::isValid):
-        (JSC::::get):
-        (JSC::::take):
-        (JSC::::set):
-        (JSC::::uncheckedRemove):
-        * runtime/WriteBarrier.h: Removed.
-
-2011-01-28  Gavin Barraclough  <barraclough@apple.com>
+        (JSC::Structure::get):
+        (JSC::Structure::materializePropertyMapIfNecessary):
 
-        Reviewed by Geoff Garen.
+2011-04-13  Paul Knight  <pknight@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=53352
-        Heavy external fragmentation in FixedVMPoolAllocator can lead to a CRASH().
-
-        The FixedVMPoolAllocator currently uses a best fix policy -
-        switch to first fit, this is less prone to external fragmentation.
-
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::AllocationTableSizeClass::AllocationTableSizeClass):
-        (JSC::AllocationTableSizeClass::blockSize):
-        (JSC::AllocationTableSizeClass::blockCount):
-        (JSC::AllocationTableSizeClass::blockAlignment):
-        (JSC::AllocationTableSizeClass::size):
-        (JSC::AllocationTableLeaf::AllocationTableLeaf):
-        (JSC::AllocationTableLeaf::~AllocationTableLeaf):
-        (JSC::AllocationTableLeaf::allocate):
-        (JSC::AllocationTableLeaf::free):
-        (JSC::AllocationTableLeaf::isEmpty):
-        (JSC::AllocationTableLeaf::isFull):
-        (JSC::AllocationTableLeaf::size):
-        (JSC::AllocationTableLeaf::classForSize):
-        (JSC::AllocationTableLeaf::dump):
-        (JSC::LazyAllocationTable::LazyAllocationTable):
-        (JSC::LazyAllocationTable::~LazyAllocationTable):
-        (JSC::LazyAllocationTable::allocate):
-        (JSC::LazyAllocationTable::free):
-        (JSC::LazyAllocationTable::isEmpty):
-        (JSC::LazyAllocationTable::isFull):
-        (JSC::LazyAllocationTable::size):
-        (JSC::LazyAllocationTable::dump):
-        (JSC::LazyAllocationTable::classForSize):
-        (JSC::AllocationTableDirectory::AllocationTableDirectory):
-        (JSC::AllocationTableDirectory::~AllocationTableDirectory):
-        (JSC::AllocationTableDirectory::allocate):
-        (JSC::AllocationTableDirectory::free):
-        (JSC::AllocationTableDirectory::isEmpty):
-        (JSC::AllocationTableDirectory::isFull):
-        (JSC::AllocationTableDirectory::size):
-        (JSC::AllocationTableDirectory::classForSize):
-        (JSC::AllocationTableDirectory::dump):
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
-        (JSC::FixedVMPoolAllocator::alloc):
-        (JSC::FixedVMPoolAllocator::free):
-        (JSC::FixedVMPoolAllocator::allocated):
-        (JSC::FixedVMPoolAllocator::isValid):
-        (JSC::FixedVMPoolAllocator::classForSize):
-        (JSC::FixedVMPoolAllocator::offsetToPointer):
-        (JSC::FixedVMPoolAllocator::pointerToOffset):
-        (JSC::ExecutableAllocator::committedByteCount):
-        (JSC::ExecutableAllocator::isValid):
-        (JSC::ExecutableAllocator::underMemoryPressure):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::PageReservation):
-        (WTF::PageReservation::commit):
-        (WTF::PageReservation::decommit):
-        (WTF::PageReservation::committed):
-
-2011-01-27  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Gavin Barraclough.
 
-        Reviewed by Geoffrey Garen.
+        BACKTRACE() macro should check for Debug configuration in macro, not WTFReportBacktrace definition
+        https://bugs.webkit.org/show_bug.cgi?id=58405
 
-        Convert markstack to a slot visitor API
-        https://bugs.webkit.org/show_bug.cgi?id=53219
+        The BACKTRACE() macro requires JavaScriptCore be built with a Debug
+        configuration in order for it to be enabled. Move the NDEBUG check to
+        the header so it will be enabled when the calling framework or
+        application is built with a Debug configuration, similar to how
+        ASSERT() and friends work.
 
-        Move the MarkStack over to a slot based marking API.
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
 
-        In order to avoiding aliasing concerns there are two new types
-        that need to be used when holding on to JSValues and JSCell that
-        need to be marked: WriteBarrier and DeprecatedPtr.  WriteBarrier
-        is expected to be used for any JSValue or Cell that's lifetime and
-        marking is controlled by another GC object.  DeprecatedPtr is used
-        for any value that we need to rework ownership for.
+2011-04-12  Ben Taylor  <bentaylor.solx86@gmail.com>
 
-        The change over to this model has produced a large amount of
-        code changes, but they are mostly mechanical (forwarding JSGlobalData,
-        etc).
+        Reviewed by Alexey Proskuryakov.
 
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObjectData::setPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
-        (JSC::JSCallbackObject::setPrivateProperty):
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::put):
-        (JSC::::staticFunctionGetter):
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeConstructor):
-        (JSObjectSetPrivateProperty):
-        * API/JSWeakObjectMapRefInternal.h:
-        * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::markAggregate):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::globalObject):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
-        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
-        (JSC::BytecodeGenerator::findScopedProperty):
-        * debugger/DebuggerActivation.cpp:
-        (JSC::DebuggerActivation::DebuggerActivation):
-        (JSC::DebuggerActivation::markChildren):
-        * debugger/DebuggerActivation.h:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::resolve):
-        (JSC::Interpreter::resolveSkip):
-        (JSC::Interpreter::resolveGlobalDynamic):
-        (JSC::Interpreter::resolveBaseAndProperty):
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::appendSourceToError):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::privateExecute):
-        * interpreter/Register.h:
-        (JSC::Register::jsValueSlot):
-        * jit/JITStubs.cpp:
-        (JSC::JITThunks::tryCacheGetByID):
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jsc.cpp:
-        (GlobalObject::GlobalObject):
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::markChildren):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::getOwnPropertyDescriptor):
-        (JSC::Arguments::put):
-        * runtime/Arguments.h:
-        (JSC::Arguments::setActivation):
-        (JSC::Arguments::Arguments):
-        * runtime/ArrayConstructor.cpp:
-        (JSC::ArrayConstructor::ArrayConstructor):
-        (JSC::constructArrayWithSizeQuirk):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncSplice):
-        * runtime/BatchedTransitionOptimizer.h:
-        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
-        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
-        * runtime/BooleanConstructor.cpp:
-        (JSC::BooleanConstructor::BooleanConstructor):
-        (JSC::constructBoolean):
-        (JSC::constructBooleanFromImmediateBoolean):
-        * runtime/BooleanPrototype.cpp:
-        (JSC::BooleanPrototype::BooleanPrototype):
-        * runtime/ConservativeSet.h:
-        (JSC::ConservativeSet::mark):
-        * runtime/DateConstructor.cpp:
-        (JSC::DateConstructor::DateConstructor):
-        * runtime/DateInstance.cpp:
-        (JSC::DateInstance::DateInstance):
-        * runtime/DatePrototype.cpp:
-        (JSC::dateProtoFuncSetTime):
-        (JSC::setNewValueFromTimeArgs):
-        (JSC::setNewValueFromDateArgs):
-        (JSC::dateProtoFuncSetYear):
-        * runtime/ErrorConstructor.cpp:
-        (JSC::ErrorConstructor::ErrorConstructor):
-        * runtime/ErrorInstance.cpp:
-        (JSC::ErrorInstance::ErrorInstance):
-        * runtime/ErrorPrototype.cpp:
-        (JSC::ErrorPrototype::ErrorPrototype):
-        * runtime/FunctionConstructor.cpp:
-        (JSC::FunctionConstructor::FunctionConstructor):
-        * runtime/FunctionPrototype.cpp:
-        (JSC::FunctionPrototype::FunctionPrototype):
-        * runtime/GetterSetter.cpp:
-        (JSC::GetterSetter::markChildren):
-        * runtime/GetterSetter.h:
-        (JSC::GetterSetter::GetterSetter):
-        (JSC::GetterSetter::getter):
-        (JSC::GetterSetter::setGetter):
-        (JSC::GetterSetter::setter):
-        (JSC::GetterSetter::setSetter):
-        * runtime/GlobalEvalFunction.cpp:
-        (JSC::GlobalEvalFunction::GlobalEvalFunction):
-        (JSC::GlobalEvalFunction::markChildren):
-        * runtime/GlobalEvalFunction.h:
-        (JSC::GlobalEvalFunction::cachedGlobalObject):
-        * runtime/Heap.cpp:
-        (JSC::Heap::markProtectedObjects):
-        (JSC::Heap::markTempSortVectors):
-        (JSC::Heap::markRoots):
-        * runtime/InternalFunction.cpp:
-        (JSC::InternalFunction::InternalFunction):
-        * runtime/JSAPIValueWrapper.h:
-        (JSC::JSAPIValueWrapper::value):
-        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
-        * runtime/JSActivation.cpp:
-        (JSC::JSActivation::put):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::JSArray):
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::deleteProperty):
-        (JSC::JSArray::increaseVectorLength):
-        (JSC::JSArray::setLength):
-        (JSC::JSArray::pop):
-        (JSC::JSArray::push):
-        (JSC::JSArray::unshiftCount):
-        (JSC::JSArray::sort):
-        (JSC::JSArray::fillArgList):
-        (JSC::JSArray::copyToRegisters):
-        (JSC::JSArray::compactForSorting):
-        * runtime/JSArray.h:
-        (JSC::JSArray::getIndex):
-        (JSC::JSArray::setIndex):
-        (JSC::JSArray::uncheckedSetIndex):
-        (JSC::JSArray::markChildrenDirect):
-        * runtime/JSByteArray.cpp:
-        (JSC::JSByteArray::JSByteArray):
-        * runtime/JSCell.h:
-        (JSC::JSCell::MarkStack::append):
-        (JSC::JSCell::MarkStack::appendCell):
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
-        (JSC::JSFunction::getOwnPropertySlot):
-        * runtime/JSGlobalObject.cpp:
-        (JSC::markIfNeeded):
-        (JSC::JSGlobalObject::reset):
-        (JSC::JSGlobalObject::resetPrototype):
-        (JSC::JSGlobalObject::markChildren):
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
-        (JSC::JSGlobalObject::regExpConstructor):
-        (JSC::JSGlobalObject::errorConstructor):
-        (JSC::JSGlobalObject::evalErrorConstructor):
-        (JSC::JSGlobalObject::rangeErrorConstructor):
-        (JSC::JSGlobalObject::referenceErrorConstructor):
-        (JSC::JSGlobalObject::syntaxErrorConstructor):
-        (JSC::JSGlobalObject::typeErrorConstructor):
-        (JSC::JSGlobalObject::URIErrorConstructor):
-        (JSC::JSGlobalObject::evalFunction):
-        (JSC::JSGlobalObject::objectPrototype):
-        (JSC::JSGlobalObject::functionPrototype):
-        (JSC::JSGlobalObject::arrayPrototype):
-        (JSC::JSGlobalObject::booleanPrototype):
-        (JSC::JSGlobalObject::stringPrototype):
-        (JSC::JSGlobalObject::numberPrototype):
-        (JSC::JSGlobalObject::datePrototype):
-        (JSC::JSGlobalObject::regExpPrototype):
-        (JSC::JSGlobalObject::methodCallDummy):
-        (JSC::constructArray):
-        * runtime/JSONObject.cpp:
-        (JSC::Stringifier::Holder::object):
-        (JSC::Stringifier::Holder::objectSlot):
-        (JSC::Stringifier::markAggregate):
-        (JSC::Stringifier::stringify):
-        (JSC::Stringifier::Holder::appendNextProperty):
-        (JSC::Walker::callReviver):
-        (JSC::Walker::walk):
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::defineGetter):
-        (JSC::JSObject::defineSetter):
-        (JSC::JSObject::removeDirect):
-        (JSC::JSObject::putDirectFunction):
-        (JSC::JSObject::putDirectFunctionWithoutTransition):
-        (JSC::putDescriptor):
-        (JSC::JSObject::defineOwnProperty):
-        * runtime/JSObject.h:
-        (JSC::JSObject::putDirectOffset):
-        (JSC::JSObject::putUndefinedAtDirectOffset):
-        (JSC::JSObject::flattenDictionaryObject):
-        (JSC::JSObject::putDirectInternal):
-        (JSC::JSObject::putDirect):
-        (JSC::JSObject::putDirectFunction):
-        (JSC::JSObject::putDirectWithoutTransition):
-        (JSC::JSObject::putDirectFunctionWithoutTransition):
-        (JSC::JSValue::putDirect):
-        (JSC::JSObject::allocatePropertyStorageInline):
-        (JSC::JSObject::markChildrenDirect):
-        * runtime/JSStaticScopeObject.cpp:
-        (JSC::JSStaticScopeObject::markChildren):
-        * runtime/JSString.cpp:
-        (JSC::StringObject::create):
-        * runtime/JSValue.h:
-        * runtime/JSWrapperObject.cpp:
-        (JSC::JSWrapperObject::markChildren):
-        * runtime/JSWrapperObject.h:
-        (JSC::JSWrapperObject::internalValue):
-        (JSC::JSWrapperObject::setInternalValue):
-        * runtime/LiteralParser.cpp:
-        (JSC::LiteralParser::parse):
-        * runtime/Lookup.cpp:
-        (JSC::setUpStaticFunctionSlot):
-        * runtime/Lookup.h:
-        (JSC::lookupPut):
-        * runtime/MarkStack.h:
-        * runtime/MathObject.cpp:
-        (JSC::MathObject::MathObject):
-        * runtime/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::NativeErrorConstructor):
-        * runtime/NativeErrorPrototype.cpp:
-        (JSC::NativeErrorPrototype::NativeErrorPrototype):
-        * runtime/NumberConstructor.cpp:
-        (JSC::NumberConstructor::NumberConstructor):
-        (JSC::constructWithNumberConstructor):
-        * runtime/NumberObject.cpp:
-        (JSC::constructNumber):
-        * runtime/NumberPrototype.cpp:
-        (JSC::NumberPrototype::NumberPrototype):
-        * runtime/ObjectConstructor.cpp:
-        (JSC::ObjectConstructor::ObjectConstructor):
-        (JSC::objectConstructorGetOwnPropertyDescriptor):
-        * runtime/Operations.h:
-        (JSC::normalizePrototypeChain):
-        (JSC::resolveBase):
-        * runtime/PrototypeFunction.cpp:
-        (JSC::PrototypeFunction::PrototypeFunction):
-        * runtime/PutPropertySlot.h:
-        (JSC::PutPropertySlot::setExistingProperty):
-        (JSC::PutPropertySlot::setNewProperty):
-        (JSC::PutPropertySlot::base):
-        * runtime/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor):
-        * runtime/ScopeChain.cpp:
-        (JSC::ScopeChainNode::print):
-        * runtime/ScopeChain.h:
-        (JSC::ScopeChainNode::~ScopeChainNode):
-        (JSC::ScopeChainIterator::operator*):
-        (JSC::ScopeChainIterator::operator->):
-        (JSC::ScopeChain::top):
-        * runtime/ScopeChainMark.h:
-        (JSC::ScopeChain::markAggregate):
-        * runtime/SmallStrings.cpp:
-        (JSC::isMarked):
-        (JSC::SmallStrings::markChildren):
-        * runtime/SmallStrings.h:
-        (JSC::SmallStrings::emptyString):
-        (JSC::SmallStrings::singleCharacterString):
-        (JSC::SmallStrings::singleCharacterStrings):
-        * runtime/StringConstructor.cpp:
-        (JSC::StringConstructor::StringConstructor):
-        * runtime/StringObject.cpp:
-        (JSC::StringObject::StringObject):
-        * runtime/StringObject.h:
-        * runtime/StringPrototype.cpp:
-        (JSC::StringPrototype::StringPrototype):
-        * runtime/Structure.cpp:
-        (JSC::Structure::flattenDictionaryStructure):
-        * runtime/Structure.h:
-        (JSC::Structure::storedPrototypeSlot):
-        * runtime/WeakGCMap.h:
-        (JSC::WeakGCMap::uncheckedGet):
-        (JSC::WeakGCMap::uncheckedGetSlot):
-        (JSC::::get):
-        (JSC::::take):
-        (JSC::::set):
-        (JSC::::uncheckedRemove):
-        * runtime/WriteBarrier.h: Added.
-        (JSC::DeprecatedPtr::DeprecatedPtr):
-        (JSC::DeprecatedPtr::get):
-        (JSC::DeprecatedPtr::operator*):
-        (JSC::DeprecatedPtr::operator->):
-        (JSC::DeprecatedPtr::slot):
-        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
-        (JSC::DeprecatedPtr::operator!):
-        (JSC::WriteBarrierBase::set):
-        (JSC::WriteBarrierBase::get):
-        (JSC::WriteBarrierBase::operator*):
-        (JSC::WriteBarrierBase::operator->):
-        (JSC::WriteBarrierBase::slot):
-        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
-        (JSC::WriteBarrierBase::operator!):
-        (JSC::WriteBarrier::WriteBarrier):
-        (JSC::operator==):
+        https://bugs.webkit.org/show_bug.cgi?id=58131
 
-2011-01-28  Adam Roben  <aroben@apple.com>
+        Provide a workaround for an obscure Studio 12 compiler bug, which
+        couldn't call src->~T() on a const T *src.
 
-        Chromium build fix after r76967
+        * wtf/Vector.h:
 
-        * wtf/ThreadingPrimitives.h: Use OS(WINDOWS) instead of PLATFORM(WIN), to match other
-        similar macros in this file.
+2011-04-12  Gavin Barraclough  <barraclough@apple.com>
 
-2011-01-28  Michael Saboff  <msaboff@apple.com>
+        Reviewed by Oliver Hunt.
 
-        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
-        https://bugs.webkit.org/show_bug.cgi?id=53271
+        https://bugs.webkit.org/show_bug.cgi?id=58395
+        Exceptions thrown from property getters called from Array prototype functions can be missed
 
-        Reapplying this this change.  No change from prior patch in
-        JavaScriptCore.
+        This is caught by an ASSERT in the top of Interpreter::executeCall.
+        Check for exceptions after accessing properties that could be getters.
 
-        Added new isValid() methods to check if a contained object in
-        a WeakGCMap is valid when using an unchecked iterator.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+            - Add exception checks.
 
-        * runtime/WeakGCMap.h:
-        (JSC::WeakGCMap::isValid):
+2011-04-12  Oliver Hunt  <oliver@apple.com>
 
-2011-01-27  Adam Roben  <aroben@apple.com>
+        Reviewed by Geoffrey Garen.
 
-        Extract code to convert a WTF absolute time to a Win32 wait interval into a separate
-        function
+        Make API callback objects use weak handles to run their finalizers
+        https://bugs.webkit.org/show_bug.cgi?id=58389
 
-        Fixes <http://webkit.org/b/53208> <rdar://problem/8922490> BinarySemaphore should wrap a
-        Win32 event
+        Make the API object's private data struct act as a finalizer for
+        an api object if the callback object has a API defined finalizer.
 
-        Reviewed by Dave Hyatt.
+        * API/JSCallbackObject.cpp:
+        (JSC::JSCallbackObjectData::finalize):
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::init):
+        * heap/Handle.h:
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export the new function.
+2011-04-12  Geoffrey Garen  <ggaren@apple.com>
 
-        * wtf/ThreadingPrimitives.h: Declare the new function.
+        Reviewed by Geoffrey Garen.
 
-        * wtf/ThreadingWin.cpp:
-        (WTF::ThreadCondition::timedWait): Moved code to convert the absolute time to a wait
-        interval from here...
-        (WTF::absoluteTimeToWaitTimeoutInterval): ...to here.
+        Cleaned up hash traits, and added hash traits for handles
+        https://bugs.webkit.org/show_bug.cgi?id=58381
 
-2011-01-28  Sam Weinig  <sam@webkit.org>
+        * heap/Handle.h:
+        (JSC::HandleBase::swap):
+        (JSC::Handle::Handle):
+        (JSC::Handle::swap): Implemented swap, so we can rehash efficiently, and
+        without creating new handles (which is not allowed during handle finalization).
 
-        Reviewed by Maciej Stachowiak.
+        * heap/Strong.h:
+        (JSC::Strong::swap): Use new SimpleClassHashTraits to avoid duplication.
 
-        Add basic rubber banding support
-        <rdar://problem/8219429>
-        https://bugs.webkit.org/show_bug.cgi?id=53277
+        * heap/Weak.h:
+        (JSC::Weak::isHashTableDeletedValue):
+        (JSC::Weak::Weak):
+        (JSC::Weak::swap):
+        (JSC::Weak::hashTableDeletedValue): Ditto.
 
-        * wtf/Platform.h: Add ENABLE for rubber banding.
+        * wtf/HashTraits.h:
+        (WTF::SimpleClassHashTraits::constructDeletedValue):
+        (WTF::SimpleClassHashTraits::isDeletedValue): Added SimpleClassHashTraits,
+        which are analogous to SimpleClassVectorTraits, since they are used in a
+        bunch of places.
 
-2011-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+        * wtf/RetainPtr.h: Use new SimpleClassHashTraits to avoid duplication.
 
-        Unreviewed, rolling out r76893.
-        http://trac.webkit.org/changeset/76893
-        https://bugs.webkit.org/show_bug.cgi?id=53287
+        * wtf/text/StringHash.h: Use new SimpleClassHashTraits to avoid duplication.
 
-        It made some tests crash on GTK and Qt debug bots (Requested
-        by Ossy on #webkit).
+2011-04-12  Geoffrey Garen  <ggaren@apple.com>
 
-        * runtime/WeakGCMap.h:
+        Reviewed by Sam Weinig.
 
-2011-01-27  Adam Barth  <abarth@webkit.org>
+        Cleaned up some Vector traits, and added missing Vector traits for handles
+        https://bugs.webkit.org/show_bug.cgi?id=58372
 
-        Reviewed by Eric Seidel.
+        * heap/Local.h: Inherit from SimpleClassVectorTraits to avoid duplication.
 
-        Add WTFString method to compare equality with Vector<UChar>
-        https://bugs.webkit.org/show_bug.cgi?id=53266
+        * heap/Strong.h: Ditto.
 
-        I'm planning to use this method in the new XSS filter implementation,
-        but it seems generally useful.
+        * heap/Weak.h: Ditto.
 
-        * wtf/text/StringImpl.h:
-        (WTF::equalIgnoringNullity):
-        * wtf/text/WTFString.h:
-        (WTF::equalIgnoringNullity):
+        * parser/JSParser.cpp: Fixed a traits error. No test case because this
+        particular trait is not currently exercised by the parser.
 
-2011-01-27  Michael Saboff  <msaboff@apple.com>
+        * runtime/UString.h: No need to override canInitializeWithMemset, since
+        our base class sets it to true.
 
-        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
-        https://bugs.webkit.org/show_bug.cgi?id=53271
+        * wtf/VectorTraits.h: Inherit from VectorTraitsBase to avoid duplication.
 
-        Added new isValid() methods to check if a contained object in
-        a WeakGCMap is valid when using an unchecked iterator.
+        * wtf/text/WTFString.h: No need to override canInitializeWithMemset, since
+        our base class sets it to true.
 
-        * runtime/WeakGCMap.h:
-        (JSC::WeakGCMap::isValid):
+2011-04-12  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
 
-2011-01-26  Sam Weinig  <sam@webkit.org>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Maciej Stachowiak.
+        [Qt] Enable JIT build for SH4 platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=58317
+        enable JIT build for QT backend  for SH4 platforms.
 
-        Add events to represent the start/end of a gesture scroll
-        https://bugs.webkit.org/show_bug.cgi?id=53215
+        * JavaScriptCore.pro:
+        * wtf/Platform.h:
 
-        * wtf/Platform.h: Add ENABLE for gesture events. 
+2011-04-11  Ben Taylor  <bentaylor.solx86@gmail.com>
 
-2011-01-26  Yael Aharon  <yael.aharon@nokia.com>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Laszlo Gombos.
+        https://bugs.webkit.org/show_bug.cgi?id=58289
 
-        [Qt][Symbian] Fix --minimal build
-        https://bugs.webkit.org/show_bug.cgi?id=52839
+        Fix compilation on Solaris/Studio 12 C++ in wtf/FastMalloc.cpp,
+        WTF::TCMalloc_PageHeap::runScavengerThread(void*) expected to return a value.
 
-        Move definition of USE_SYSTEM_MALLOC out of pri file.
-        Put it in platform.h instead.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::runScavengerThread):
 
-        * wtf/Platform.h:
-        * wtf/TCSystemAlloc.cpp:
-        * wtf/wtf.pri:
+2011-04-11  Mark Rowe  <mrowe@apple.com>
 
-2011-01-26  Patrick Gansterer  <paroga@webkit.org>
+        Fix the build.
 
-        Reviewed by Andreas Kling.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Headers used outside of JavaScriptCore need to be marked as private.
 
-        [WINCE] Add JIT support to build system
-        https://bugs.webkit.org/show_bug.cgi?id=53079
+2011-04-11  Anna Cavender  <annacc@chromium.org>
 
-        * CMakeListsWinCE.txt:
+        Reviewed by Eric Carlson.
 
-2011-01-25  Adam Roben  <aroben@apple.com>
+        Setup ENABLE(TRACK) feature define
+        https://bugs.webkit.org/show_bug.cgi?id=53556
 
-        Windows Production build fix
 
-        Reviewed by Steve Falkenburg.
+        * Configurations/FeatureDefines.xcconfig:
 
-        * JavaScriptCore.vcproj/JavaScriptCore.make: Set BUILDSTYLE to Release_PGO at the very start
-        of the file so that ConfigurationBuildDir takes that into account. Also set it the right way
-        (by redefining the macro) rather than the wrong way (by modifying the environment variable).
+2011-04-11  Geoffrey Garen  <ggaren@apple.com>
 
-2011-01-25  Steve Falkenburg  <sfalken@apple.com>
+        Try to fix a few builds.
+        
+        Updated a few more build configurations for file moves.
 
-        Rubber-stamped by Adam Roben.
+        * CMakeListsWinCE.txt:
 
-        Windows production build fix.
-        Use correct environment variable escaping
+2011-04-11  Gavin Barraclough  <barraclough@apple.com>
 
-        * JavaScriptCore.vcproj/JavaScriptCore.make:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        Reviewed by Sam Weinig.
 
-2011-01-25  Oliver Hunt  <oliver@apple.com>
+        Bug 58263 - Use EncodedValueDescriptor on both JSVALUE32_64, JSVALUE64
 
-        Reviewed by Gavin Barraclough.
+        The JSJITInterface already uses EncodedValueDescriptor to access the tag/payload
+        separately on JSVALUE64, even though EncodedValueDescriptor is not used in
+        JSVALUE64's implementation of JSValue. Remove the separate definition for m_ptr
+        on X86_64. Using the union allows us to remove a layer of makeImmediate()/
+        immedaiteValue() methods.
 
-        JSON.stringify processing time exponentially grows with size of object
-        https://bugs.webkit.org/show_bug.cgi?id=51922
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emitSlow_op_not):
+        * runtime/JSCell.h:
+        * runtime/JSValue.h:
+        * runtime/JSValueInlineMethods.h:
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32):
+        (JSC::JSValue::asDouble):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::asCell):
 
-        Remove last use of reserveCapacity from JSON stringification, as it results
-        in appalling append behaviour when there are a large number of property names
-        and nothing else.
+2011-04-11  Geoffrey Garen  <ggaren@apple.com>
 
-        * runtime/JSONObject.cpp:
-        (JSC::Stringifier::appendQuotedString):
+        Try to fix a few builds.
+        
+        Updated a few more build configurations for file moves.
 
-2011-01-25  Antti Koivisto  <antti@apple.com>
+        * CMakeListsEfl.txt:
+        * wscript:
 
-        Not reviewed.
-        
-        Try to fix windows build.
+2011-04-11  Geoffrey Garen  <ggaren@apple.com>
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Build fix: Updated a file name.
 
-2011-01-25  Antti Koivisto  <antti@apple.com>
+        * CMakeLists.txt:
 
-        Reviewed by Oliver Hunt.
+2011-04-11  Geoffrey Garen  <ggaren@apple.com>
 
-        REGRESSION: Leak in JSParser::Scope::copyCapturedVariablesToVector()
-        https://bugs.webkit.org/show_bug.cgi?id=53061
-         
-        Cache did not know about the subclass so failed to fully delete the items. 
-        Got rid of the subclass and moved the classes to separate files.
+        Rubber-stamped by Sam Weinig.
+        
+        Moved remaining heap implementation files to the heap folder.
 
+        * Android.mk:
         * CMakeLists.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.exp:
+        * GNUmakefile.list.am:
         * JavaScriptCore.gypi:
         * JavaScriptCore.pro:
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
         * JavaScriptCore.xcodeproj/project.pbxproj:
-        * parser/JSParser.cpp:
-        (JSC::JSParser::Scope::saveFunctionInfo):
-        (JSC::JSParser::Scope::restoreFunctionInfo):
-        (JSC::JSParser::findCachedFunctionInfo):
-        (JSC::JSParser::parseFunctionInfo):
-        * parser/SourceProvider.h:
-        * parser/SourceProviderCache.cpp: Added.
-        (JSC::SourceProviderCache::~SourceProviderCache):
-        (JSC::SourceProviderCache::byteSize):
-        * parser/SourceProviderCache.h: Added.
-        (JSC::SourceProviderCache::SourceProviderCache):
-        (JSC::SourceProviderCache::add):
-        (JSC::SourceProviderCache::get):
-        * parser/SourceProviderCacheItem.h: Added.
-        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
-        (JSC::SourceProviderCacheItem::approximateByteSize):
-        (JSC::SourceProviderCacheItem::closeBraceToken):
-
-2011-01-25  Marcilio Mendonca  <mamendonca@rim.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 53087: Refactoring: replaced a hanging "else" with a "return"
-        statement
-        https://bugs.webkit.org/show_bug.cgi?id=53087.
-
-        Refactoring work: Replaced a hanging "else" within an #if PLATFORM(M
-        with a "return" so that the code is more readable and less error pro
-        (e.g., "else" doesn't use braces so adding extra lines to the else
-        block won't have any effect; even worse, code still compiles
-        successfully.
-
-        * wtf/Assertions.cpp:
-
-2011-01-24  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Change ENABLE_3D_CANVAS to ENABLE_WEBGL
-        https://bugs.webkit.org/show_bug.cgi?id=53041
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2011-01-25  Adam Roben  <aroben@apple.com>
-
-        Windows Production build fix
-
-        * JavaScriptCore.vcproj/JavaScriptCore.make: Added a missing "set".
-
-2011-01-25  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Add missing defines for COMPILER(RVCT) && CPU(ARM_THUMB2)
-        https://bugs.webkit.org/show_bug.cgi?id=52949
-
-        * jit/JITStubs.cpp:
-
-2011-01-24  Adam Roben  <aroben@apple.com>
-
-        Windows Production build fix
+        * heap/ConservativeRoots.cpp: Copied from runtime/ConservativeSet.cpp.
+        * heap/ConservativeRoots.h: Copied from runtime/ConservativeSet.h.
+        * heap/Handle.h:
+        * heap/Heap.cpp:
+        * heap/MachineStackMarker.cpp: Copied from runtime/MachineStackMarker.cpp.
+        * heap/MachineStackMarker.h: Copied from runtime/MachineStackMarker.h.
+        * heap/MarkStack.cpp: Copied from runtime/MarkStack.cpp.
+        * heap/MarkStack.h: Copied from runtime/MarkStack.h.
+        * heap/MarkStackPosix.cpp: Copied from runtime/MarkStackPosix.cpp.
+        * heap/MarkStackSymbian.cpp: Copied from runtime/MarkStackSymbian.cpp.
+        * heap/MarkStackWin.cpp: Copied from runtime/MarkStackWin.cpp.
+        * heap/MarkedBlock.cpp: Copied from runtime/MarkedBlock.cpp.
+        * heap/MarkedBlock.h: Copied from runtime/MarkedBlock.h.
+        * heap/MarkedSpace.cpp: Copied from runtime/MarkedSpace.cpp.
+        * heap/MarkedSpace.h: Copied from runtime/MarkedSpace.h.
+        * interpreter/RegisterFile.cpp:
+        * runtime/ConservativeSet.cpp: Removed.
+        * runtime/ConservativeSet.h: Removed.
+        * runtime/MachineStackMarker.cpp: Removed.
+        * runtime/MachineStackMarker.h: Removed.
+        * runtime/MarkStack.cpp: Removed.
+        * runtime/MarkStack.h: Removed.
+        * runtime/MarkStackPosix.cpp: Removed.
+        * runtime/MarkStackSymbian.cpp: Removed.
+        * runtime/MarkStackWin.cpp: Removed.
+        * runtime/MarkedBlock.cpp: Removed.
+        * runtime/MarkedBlock.h: Removed.
+        * runtime/MarkedSpace.cpp: Removed.
+        * runtime/MarkedSpace.h: Removed.
+
+2011-04-11  Gavin Barraclough  <barraclough@apple.com>
 
-        * JavaScriptCore.vcproj/JavaScriptCore.make: Update for move of JavaScriptCore into Source.
+        Windows build fix.
 
-2011-01-24  Peter Varga  <pvarga@webkit.org>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        Reviewed by Oliver Hunt.
+2011-04-09  Gavin Barraclough  <barraclough@apple.com>
 
-        Optimize regex patterns which contain empty alternatives
-        https://bugs.webkit.org/show_bug.cgi?id=51395
+        Reviewed by Sam Weinig.
 
-        Eliminate the empty alternatives from the regex pattern and convert it to do
-        the matching in an easier way.
+        Bug 58198 - Clean up JSValue implementation for JSVALUE64
 
-        * yarr/YarrPattern.cpp:
-        (JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
+        Remove JSNumberCell, JSImmediate, unify some methods between JSVALUE32_64/JSVALUE64
 
-2011-01-24  Andras Becsi  <abecsi@webkit.org>
+        JSNumberCell.h largely just contained the constructors for JSValue on JSVALUE64,
+        which should not have been here.  JSImmediate mostly contained uncalled methods,
+        along with the internal implementation of the JSValue constructors split unnecessarily
+        across a number of layers of function calls. These could largely be merged back
+        together. Many methods and constructors from JSVALUE32_64 and JSVALUE64 can by unified.
 
-        Reviewed by Csaba Osztrogonác.
+        The .cpp files were empty.
 
-        [Qt] Move project files into Source
-        https://bugs.webkit.org/show_bug.cgi?id=52891
+        Moving all these methods into JSValue.h seems to be a repro measurable regression, so
+        I have kept these methods in a separate JSValueInlineMethods.h. Adding the 64-bit tag
+        values as static const members of JSValue also measures as a repro regression, so I
+        have made these #defines.
 
-        * JavaScriptCore.pri:
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
         * JavaScriptCore.pro:
-        * jsc.pro:
-
-2011-01-23  Mark Rowe  <mrowe@apple.com>
-
-        Follow-up to r76477.
-
-        Fix the scripts that detect problematic code such as static initializers
-        and destructors, weak vtables, inappropriate files in the framework wrappers,
-        and public headers including private headers. These had all been broken
-        since the projects were moved in to the Source directory as the paths to the
-        scripts were not updated at that time.
-
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
         * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+            - Removed class JSImmediate.
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+            - Removed class JSImmediate.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Removed class JSImmediate.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+            - Removed class JSImmediate.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitTagAsBoolImmediate):
+            - Removed class JSImmediate.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emitSlow_op_not):
+            - Removed class JSImmediate.
+        * jit/JSInterfaceJIT.h:
+            - Removed class JSImmediate.
+        * runtime/JSCell.h:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * runtime/JSImmediate.cpp: Removed.
+        * runtime/JSImmediate.h: Removed.
+        * runtime/JSNumberCell.cpp: Removed.
+        * runtime/JSNumberCell.h: Removed.
+            - Removed.
+        * runtime/JSObject.h:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * runtime/JSString.h:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * runtime/JSValue.h:
+            - Added tags for JSVALUE64, moved out some JSVALUE32_64 methods, unified with JSVALUE64.
+        * runtime/JSValueInlineMethods.h: Added.
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        (JSC::JSValue::isUInt32):
+        (JSC::JSValue::asUInt32):
+        (JSC::JSValue::uncheckedGetNumber):
+        (JSC::JSValue::toJSNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::getNumber):
+        (JSC::JSValue::getBoolean):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32):
+        (JSC::JSValue::isDouble):
+        (JSC::JSValue::isTrue):
+        (JSC::JSValue::isFalse):
+        (JSC::JSValue::tag):
+        (JSC::JSValue::payload):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::asDouble):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::makeImmediate):
+        (JSC::JSValue::immediateValue):
+        (JSC::reinterpretDoubleToIntptr):
+        (JSC::reinterpretIntptrToDouble):
+            - Methods moved here from JSImmediate.h/JSNumberCell.h/JSValue.h.
+        * runtime/Operations.h:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * wtf/StdLibExtras.h:
+            - Export bitwise_cast.
 
-2011-01-23  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Use WTF::StringHasher in WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=52934
-
-        Add an additional function to calculate the hash
-        of data with a runtimedependent size.
-
-        * wtf/StringHasher.h:
-        (WTF::StringHasher::createBlobHash):
-
-2011-01-23  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by David Kilzer.
-
-        Fix comment in String::ascii()
-        https://bugs.webkit.org/show_bug.cgi?id=52980
-
-        * wtf/text/WTFString.cpp:
-        (WTF::String::ascii):
-
-2011-01-23  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by David Kilzer.
-
-        Add String::containsOnlyLatin1()
-        https://bugs.webkit.org/show_bug.cgi?id=52979
-
-        * wtf/text/WTFString.h:
-        (WTF::String::containsOnlyLatin1):
-        (WTF::charactersAreAllLatin1):
-
-2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+2011-04-11  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
 
         Reviewed by Oliver Hunt.
 
-        Remove obsolete JSVALUE32 code
-        https://bugs.webkit.org/show_bug.cgi?id=52948
+        SH4 JIT SUPPORT.
+        https://bugs.webkit.org/show_bug.cgi?id=44329
 
-        r70111 removed support for JSVALUE32.
-        ARM, MIPS and X86 support JSVALUE32_64 only.
+        Add JIT remaining part for SH4 platforms.
 
+        * assembler/MacroAssemblerSH4.h:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
         * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JSInterfaceJIT.h:
 
-2011-01-22  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        ASSERT running run-webkit-tests --threaded.
-        https://bugs.webkit.org/show_bug.cgi?id=52971
-        
-        SunSpider and v8 report no change.
-
-        * runtime/ConservativeSet.cpp:
-        (JSC::ConservativeSet::grow):
-        (JSC::ConservativeSet::add):
-        * runtime/ConservativeSet.h: Tweaked the inline capacity to 128, and
-        the growth policy to 2X, to make SunSpider and v8 happy.
-        (JSC::ConservativeSet::ConservativeSet):
-        (JSC::ConservativeSet::~ConservativeSet):
-        (JSC::ConservativeSet::mark): Use OSAllocator directly, instead of malloc.
-        Malloc is forbidden during a multi-threaded mark phase because it can
-        cause deadlock.
-
-2011-01-22  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Rubber-stamped by Maciej Stachowiak.
+2011-04-10  Geoffrey Garen  <ggaren@apple.com>
 
-        A few of Maciej's review suggestions for my last patch.
-        https://bugs.webkit.org/show_bug.cgi?id=52946        
+        Rubber-stamped by Beth Dakin.
 
-        SunSpider reports no change.
+        Moved Heap.h and Heap.cpp to the heap folder, because anything less 
+        would be uncivilized.
 
         * Android.mk:
         * CMakeLists.txt:
-        * GNUmakefile.am:
+        * GNUmakefile.list.am:
         * JavaScriptCore.gypi:
         * JavaScriptCore.pro:
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj: Updated build systems.
-
-        * runtime/ConservativeSet.cpp: Added.
-        (JSC::isPointerAligned):
-        (JSC::ConservativeSet::add):
-        * runtime/ConservativeSet.h: Added.
-        (JSC::ConservativeSet::ConservativeSet):
-        (JSC::ConservativeSet::mark): Split ConservativeSet out into its own
-        file, and moved the conservative check into ConservativeSet::add, making
-        ConservativeSet's responsibility clearer.
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::markRoots):
-        * runtime/MachineStackMarker.cpp:
-        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
-        (JSC::MachineStackMarker::markOtherThreadConservatively):
-        * runtime/MachineStackMarker.h:
-        * runtime/MarkStack.h: Updated for changes above.
-
-2011-01-22  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed WinCE build fix for r76430.
-
-        * runtime/MachineStackMarker.cpp:
-        (JSC::swapIfBackwards):
-
-2011-01-21  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        Reorganized MarkedSpace, making many of its functions private.
-
-        * runtime/JSCell.h:
-        (JSC::JSCell::Heap::heap):
-        * runtime/MarkedSpace.h:
-        (JSC::MarkedSpace::globalData):
-        (JSC::MarkedSpace::heap):
-
-2011-01-21  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix build: moved helper function out of #ifdef.
-
-        * runtime/MachineStackMarker.cpp:
-        (JSC::swapIfBackwards):
-
-2011-01-21  Geoffrey Garen  <ggaren@apple.com>
-
-        Rubber-stamped by Maciej Stachowiak.
-
-        A few of Maciej's review suggestions for my last patch.
-        https://bugs.webkit.org/show_bug.cgi?id=52946        
-
-        SunSpider reports no change.
-
-        * runtime/MachineStackMarker.cpp:
-        (JSC::swapIfBackwards): Added a helper function for handling platforms
-        where the stack can grow in any direction.
-
-        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
-        (JSC::MachineStackMarker::markOtherThreadConservatively): Use the helper
-        function.
-
-        (JSC::isPointerAligned): Use "!" instead of "==0" because a robot told me to.
-
-        (JSC::MachineStackMarker::markConservatively): Changed to use a more
-        standard looping idiom, and to use the helper function above.
-
-        * runtime/MarkedSpace.h:
-        (JSC::MarkedSpace::isCellAligned): Use "!" instead of "==0" because a robot told me to.
-
-2011-01-21  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Cleaned up some conservative marking code.
-        https://bugs.webkit.org/show_bug.cgi?id=52946
-        
-        SunSpider reports no change.
-
-        * interpreter/RegisterFile.h: No need for a special marking function,
-        since we already expose a start() and end().
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::registerFile):
-        (JSC::Heap::markRoots):
-        * runtime/Heap.h:
-        (JSC::Heap::contains): Migrated markConservatively() to the machine stack
-        marker class. Now, Heap just provides a contains() function, which the
-        machine stack marker uses for checking whether a pointer points into the heap.
-
-        * runtime/MachineStackMarker.cpp:
-        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
-        (JSC::MachineStackMarker::markOtherThreadConservatively):
-        (JSC::isPointerAligned):
-        (JSC::MachineStackMarker::markConservatively):
-        * runtime/MachineStackMarker.h: Move the conservative marking code here.
-
-        * runtime/MarkStack.h:
-        (JSC::ConservativeSet::add):
-        (JSC::ConservativeSet::mark): Changed to using a vector instead of hash
-        set. Vector seems to be a bit faster, and it generates smaller code.
-
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::containsSlowCase):
-        * runtime/MarkedSpace.h:
-        (JSC::MarkedSpace::isCellAligned):
-        (JSC::MarkedSpace::isPossibleCell):
-        (JSC::MarkedSpace::contains): Kept the code for determining whether a
-        pointer pointed into marked space, and moved the code for marking
-        a set of conservative pointers into the machine stack marker.
-
-        * wtf/HashSet.h:
-        (WTF::::add): Added two missing inlines that I noticed while testing
-        vector vs hash set.
-
-2011-01-21  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Work around a Clang bug <rdar://problem/8876150> that leads to it incorrectly emitting an access
-        control warning when a client tries to use operator bool exposed above via "using PageBlock::operator bool".
-
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::operator bool):
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::operator bool):
-
-2011-01-21  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        [RegexFuzz] Hang with forward assertion
-        https://bugs.webkit.org/show_bug.cgi?id=52825
-        <rdar://problem/8894332>
-
-        The backtrackTo label from the first term in a list of terms is
-        being overwritten by processing of subsequent terms.  Changed
-        copyBacktrackToLabel() to check for an existing bcaktrackTo label
-        before copying and renamed it to propagateBacktrackToLabel() since
-        it no longer copies.
-
-        * yarr/YarrJIT.cpp:
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::propagateBacktrackToLabel):
-        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
-
-2011-01-21  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Moved the mark stack from global data to the heap, since it pertains
-        to the heap, and not the virtual machine as a whole.
-        https://bugs.webkit.org/show_bug.cgi?id=52930
-        
-        SunSpider reports no change.
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::Heap):
-        (JSC::Heap::markRoots):
-        * runtime/Heap.h:
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * runtime/JSGlobalData.h:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp: Copied from JavaScriptCore/runtime/Heap.cpp.
+        * heap/Heap.h: Copied from JavaScriptCore/runtime/Heap.h.
+        * runtime/Heap.cpp: Removed.
+        * runtime/Heap.h: Removed.
 
-2011-01-21  Peter Gal  <galpeter@inf.u-szeged.hu>
+2011-04-10  Patrick Gansterer  <paroga@webkit.org>
 
         Reviewed by Darin Adler.
 
-        REGRESSION(r76177): All JavaScriptCore tests fail on ARM
-        https://bugs.webkit.org/show_bug.cgi?id=52814
-
-        Get the approximateByteSize value before releasing the OwnPtr.
-
-        * parser/JSParser.cpp:
-        (JSC::JSParser::parseFunctionInfo):
-
-2011-01-21  Xan Lopez  <xlopez@igalia.com>
+        Remove duplicated code from AtomicString::fromUTF8()
+        https://bugs.webkit.org/show_bug.cgi?id=53711
 
-        Reviewed by Martin Robinson.
-
-        Remove unnecessary <stdio.h> include
-        https://bugs.webkit.org/show_bug.cgi?id=52884
-
-        * jit/JIT.cpp: remove unnecessary include.
-
-2011-01-20  Ryosuke Niwa  <rniwa@webkit.org>
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::fromUTF8Internal):
+        * wtf/text/AtomicString.h:
+        (WTF::AtomicString::fromUTF8):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8):
+        * wtf/unicode/UTF8.h:
 
-        Reviewed by Maciej Stachowiak.
+2011-04-10  Maciej Stachowiak  <mjs@apple.com>
 
-        Added OwnPtrCommon.h because OwnArrayPtr::set calls deleteOwnedPtr.
+        Not reviewed.
 
-        * wtf/OwnArrayPtr.h:
+        Fix build (at least on Lion) by adding some newish header files to
+        PrivateHeaders.
 
-2011-01-20  Patrick Gansterer  <paroga@webkit.org>
+        * JavaScriptCore.xcodeproj/project.pbxproj:
 
-        Reviewed by Oliver Hunt.
+2011-04-09  Geoffrey Garen  <ggaren@apple.com>
 
-        [WINCE] Remove obsolete JSVALUE32 code
-        https://bugs.webkit.org/show_bug.cgi?id=52450
+        Not reviewed.
 
-        Remove the "offset hack" in create_jit_stubs, since we
-        only support JSVALUE32_64 in the meantime.
+        Try recommitting some things svn left out of its last commit.
 
-        * create_jit_stubs: Removed offset argument
-        * jit/JITStubs.cpp:
+        * heap/Handle.h:
+        (JSC::HandleBase::operator!):
+        (JSC::HandleBase::HandleBase):
+        (JSC::HandleBase::slot):
+        (JSC::HandleBase::setSlot):
+        (JSC::Handle::Handle):
+        * heap/HandleHeap.cpp:
+        (JSC::HandleHeap::markWeakHandles):
+        (JSC::HandleHeap::finalizeWeakHandles):
+        (JSC::HandleHeap::isValidWeakNode):
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::globalData):
 
-2011-01-20  Geoffrey Garen  <ggaren@apple.com>
+2011-04-08  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        When marking conservatively, guard against reviving dead objects.
-        https://bugs.webkit.org/show_bug.cgi?id=52840
+        A few heap-related renames and file moves.
+        
+        WeakGCPtr<T> => Weak<T>
+        Global<T> => Strong<T>
+        collector/ => heap/
+        collector/* => heap/*
+        runtime/WeakGCPtr.h => heap/Weak.h
         
-        SunSpider and v8 say no change.
+        (Eventually, even more files should move into the heap directory. Like
+        Heap.h and Heap.cpp, for example.)
 
+        * API/JSClassRef.h:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/SamplingTool.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * collector: Removed.
+        * collector/handles: Removed.
+        * collector/handles/Global.h: Removed.
+        * collector/handles/Handle.h: Removed.
+        * collector/handles/HandleHeap.cpp: Removed.
+        * collector/handles/HandleHeap.h: Removed.
+        * collector/handles/HandleStack.cpp: Removed.
+        * collector/handles/HandleStack.h: Removed.
+        * collector/handles/Local.h: Removed.
+        * collector/handles/LocalScope.h: Removed.
+        * heap: Copied from collector.
+        * heap/Handle.h: Copied from collector/handles/Handle.h.
+        * heap/HandleHeap.cpp: Copied from collector/handles/HandleHeap.cpp.
+        * heap/HandleHeap.h: Copied from collector/handles/HandleHeap.h.
+        * heap/HandleStack.cpp: Copied from collector/handles/HandleStack.cpp.
+        * heap/HandleStack.h: Copied from collector/handles/HandleStack.h.
+        * heap/Local.h: Copied from collector/handles/Local.h.
+        * heap/LocalScope.h: Copied from collector/handles/LocalScope.h.
+        * heap/Strong.h: Copied from collector/handles/Global.h.
+        (JSC::Strong::Strong):
+        (JSC::Strong::~Strong):
+        (JSC::Strong::operator=):
+        * heap/Weak.h: Copied from runtime/WeakGCPtr.h.
+        (JSC::Weak::Weak):
+        (JSC::Weak::~Weak):
+        * heap/handles: Removed.
         * interpreter/RegisterFile.h:
-        (JSC::RegisterFile::markCallFrames): Updated to use the ConservativeSet API.
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::recordExtraCost): No need to guard against conservative
-        marking reviving dead objects anymore, since the conservative marking
-        mechanism guards against this now.
-
-        (JSC::Heap::markConservatively):
-        (JSC::Heap::markProtectedObjects):
-        (JSC::Heap::markTempSortVectors): Don't drain the mark stack inside a
-        marking function. We want to establish a separation of concerns between
-        visiting roots and draining the mark stack.
-
-        (JSC::Heap::markRoots): Gather the set of conservative references before
-        clearning mark bits, because conservative marking now uses the mark bits
-        to determine if a reference is valid, and avoid reviving dead objects.
-
-        (JSC::Heap::collectAllGarbage): No need to guard against conservative
-        marking reviving dead objects anymore, since the conservative marking
-        mechanism guards against this now.
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        * runtime/Structure.h:
+        * runtime/WeakGCPtr.h: Removed.
 
-        * runtime/Heap.h: Updated to use the ConservativeSet API.
+2011-04-08  Alpha Lam  <hclam@chromium.org>
 
-        * runtime/MachineStackMarker.cpp:
-        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
-        (JSC::MachineStackMarker::markCurrentThreadConservatively):
-        (JSC::MachineStackMarker::markOtherThreadConservatively):
-        (JSC::MachineStackMarker::markMachineStackConservatively):
-        * runtime/MachineStackMarker.h: Ditto.
+        Unreviewed, rolling out r83335.
+        http://trac.webkit.org/changeset/83335
+        https://bugs.webkit.org/show_bug.cgi?id=53556
 
-        * runtime/MarkStack.h:
-        (JSC::ConservativeSet::add):
-        (JSC::ConservativeSet::mark): Added ConservativeSet, for gathering the
-        set of conservative references. This is different from MarkStack, since
-        we don't mark the set until it is completely gathered.
+        GTK and QT bots are broken
 
-        * runtime/MarkedSpace.cpp:
-        (JSC::MarkedSpace::freeBlock):
-        (JSC::MarkedSpace::resizeBlocks):
-        (JSC::MarkedSpace::markConservatively):
-        * runtime/MarkedSpace.h: When marking conservatively, guard against
-        reviving dead objects.
-
-2011-01-20  Siddharth Mathur  <siddharth.mathur@nokia.com>
+        * Configurations/FeatureDefines.xcconfig:
 
-        Reviewed by Geoffrey Garen.
+2011-04-08  Gavin Barraclough  <barraclough@apple.com>
 
-        [Symbian] Fix StackBounds::initialize()
-        https://bugs.webkit.org/show_bug.cgi?id=52842
+        Ooops, typo, build fix.
 
-        * wtf/StackBounds.cpp:
-        (WTF::StackBounds::initialize): Use TThreadStackInfo.iLimit for stack limit
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
 
-2011-01-20  Michael Saboff  <msaboff@apple.com>
+2011-04-08  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        <rdar://problem/8890203> [RegexFuzz] Crash in generated code (52773)
-        https://bugs.webkit.org/show_bug.cgi?id=52773
+        Bug 58154 - Add support for comparison operators to the DFG JIT.
+
+        Add support for <, <=, ==, ===, and also !.  Add support for all corresponding
+        bytecode ops, including the not- and -null forms.  Initially add functionally
+        correct support, we'll revisit the performance.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::constantNull):
+        (JSC::DFG::ByteCodeParser::parse):
+            - Add support for parsing of bytecode opcodes, 
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::callOperation):
+            - Add new operation call types, return bool values.
+        * dfg/DFGNode.h:
+            - Add new node types.
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+            - Add code generation for new nodes.
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationCompareLess):
+        (JSC::DFG::operationCompareLessEq):
+        (JSC::DFG::operationCompareEq):
+        (JSC::DFG::operationCompareStrictEq):
+        (JSC::DFG::dfgConvertJSValueToBoolean):
+        * dfg/DFGOperations.h:
+            - Add operation callbacks to implement new ops.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Add code generation for new nodes.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+            - Switched to a simpler <0 check, rather than relying on an internal value in JSImmediate.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+            - Switched to a simpler <0 check, rather than relying on an internal value in JSImmediate.
+        * runtime/JSImmediate.h:
+            - Make tag values public, rather than relying on a friend - this matches JSVALUE32_64.
 
-        Fixed case where an existing DataLabelPtr is overwritten.  The
-        replacing DataLabelPtr is now resolved immediately in
-        linkDataLabelToBacktrackIfExists().  Cleanup - eliminated bool
-        return value for the routine as it was never used.
+2011-04-07  Anna Cavender  <annacc@chromium.org>
 
-        * yarr/YarrJIT.cpp:
-        (JSC::Yarr::YarrGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists):
+        Reviewed by Eric Carlson.
 
-2011-01-20  Andras Becsi  <abecsi@webkit.org>
+        Setup ENABLE(TRACK) feature define
+        https://bugs.webkit.org/show_bug.cgi?id=53556
 
-        Reviewed by Csaba Osztrogonác.
 
-        [Qt][WK2] WebKit2 enabled build fails to link
+        * Configurations/FeatureDefines.xcconfig:
 
-        Work around undefined reference linking issues until the buildsystem gets redesigned.
-        These issues first occured in minimal builds (see BUG 50519).
+2011-04-07  Balazs Kelemen  <kbalazs@webkit.org>
 
-        * JavaScriptCore.pri: link as whole-archive for WebKit2 builds
+        Reviewed by Kenneth Rohde Christiansen.
 
-2011-01-20  Zoltan Horvath  <zoltan@webkit.org>
+        [WK2][Qt][GTK] Introduce common use flag for the shared UNIX domain socket IPC implementation
+        https://bugs.webkit.org/show_bug.cgi?id=58030
 
-        Reviewed by Csaba Osztrogonác.
+        * wtf/Platform.h: Introduce USE(UNIX_DOMAIN_SOCKETS) for WebKit2.
 
-        Refactoring of the custom allocation framework
-        https://bugs.webkit.org/show_bug.cgi?id=49897
+2011-04-08  Adam Roben  <aroben@apple.com>
 
-        Inheriting from FastAllocBase can result in objects getting larger (bug #33896, #46589).
-        The modification replaces Noncopyable and FastAllocBase classes and these inherits with their
-        equivalent macro implementation at the necessary places.
+        Clean build fix
 
-        * wtf/FastAllocBase.h: Turn FastAllocBase's implementation into a macro.
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: Don't try to delete directories that
+        don't exist. Also switched from del /s to rmdir /s, which has the benefit of deleting the
+        directory itself in addition to the files it contains.
 
-2011-01-20  Mark Rowe  <mrowe@apple.com>
+2011-04-07  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Maciej Stachowiak.
 
-        Follow-up to r75766 / <rdar://problem/5469576>.
-
-        We were failing to initialize the key, causing all sorts of unexpected behavior.
+        Some Handle<T> cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=58109
 
-        * wtf/FastMalloc.cpp:
-        (WTF::setThreadHeap):
-        (WTF::TCMalloc_ThreadCache::GetThreadHeap):
-        (WTF::TCMalloc_ThreadCache::InitTSD): Ensure that the key is initialized.
-
-2011-01-18  Geoffrey Garen  <ggaren@apple.com>
+        * bytecode/SamplingTool.h: Sorted alphabetically because that's the
+        WebKit style. Added a Global.h #include that was previously missing
+        but harmless.
 
-        Reviewed by Darin Adler.
-
-        Rolled back in r76078, with crash fixed.
-        https://bugs.webkit.org/show_bug.cgi?id=52668
+        * collector/handles/Global.h:
+        (JSC::Global::Global): Added a null constructor. No need for a special
+        tag, and the tag is incompatible with some data structures.
         
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::markChildren): Account for the fact that the global
-        object moves its variables into and out of the register file. While out
-        of the register file, the symbol table's size is not an accurate count
-        for the size of the register array, since the BytecodeGenerator might
-        be compiling, adding items to the symbol table.
+        (JSC::Global::isHashTableDeletedValue):
+        (JSC::Global::~Global):
+        (JSC::Global::set):
+        (JSC::Global::operator=):
+        (JSC::Global::clear):
+        (JSC::Global::hashTableDeletedValue): Reordered constructors to be near
+        each other.
+
+        (JSC::Global::setWithWriteBarrier): Renamed internalSet to
+        setWithWriteBarrier for clarity, and funneled more code into using set
+        and setWithWriteBarrier to reduce duplication.
+
+        * collector/handles/Handle.h:
+        (JSC::HandleBase::operator!):
+        (JSC::HandleBase::HandleBase): Removed isEmpty(), since we already have
+        boolean and ! operators.
+
+        (JSC::HandleBase::slot):
+        (JSC::HandleBase::setSlot):
+        (JSC::Handle::Handle): Added general support for null Handles. This was
+        previously outlawed by ASSERTs, but our code has grown to support and
+        rely on null Handles.
         
-2011-01-18  Darin Adler  <darin@apple.com>
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::markWeakHandles):
+        (JSC::HandleHeap::finalizeWeakHandles):
+        (JSC::HandleHeap::isValidWeakNode): Migrated from isValidWeakHandle,
+        and beefed this up a bit.
 
-        Reviewed by Geoffrey Garen.
-
-        Stack overflow when converting an Error object to string
-        https://bugs.webkit.org/show_bug.cgi?id=46410
+        * collector/handles/HandleHeap.h:
+        (JSC::HandleHeap::globalData): Added accessor, used by some new set functions.
 
-        * Android.mk: Added StringRecursionChecker.cpp and
-        StringRecursionChecker.h.
-        * CMakeLists.txt: Ditto.
-        * GNUmakefile.am: Ditto.
-        * JavaScriptCore.gypi: Ditto.
-        * JavaScriptCore.pro: Ditto.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * collector/handles/Local.h: Moved hash traits to the bottom of the file,
+        since this file is about the Local class, not the traits.
 
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncToString): Use StringRecursionChecker instead
-        of the older hand-written code to do the same thing.
-        (JSC::arrayProtoFuncToLocaleString): Ditto.
-        (JSC::arrayProtoFuncJoin): Ditto.
+        (JSC::::Local): Updated for removal of invalidate().
 
-        * runtime/ErrorPrototype.cpp:
-        (JSC::errorProtoFuncToString): Use StringRecursionChecker.
+        (JSC::::operator): Deployed "using" to avoid a lot of this->
+        template funny business.
 
-        * runtime/JSGlobalData.h: Renamed arrayVisitedElements to
-        stringRecursionCheckVisitedObjects.
+        (JSC::::setWithSlotCheck): Renamed from internalSet, more specific now.
 
-        * runtime/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncToString): Use StringRecursionChecker.
-
-        * runtime/StringRecursionChecker.cpp: Added.
-        * runtime/StringRecursionChecker.h: Added.
-
-2011-01-19  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile): Updated to use null constructor.
 
-        Remove non-spec support for callable RegExp
-        https://bugs.webkit.org/show_bug.cgi?id=28285
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
 
-        Remove support for callable regexps.  If it breaks sites we can
-        just roll this out.
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::Structure::setEnumerationCache):
+        * runtime/Structure.h: Removed clearEnumerationCache
+        because it was an unused holdover from when the enumeration cache was
+        not a handle.
 
-        * runtime/RegExpObject.cpp:
-        * runtime/RegExpObject.h:
-        * tests/mozilla/expected.html: update results.
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::set): Finish initializing our handle before putting it
+        in the table. This seemed more logical, and at one point was required
+        to avoid triggering an ASSERT.
 
-2011-01-19  Antti Koivisto  <antti@apple.com>
+        * runtime/WeakGCPtr.h: Inherit from Handle instead of rolling our own
+        handle-like behavior, to avoid duplication.
 
-        Reviewed by Oliver Hunt.
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::~WeakGCPtr):
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::clear):
+        (JSC::WeakGCPtr::set):
+        (JSC::WeakGCPtr::setWithWriteBarrier): Removed duplicate code and
+        standardized on Handle idioms.
 
-        Cache function offsets to speed up javascript parsing
-        https://bugs.webkit.org/show_bug.cgi?id=52622
-        
-        Use cache to save function offsets and some other info.
-        This avoids quite a bit of work when reparsing the source.
+2011-04-07  Adam Barth  <abarth@webkit.org>
 
-        * parser/ASTBuilder.h:
-        * parser/JSParser.cpp:
-        (JSC::JSParser::CachedFunctionInfo::CachedFunctionInfo):
-        (JSC::JSParser::CachedFunctionInfo::approximateByteSize):
-        (JSC::JSParser::CachedFunctionInfo::closeBraceToken):
-        (JSC::JSParser::Scope::copyCapturedVariablesToVector):
-        (JSC::JSParser::Scope::saveFunctionInfo):
-        (JSC::JSParser::Scope::restoreFunctionInfo):
-        (JSC::JSParser::findCachedFunctionInfo):
-        (JSC::JSParser::JSParser):
-        (JSC::JSParser::parseProgram):
-        (JSC::JSParser::parseFunctionInfo):
-        * parser/Lexer.h:
-        (JSC::Lexer::setOffset):
-        (JSC::Lexer::setLineNumber):
-        (JSC::Lexer::sourceProvider):
-        * parser/SourceProvider.h:
-        (JSC::SourceProviderCache::SourceProviderCache):
-        (JSC::SourceProviderCache::~SourceProviderCache):
-        (JSC::SourceProviderCache::byteSize):
-        (JSC::SourceProviderCache::add):
-        (JSC::SourceProviderCache::get):
-        (JSC::SourceProvider::SourceProvider):
-        (JSC::SourceProvider::~SourceProvider):
-        (JSC::SourceProvider::cache):
-        (JSC::SourceProvider::notifyCacheSizeChanged):
-        (JSC::SourceProvider::cacheSizeChanged):
-        * parser/SyntaxChecker.h:
-
-2011-01-19  Mark Rowe  <mrowe@apple.com>
+        Reviewed by Martin Robinson.
 
-        Reviewed by Darin Adler.
+        Refactor Gtk build system to separate list of files
+        https://bugs.webkit.org/show_bug.cgi?id=58090
 
-        Follow-up to r75766 / <rdar://problem/5469576>.
+        This is the first step towards generating part of the GTK build system
+        using GYP.  In the first iteration, our plan is to just generate the
+        list of files.  This patch is the first step, which is to separate out
+        the part of JavaScriptCore build system that we intend to generate from
+        the rest of the build system.
 
-        * DerivedSources.make: Evaluate the SDKROOT variable correctly.
+        * GNUmakefile.am:
+        * GNUmakefile.list.am: Added.
 
-2011-01-19  Oliver Hunt  <oliver@apple.com>
+2011-04-07  Zoltan Herczeg  <zherczeg@webkit.org>
 
         Reviewed by Gavin Barraclough.
 
-        [jsfunfuzz] Defining a function called __proto__ inside an eval triggers an assertion
-        https://bugs.webkit.org/show_bug.cgi?id=52672
+        Mapping booleans the same way as integers
+        https://bugs.webkit.org/show_bug.cgi?id=56913
 
-        Rather than coming up with a somewhat convoluted mechanism to ensure that
-        developers can override the global objects prototype with a function named
-        __proto__ and expect it to work, we just disallow it at the syntax level.
+        Instead of having a seperate tag field for booleans,
+        the logical values are stored in the payload field
+        (for JSValue32_64 representation).
 
-        * parser/JSParser.cpp:
-        (JSC::JSParser::parseFunctionInfo):
+        1.007x speedup on SunSpider.
 
-2011-01-19  Michael Saboff  <msaboff@apple.com>
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitStoreBool):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JSInterfaceJIT.h:
+        * runtime/JSValue.h:
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::isTrue):
+        (JSC::JSValue::isFalse):
+        (JSC::JSValue::getBoolean):
 
-        Reviewed by Darin Adler.
+2011-04-07  Eric Seidel  <eric@webkit.org>
 
-        <rdar://problem/8882994> Regression: Simple nested backtrack hangs
-        https://bugs.webkit.org/show_bug.cgi?id=52675
+        Reviewed by Adam Barth.
 
-        The changeset (r76076) for https://bugs.webkit.org/show_bug.cgi?id=52540
-        broke simple backtracking in some cases.  Reworked that change to 
-        link both jumps and labels.
+        Add stub support for generating Gtk build system from gyp
+        https://bugs.webkit.org/show_bug.cgi?id=58086
 
-        * yarr/YarrJIT.cpp:
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::hasBacktrackToLabel):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::propagateBacktrackingFrom):
-        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+        This does not produce a buildable JavaScriptCore, but it
+        does allow running gyp/configure --port=gtk and having
+        it generate a gtk.Makefile which we can use for testing
+        the rest of the plumbing.
 
-2011-01-19  Pavel Podivilov  <podivilov@chromium.org>
+        * gyp/gtk.gyp: Added.
 
-        Reviewed by Yury Semikhatsky.
+2011-04-07  Andrew Scherkus  <scherkus@chromium.org>
 
-        Web Inspector: [JSC] scripts have incorrect starting line (always 1).
-        https://bugs.webkit.org/show_bug.cgi?id=52721
+        Revert ENABLE_TRACK patch due to compile failures.
 
-        * debugger/Debugger.cpp:
-        (JSC::Debugger::recompileAllJSFunctions):
-        * debugger/Debugger.h:
-        * parser/Parser.h:
-        (JSC::Parser::parse):
-        * parser/SourceCode.h:
-        (JSC::SourceCode::SourceCode):
-        * parser/SourceProvider.h:
-        (JSC::SourceProvider::startPosition):
+        * Configurations/FeatureDefines.xcconfig:
 
-2011-01-19  Csaba Osztrogonác  <ossy@webkit.org>
+2011-04-07  Adam Barth  <abarth@webkit.org>
 
-        Reviewed by Laszlo Gombos and Tor Arne Vestbø.
+        Fix whitespace in GNUmakefile.am.
 
-        [Qt] Remove unnecessary "../Source" from paths
-        after moving source files into Source is finished.
+        * GNUmakefile.am:
 
-        * JavaScriptCore.pri:
+2011-04-07  Gavin Barraclough  <barraclough@apple.com>
 
-2011-01-19  Benjamin Kalman  <kalman@chromium.org>
+        Fix a couple of typos in comments that Darin spotted.
 
-        Reviewed by Darin Adler.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        * runtime/JSImmediate.h:
 
-        Don't return void from void function String::split
-        https://bugs.webkit.org/show_bug.cgi?id=52684
+2011-04-06  Gavin Barraclough  <barraclough@apple.com>
 
-        * wtf/text/WTFString.cpp:
-        (WTF::String::split):
+        Reviewed by Geoff Garen.
+        Bug 58057 - Store boolean payload in low bit of JSImmediate
 
-2011-01-18  Kenneth Russell  <kbr@google.com>
+        And remove some uncalled functions from JSImmediate.h
 
-        Unreviewed, rolling out r76078.
-        http://trac.webkit.org/changeset/76078
-        https://bugs.webkit.org/show_bug.cgi?id=52668
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeBool):
+        (JSC::JSImmediate::intValue):
+        (JSC::JSImmediate::boolValue):
+        (JSC::JSImmediate::asInt32):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::isUInt32):
+        (JSC::JSValue::asUInt32):
 
-        Caused crashes of fast/canvas/webgl/constants.html,
-        fast/canvas/webgl/gl-enum-tests.html, and possibly other layout
-        test crashes in Release mode. WebGL crashes were observed with
-        "run-webkit-tests fast/canvas/webgl". It was necessary to run
-        multiple tests to provoke the crash.
+2011-04-07  Liang Qi  <liang.qi@nokia.com>
 
-        * interpreter/RegisterFile.h:
-        (JSC::RegisterFile::markGlobals):
-        * runtime/JSActivation.cpp:
-        (JSC::JSActivation::markChildren):
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::markChildren):
+        Reviewed by Laszlo Gombos.
 
-2011-01-18  Oliver Hunt  <oliver@apple.com>
+        [Qt][Symbian] Enable webkit build with GCCE on Symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=57841
 
-        Reviewed by Gavin Barraclough.
+        * wtf/MathExtras.h: GCCE compiler doesn't support those std static functions.
 
-        [jsfunfuzz] Assertion asking activation for arguments when arguments is overridden
-        https://bugs.webkit.org/show_bug.cgi?id=52690
+2011-04-06  Dai Mikurube  <dmikurube@chromium.org>
 
-        Clean up code to retrieve arguments from activation and function objects.
-        Remove the incorrect assertion from JSActivation's argumentsGetter.
+        Reviewed by David Levin.
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::retrieveArguments):
-        * runtime/JSActivation.cpp:
-        (JSC::JSActivation::argumentsGetter):
+        Add QUOTA build flag for unified quota API
+        https://bugs.webkit.org/show_bug.cgi?id=57918
 
-2011-01-18  Geoffrey Garen  <ggaren@apple.com>
+        * Configurations/FeatureDefines.xcconfig: Added QUOTA build flag
 
+2011-04-06  Kevin Ollivier  <kevino@theolliviers.com>
+        
         Reviewed by Darin Adler.
+        
+        Make sure JS_EXPORT_PRIVATE is an empty define when we aren't using the export macros.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
 
-        Removed RegisterFile::markGlobals because it was obtuse, and it
-        unnecessarily relied on conservative marking.
-        https://bugs.webkit.org/show_bug.cgi?id=52668
-
-        * interpreter/RegisterFile.h: Removed markGlobals.
-
-        * runtime/JSActivation.cpp:
-        (JSC::JSActivation::markChildren): Added a comment explaning why some
-        JSActivations don't always mark their registers arrays.
-
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::markChildren): Instead of calling markGlobals, mark
-        the registers array directly.
-
-2011-01-18  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/8875432> Regression: Some text-only e-mails cause hang beneath RegExp::match (52540)
-        https://bugs.webkit.org/show_bug.cgi?id=52540
-        https://bugs.webkit.org/show_bug.cgi?id=52662
-
-        Directly use backtrack label with parentheses nested under a
-        non-capturing parentheses.  Also linked current parentheses
-        tail code object for possible parens nested within a non-capturing
-        parentheses.
-
-        * yarr/YarrJIT.cpp:
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkBacktrackToLabel):
-        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+        * config.h:
 
-2011-01-18  Daniel Bates  <dbates@rim.com>
+2011-04-06  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Gavin Barraclough.
 
-        Only use moving memory model assumption in ExecutableAllocator::intializePageSize() for Symbian OS
-        https://bugs.webkit.org/show_bug.cgi?id=52517
-
-        Patch by David Tapuska
-
-        Currently, we compile code with respect to the Symbian-specific moving memory model
-        assumption for all ARMv5 or lower architectures. Instead, we should only compile
-        such code when building for Symbian OS on those architectures because this model
-        is Symbian-specific.
-
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutableAllocator::intializePageSize):
-
-2011-01-18  Dimitry Andric  <dim@freebsd.org>
-
-        Reviewed by Andreas Kling.
-
-        Fix linking JavaScriptCore on FreeBSD/amd64
-        https://bugs.webkit.org/show_bug.cgi?id=52591
-
-        Linking of JavaScriptCore on FreeBSD/amd64 fails, for the same reason as
-        in bug 28422: cti_vm_throw needs a "@plt" suffix, otherwise the linker
-        complains about the relocation type.
-
-        * jit/JITStubs.cpp: use @plt suffix on x86_64 platforms, for both Linux
-        and FreeBSD.
-
-2011-01-18  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        [jsfunfuzz] Assertion in codegen for array of NaN constants
-        https://bugs.webkit.org/show_bug.cgi?id=52643
-
-        Don't cache NaN literals in the code generator, as NaN doesn't compare
-        as equal to itself it causes problems when rehashing the number cache.
-
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitLoad):
-
-2011-01-17  Jarred Nicholls  <jarred@sencha.com>
-
-        Reviewed by Csaba Osztrogonác.
-
-        REGRESSION(r75709): Return value of fscanf() shouldn't be ignored.
-        https://bugs.webkit.org/show_bug.cgi?id=52585
-        
-        gcc 4.4.4+ has warn_unused_value attribute on fscanf, so we should check
-        the return value to get around the gcc warning
-
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::maybeModifyVMPoolSize):
+        Stop JSObject::isUsingInlineStorage() from using the structure
+        https://bugs.webkit.org/show_bug.cgi?id=57986
 
-2011-01-17  Michael Saboff  <msaboff@apple.com>
+        Make the isUsingInlineStorage() implementation just look at
+        whether the property storage is inside the object.
 
-        Reviewed by Oliver Hunt.
-
-        [regexfuzz] Crash running regex with lookahead
-        https://bugs.webkit.org/show_bug.cgi?id=52548
+        * runtime/JSObject.h:
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSC::JSObject::JSObject):
 
-        Eliminated agressive chaining of backtracks.  This code was overwriting
-        already valid backtrack information.
+2011-04-06  Gavin Barraclough  <barraclough@apple.com>
 
-        * yarr/YarrJIT.cpp:
-        (JSC::Yarr::YarrGenerator::ParenthesesTail::processBacktracks):
+        Rubber stamped by Geoff Garen.
 
-2011-01-17  Tony Gentilcore  <tonyg@chromium.org>
+        Update comments documenting JSVALUE64/JSVALUE32_64 JSValue representations.
 
-        Reviewed by Alexey Proskuryakov.
+        * runtime/JSImmediate.h:
+        * runtime/JSValue.h:
 
-        Fix some headers with missing or misspelled #ifndef guards
-        https://bugs.webkit.org/show_bug.cgi?id=52545
+2011-04-06  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
 
-        * wtf/RefPtrHashMap.h:
+        cmake: Fix build for ARMv7
 
-2011-01-17  Dan Bernstein  <mitz@apple.com>
+        * CMakeLists.txt: add missing file.
 
-        Rubber-stamped by Mark Rowe.
+2011-04-06  Liang Qi  <liang.qi@nokia.com>
 
-        Update xcodeproj svn:ignore to include xcuserdata.
+        Reviewed by Benjamin Poulain.
 
-        * JavaScriptCore.xcodeproj: Modified property svn:ignore.
+        Correct a include file name.
+        https://bugs.webkit.org/show_bug.cgi?id=57839
 
-2011-01-16  Adam Barth  <abarth@webkit.org>
+        * wtf/PageAllocatorSymbian.h: It should be case sensitive. This fix 
+        builds on Unix hosts.
 
-        Rubber-stamped by Eric Seidel.
+2011-04-06  Adam Roben  <aroben@apple.com>
 
-        Move WebKit into Source
-        https://bugs.webkit.org/show_bug.cgi?id=52530
+        Build fix after r83056
 
-        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: Added property svn:executable.
 
-2011-01-16  Oliver Hunt  <oliver@apple.com>
+2011-04-06  Adam Roben  <aroben@apple.com>
 
-        Reviewed by Sam Weinig.
+        Move JavaScriptCoreGenerated's file-copying logic out to a new script
 
-        [jsfunfuzz] Parser doesn't correctly validate for-loop syntax
-        https://bugs.webkit.org/show_bug.cgi?id=52516
+        Hopefully this will make it easier to modify this logic in the future. I also made the
+        script much quieter than the old logic, since it didn't seem helpful to see long lists of
+        filenames during the copying phase.
 
-        Ensure that we always check for a semicolon after encountering
-        multiple declarations in the initialiser portion of a for-loop.
+        If we like this new style, we could copy it for our other projects.
 
-        * parser/JSParser.cpp:
-        (JSC::JSParser::parseForStatement):
+        Fixes <http://webkit.org/b/57950> JavaScriptCoreGenerated's file-copying logic is hard to
+        modify and noisy
 
-2011-01-16  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Steve Falkenburg.
 
-        Reviewed by Geoffrey Garen.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Moved logic to copy
+        files from here...
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: ...to here. (Added.)
 
-        Strict mode restrictions on arguments and eval usage aren't complete
-        https://bugs.webkit.org/show_bug.cgi?id=52528
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Added copy-files.cmd
+        for convenience.
 
-        Fix a few bugs in strict mode where we incorrect allow mutation of
-        arguments and eval in the parser.
+2011-04-05  Geoffrey Garen  <ggaren@apple.com>
 
-        Alas the "optimisation" used by the syntax checker for validating
-        binary and unary expressions was too aggressive: we do actually need
-        a stack for operations and operands although it needn't be as complete
-        as that used for the full AST builder.
+        Try to fix the Windows build.
 
-        Also disallow assignment to arguments in all cases as allowing arguments
-        to be assignable is always an error in strict mode, regardless of context.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Who likes export files? I do!
 
-        * parser/ASTBuilder.h:
-        (JSC::ASTBuilder::BinaryExprContext::BinaryExprContext):
-        (JSC::ASTBuilder::UnaryExprContext::UnaryExprContext):
-        * parser/JSParser.cpp:
-        (JSC::JSParser::parseAssignmentExpression):
-        (JSC::JSParser::parseBinaryExpression):
-        (JSC::JSParser::parseUnaryExpression):
-        * parser/SyntaxChecker.h:
-        (JSC::SyntaxChecker::BinaryExprContext::BinaryExprContext):
-        (JSC::SyntaxChecker::BinaryExprContext::~BinaryExprContext):
-        (JSC::SyntaxChecker::UnaryExprContext::UnaryExprContext):
-        (JSC::SyntaxChecker::UnaryExprContext::~UnaryExprContext):
-        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
-        (JSC::SyntaxChecker::operatorStackPop):
-
-2011-01-15  Geoffrey Garen  <ggaren@apple.com>
+2011-04-05  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Rolled back in r75886.
-        https://bugs.webkit.org/show_bug.cgi?id=52527
-        
-        r75886 broke the GTK Linux bot because Linux was -- quite surprisingly --
-        set up to use the constants for embedded devices.
+        Introduced the concept of opaque roots, in preparation for marking the DOM with them
+        https://bugs.webkit.org/show_bug.cgi?id=57903
 
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::maybeModifyVMPoolSize): Separated Linux constants from embedded
-        constants.
+        * JavaScriptCore.exp: Who likes export files? I do!
 
-2011-01-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+        * collector/handles/HandleHeap.cpp:
+        (JSC::isValidWeakHandle): Factored out a helper function for ASSERTs.
 
-        Unreviewed, rolling out r75886.
-        http://trac.webkit.org/changeset/75886
-        https://bugs.webkit.org/show_bug.cgi?id=52526
+        (JSC::WeakHandleOwner::~WeakHandleOwner): Moved from header to avoid
+        weak linkage problems.
 
-        "Broke GTK+ 64bit" (Requested by xan_ on #webkit).
+        (JSC::WeakHandleOwner::isReachableFromOpaqueRoots): New callback.
+        Currently unused.
 
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::WeakHandleOwner::finalize): Switched from pure virtual to a
+        default empty implementation, since not all clients necessarily want
+        or need non-trivial finalizers.
 
-2011-01-15  Geoffrey Garen  <ggaren@apple.com>
+        (JSC::HandleHeap::markWeakHandles): Split updateWeakHandles into two
+        passes. The first pass marks all reachable weak handles. The second pass
+        finalizes all unreachable weak handles. This must be two passes because
+        we don't know the set of finalizable weak handles until we're done
+        marking all weak handles.
 
-        Reviewed by Sam Weinig.
-
-        <rdar://problem/8870429> Shrink the executable pool on embedded devices
-
-        * jit/ExecutableAllocatorFixedVMPool.cpp: Dropped the pool size from 32MB
-        to 16MB.
-
-2011-01-15  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Incorrect behavior changing attributes of an accessor
-        https://bugs.webkit.org/show_bug.cgi?id=52515
-
-        defineProperty doesn't correctly handle changing attributes of an accessor
-        property.  This is because we don't pass the full descriptor to the 
-        putDescriptor helper function, which means we have insufficient information
-        to do the right thing. Once that's passed the correct behavior is relatively
-        simple to implement.
+        (JSC::HandleHeap::finalizeWeakHandles): Use new helper function.
 
-        * runtime/JSObject.cpp:
-        (JSC::putDescriptor):
-        (JSC::JSObject::defineOwnProperty):
+        * collector/handles/HandleHeap.h: Ditto.
 
-2011-01-14  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        [jsfunfuzz] Incorrect handling of consecutive duplicate labels
-        https://bugs.webkit.org/show_bug.cgi?id=52505
-
-        Compare StringImpl*'s instead of Identifier*'s when looking for duplicate
-        labels.
-
-        * parser/JSParser.cpp:
-        (JSC::JSParser::parseExpressionOrLabelStatement):
-
-2011-01-14  Simon Fraser  <simon.fraser@apple.com>
-
-        No review.
-        
-        Initialize m_operationInProgress after r75855.
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::Heap):
-
-2011-01-14  Geoffrey Garen  <ggaren@apple.com>
-
-        Reverted accidentally committed code from my last checkin.
-
-        * runtime/Heap.cpp:
+        * runtime/Heap.cpp: 
+        (JSC::Heap::destroy):
         (JSC::Heap::markRoots):
+        (JSC::Heap::reset): Split out handle marking from handle finalization.
 
-2011-01-14  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Try to fix the GTK bot.
+        * runtime/MarkStack.cpp:
+        (JSC::MarkStack::reset):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::addOpaqueRoot):
+        (JSC::MarkStack::containsOpaqueRoot):
+        (JSC::MarkStack::opaqueRootCount):
+        (JSC::HeapRootMarker::markStack): New helper functions for managing the
+        set of opaque roots.
 
-        * runtime/Heap.cpp:
-        (JSC::Heap::Heap):
-        (JSC::Heap::markRoots): Kids, remember to initialize your data members.
-        Knowing is half the battle.
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::finalize): Renamed to match parent class declaration.
 
-2011-01-14  Oliver Hunt  <oliver@apple.com>
+2011-04-05  Balazs Kelemen  <kbalazs@webkit.org>
 
-        Reviewed by Stephanie Lewis.
+        Reviewed by Darin Adler.
 
-        [jsfunfuzz] We should be clearing the lexers temporary character buffers when switching to strict mode
-        https://bugs.webkit.org/show_bug.cgi?id=52501
+        Build fix for YarrParser.h
+        https://bugs.webkit.org/show_bug.cgi?id=57822
 
-        Clear the temporary character buffers used for reading escaped characters and
-        numbers.
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
 
-        * parser/Lexer.h:
-        (JSC::Lexer::setOffset):
+2011-04-05  Steve Falkenburg  <sfalken@apple.com>
 
-2011-01-14  Geoffrey Garen  <ggaren@apple.com>
+        Follow-up Windows build fix.
+        Don't skip react-to-vsprops-changes.py for all production builds,
+        only those initiated via JavaScriptCore.make.
 
-        Try to fix non-Dtrace builds: #include Tracing.h instead of TracingDtrace.h.
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
 
-        * runtime/Heap.cpp:
+2011-04-05  Oliver Hunt  <oliver@apple.com>
 
-2011-01-13  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Oliver Hunt.
+        REGRESSION (r82849): 85,000+ JSC-related leaks seen on SnowLeopard Intel Leaks
+        https://bugs.webkit.org/show_bug.cgi?id=57857
 
-        Split out a MarkedSpace strategy object from Heap.
-        https://bugs.webkit.org/show_bug.cgi?id=52421
-        
-        SunSpider reports no change.
+        Whoops, accidentally removed a deref().
 
-        * Android.mk:
-        * CMakeLists.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj: Updated our 7 build systems. Which is cool.
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
 
-        * runtime/Heap.cpp:
-        (JSC::Heap::Heap):
-        (JSC::Heap::destroy):
-        (JSC::Heap::recordExtraCost):
-        (JSC::Heap::allocate):
-        (JSC::Heap::markConservatively):
-        (JSC::Heap::markRoots):
-        (JSC::Heap::objectCount):
-        (JSC::Heap::statistics):
-        (JSC::Heap::size):
-        (JSC::Heap::isBusy):
-        (JSC::Heap::collectAllGarbage):
-        (JSC::Heap::primaryHeapBegin):
-        (JSC::Heap::primaryHeapEnd):
-        * runtime/Heap.h:
-        (JSC::Heap::globalData):
-        (JSC::Heap::markedSpace):
-        (JSC::Heap::isCellMarked):
-        (JSC::Heap::checkMarkCell):
-        (JSC::Heap::markCell): Moved all code pertaining to managing chunks of
-        collector memory out of this class. Heap now just delegates to MarkedSpace.
+2011-04-05  Steve Falkenburg  <sfalken@apple.com>
 
-        * runtime/JSCell.h:
-        (JSC::JSCell::Heap::heap): Updated for MarkedSpace delegation.
+        Windows build fix.
 
-        * runtime/JSValue.h: Moved the ValueStringPair typedef to help with #includes.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Add per-configuration vsprops files.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops: Removed inheritance from common.vsprops.
+        Set production environment variable before calling make.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops: Added.
 
-        * runtime/MarkedSpace.cpp: Copied from runtime/Heap.cpp.
-        (JSC::MarkedSpace::MarkedSpace):
-        (JSC::MarkedSpace::destroy):
-        (JSC::MarkedSpace::allocateBlock):
-        (JSC::MarkedSpace::freeBlock):
-        (JSC::MarkedSpace::allocate):
-        (JSC::MarkedSpace::resizeBlocks):
-        (JSC::MarkedSpace::growBlocks):
-        (JSC::MarkedSpace::shrinkBlocks):
-        (JSC::MarkedSpace::markConservatively):
-        (JSC::MarkedSpace::clearMarkBits):
-        (JSC::MarkedSpace::markedCells):
-        (JSC::MarkedSpace::sweep):
-        (JSC::MarkedSpace::objectCount):
-        (JSC::MarkedSpace::addToStatistics):
-        (JSC::MarkedSpace::statistics):
-        (JSC::MarkedSpace::size):
-        (JSC::MarkedSpace::reset):
-        (JSC::MarkedSpace::primaryHeapBegin):
-        (JSC::MarkedSpace::primaryHeapEnd):
-        * runtime/MarkedSpace.h: Copied from runtime/Heap.h.
-        (JSC::MarkedSpace::globalData):
-        (JSC::MarkedSpace::didShrink):
-        (JSC::MarkedSpace::cellBlock):
-        (JSC::MarkedSpace::cellOffset):
-        (JSC::MarkedSpace::isCellMarked):
-        (JSC::MarkedSpace::checkMarkCell):
-        (JSC::MarkedSpace::markCell): Moved all code pertaining to managing chunks of
-        collector memory into this class.
-
-        * runtime/MemoryStatistics.cpp:
-        (JSC::heapStatistics):
-        * runtime/MemoryStatistics.h: Updated for MarkedSpace delegation.
-
-2011-01-14  Oliver Hunt  <oliver@apple.com>
+2011-04-05  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Gavin Barraclough.
 
-        [jsfunfuzz] parser doesn't enforce continue restrictions correctly.
-        https://bugs.webkit.org/show_bug.cgi?id=52493
-
-        This patch reworks handling of break, continue and label statements
-        to correctly handle all the valid and invalid cases.  Previously certain
-        errors would be missed by the parser in strict mode, but the bytecode 
-        generator needed to handle those cases for non-strict code so nothing
-        failed, it simply became non-standard behaviour.
+        Make caches window show more info about non-jsobject GC values
+        https://bugs.webkit.org/show_bug.cgi?id=57874
 
-        Now that we treat break and continue errors as early faults in non-strict
-        mode as well that safety net has been removed so the parser bugs result in
-        crashes at codegen time.
+        Add ClassInfo to the various internal JS types that currently
+        don't have any, and make the text for caches window show the
+        classname for non-JSObject instances.
 
-        * parser/JSParser.cpp:
-        (JSC::JSParser::ScopeLabelInfo::ScopeLabelInfo):
-        (JSC::JSParser::next):
-        (JSC::JSParser::nextTokenIsColon):
-        (JSC::JSParser::continueIsValid):
-            Continue is only valid in loops so we can't use breakIsValid()
-        (JSC::JSParser::pushLabel):
-            We now track whether the label is for a loop (and is therefore a
-            valid target for continue.
-        (JSC::JSParser::popLabel):
-        (JSC::JSParser::getLabel):
-            Replace hasLabel with getLabel so that we can validate the target
-            when parsing continue statements.
-        (JSC::JSParser::Scope::continueIsValid):
-        (JSC::JSParser::Scope::pushLabel):
-        (JSC::JSParser::Scope::getLabel):
-        (JSC::JSParser::JSParser):
-        (JSC::JSParser::parseBreakStatement):
-        (JSC::JSParser::parseContinueStatement):
-        (JSC::LabelInfo::LabelInfo):
-        (JSC::JSParser::parseExpressionOrLabelStatement):
-            Consecutive labels now get handled iteratively so that we can determine
-            whether they're valid targets for continue.
-        * parser/Lexer.cpp:
-        (JSC::Lexer::nextTokenIsColon):
-        * parser/Lexer.h:
-        (JSC::Lexer::setOffset):
-
-2011-01-14  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        Use the Windows thread pool instead of an extra thread for FastMalloc scavenging
-        https://bugs.webkit.org/show_bug.cgi?id=45186
-
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_PageHeap::scheduleScavenger): Added missing this pointer to CreateTimerQueueTimer().
-
-2011-01-14  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        Use the Windows thread pool instead of an extra thread for FastMalloc scavenging
-        https://bugs.webkit.org/show_bug.cgi?id=45186
-
-        r75819 accidentally changed the initial state of the scavenge timer.
-
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_PageHeap::initializeScavenger): Changed initial state of m_scavengingSuspended to true.
-
-2011-01-14  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed Windows Release build fix.
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::createStructure):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/Heap.cpp:
+        (JSC::TypeCounter::typeName):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/ScopeChain.cpp:
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::createStructure):
+        * runtime/StructureChain.cpp:
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::createStructure):
 
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_PageHeap::scavengerTimerFired):
+2011-04-05  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-2011-01-14  Patrick Gansterer  <paroga@webkit.org>
+        Reviewed by Andreas Kling.
 
-        Unreviewed Windows Release build fix.
+        Cleanup StringConcatenate
+        https://bugs.webkit.org/show_bug.cgi?id=57836
 
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_PageHeap::scavengerTimerFired):
+        Don't use PassRefPtr in local variables, properly store in RefPtrs and release on return.
+        Add a makeString() variant taking 9 arguments, needed by a follow-up patch.
 
-2011-01-14  Patrick Gansterer  <paroga@webkit.org>
+        * wtf/text/StringConcatenate.h:
+        (WTF::tryMakeString):
+        (WTF::makeString):
 
-        Reviewed by Adam Roben.
+2011-04-04  Sheriff Bot  <webkit.review.bot@gmail.com>
 
-        Use the Windows thread pool instead of an extra thread for FastMalloc scavenging
-        https://bugs.webkit.org/show_bug.cgi?id=45186
+        Unreviewed, rolling out r82876.
+        http://trac.webkit.org/changeset/82876
+        https://bugs.webkit.org/show_bug.cgi?id=57816
 
-        Use CreateTimerQueueTimer() to start periodicScavenge() and stop it with DeleteTimerQueueTimer().
+        Caused a lot of test crashes (Requested by tkent on #webkit).
 
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
         * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_PageHeap::initializeScavenger):
+        (WTF::tryFastMalloc):
+        (WTF::fastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::fastCalloc):
+        (WTF::fastFree):
+        (WTF::tryFastRealloc):
+        (WTF::fastRealloc):
+        (WTF::fastMallocSize):
         (WTF::TCMalloc_PageHeap::isScavengerSuspended):
         (WTF::TCMalloc_PageHeap::scheduleScavenger):
-        (WTF::TCMalloc_PageHeap::rescheduleScavenger):
         (WTF::TCMalloc_PageHeap::suspendScavenger):
-        (WTF::scavengerTimerFired):
-        (WTF::TCMalloc_PageHeap::periodicScavenge):
         (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMallocStats::malloc):
+        (WTF::TCMallocStats::free):
+        (WTF::TCMallocStats::fastCalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::calloc):
+        (WTF::TCMallocStats::fastRealloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        (WTF::TCMallocStats::realloc):
+        (WTF::TCMallocStats::fastMallocSize):
+        * wtf/FastMalloc.h:
+        (WTF::Internal::fastMallocMatchValidationType):
+        (WTF::Internal::fastMallocMatchValidationValue):
+        (WTF::Internal::setFastMallocMatchValidationType):
+        (WTF::fastMallocMatchValidateFree):
+        * wtf/Platform.h:
 
-2011-01-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        Align import/export directives
-        https://bugs.webkit.org/show_bug.cgi?id=52208
-
-        * API/JSBase.h: Align import/export directives with
-        WebKit2/Shared/API/c/WKBase.h
-
-2011-01-14  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Incorrect backtracking for nested alternatives
-        https://bugs.webkit.org/show_bug.cgi?id=52387
-
-        In the process of propigating a datalabel it wasn't getting connected
-        to a destination when the destination was an indirect jump.  Added
-        code to recognize a direct backtrack destination that was an indirect
-        jump and added mechanism to associate DataLabelPtrs with indirect
-        jump entries.
-        Removed dead method
-        BacktrackDestination::linkDataLabelToHereIfExists()
-
-        * yarr/YarrJIT.cpp:
-        (JSC::Yarr::YarrGenerator::IndirectJumpEntry::IndirectJumpEntry):
-        (JSC::Yarr::YarrGenerator::IndirectJumpEntry::addDataLabel):
-        (JSC::Yarr::YarrGenerator::GenerationState::addIndirectJumpEntry):
-        (JSC::Yarr::YarrGenerator::GenerationState::emitIndirectJumpTable):
-        Changes to link indirect jumps with DataLabelPtr's.
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::clearSubDataLabelPtr):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists): 
-        Updated to handle immediate linking of indirect jumps to
-        DataLabelPtr.
-        (JSC::Yarr::YarrGenerator::generateParenthesesDisjunction): Changed to
-        reflect updated linkDataLabelToBacktrackIfExists().
-
-2011-01-14  Pavel Podivilov  <podivilov@chromium.org>
-
-        Reviewed by Yury Semikhatsky.
-
-        Web Inspector: provide script column offset to frontend.
-        https://bugs.webkit.org/show_bug.cgi?id=52377
-
-        * parser/SourceCode.h:
-        (JSC::SourceCode::SourceCode):
-        (JSC::SourceCode::firstColumn):
-
-2011-01-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        <rdar://problem/5469576> Use __PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0 if available.
-
-        * DerivedSources.make: Create a header file, HeaderDetection.h, that tells
-        us whether pthread_machdep.h is available.
-        * wtf/FastMalloc.cpp: If __PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0 is available, then
-        don't do the pthread_getspecific_function_pointer trick.
-        (WTF::setThreadHeap): Ditto, but set thread-specific data.
-        (WTF::TCMalloc_ThreadCache::GetThreadHeap): Ditto, but get rather than set.
-
-2011-01-13  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gavin Barraclough.
-
-        JIT requires VM overcommit (particularly on x86-64), Linux does not by default support this without swap?
-        https://bugs.webkit.org/show_bug.cgi?id=42756
-
-        The FixedVMPool Allocator does not work well on systems where
-        allocating very large amounts of memory upfront is not reasonable,
-        like Linux without overcommit enabled. As a workaround, on Linux,
-        default to the values used in embedded environments (in the MB
-        range), and only jump to the GB range if we detect at runtime that
-        overcommit is enabled. Should fix crashes on Linux/x86_64 with
-        less than 3 or 4GB of RAM.
-
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::free): use new variables for VM pool
-        size and coalesce limit.
-        (JSC::ExecutableAllocator::isValid): swap the variables from
-        embedded to generic values at runtime, on linux, if overcommit is
-        enabled.
-        (JSC::ExecutableAllocator::underMemoryPressure): use new variables
-        for VM pool size and coalesce limit.
-
-2011-01-12  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Martin Robinson.
-
-        Add new Yarr.h header to the list file.
-
-        * GNUmakefile.am: ditto.
-
-2011-01-12  Martin Robinson  <mrobinson@igalia.com>
-
-        Missing Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h in WebKitGtk tarball
-        https://bugs.webkit.org/show_bug.cgi?id=52299
-
-        * GNUmakefile.am: Fix the GTK+ build on ARMv7 by including missing source
-        files in the source list.
+2011-04-04  Oliver Hunt  <oliver@apple.com>
 
-2011-01-12  Peter Varga  <pvarga@webkit.org>
+        Reviewed by Antti Koivisto.
 
-        Reviewed by Gavin Barraclough.
+        Stop JSCell.h from including Structure.h
+        https://bugs.webkit.org/show_bug.cgi?id=57809
 
-        Add Yarr.h to YARR
-        https://bugs.webkit.org/show_bug.cgi?id=51021
+        * runtime/GetterSetter.h:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toThisObject):
+        * runtime/JSString.h:
+        * runtime/ScopeChain.h:
+        * runtime/Structure.h:
+        (JSC::JSCell::isObject):
+        (JSC::JSCell::isString):
+        (JSC::JSCell::classInfo):
+        (JSC::JSCell::createDummyStructure):
+        (JSC::JSValue::needsThisConversion):
+        (JSC::MarkStack::internalAppend):
+        * runtime/StructureChain.h:
 
-        Move other common constants and functions from YARR's different files
-        to Yarr.h.
-        Use Yarr.h header instead of including other YARR headers where it
-        is possible.
+2011-04-04  Oliver Hunt  <oliver@apple.com>
 
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/RegExp.cpp:
-        * yarr/Yarr.h: Added.
-        * yarr/YarrInterpreter.cpp:
-        * yarr/YarrInterpreter.h:
-        * yarr/YarrJIT.cpp:
-        (JSC::Yarr::jitCompile):
-        (JSC::Yarr::execute):
-        * yarr/YarrJIT.h:
-        * yarr/YarrParser.h:
-        * yarr/YarrPattern.cpp:
-        (JSC::Yarr::YarrPattern::compile):
-        (JSC::Yarr::YarrPattern::YarrPattern):
-        * yarr/YarrPattern.h:
+        Fix clang build.
 
-2011-01-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+        (WTF::fastRealloc):
 
-        Unreviewed, rolling out r75595.
-        http://trac.webkit.org/changeset/75595
-        https://bugs.webkit.org/show_bug.cgi?id=52286
+2011-04-04  Oliver Hunt  <oliver@apple.com>
 
-        It broke fast/regex/pcre-test-1.html (Requested by Ossy on
-        #webkit).
+        Remove accidental change to Platform.h
 
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/RegExp.cpp:
-        * yarr/Yarr.h: Removed.
-        * yarr/YarrInterpreter.cpp:
-        * yarr/YarrInterpreter.h:
-        * yarr/YarrJIT.cpp:
-        (JSC::Yarr::jitCompile):
-        * yarr/YarrJIT.h:
-        (JSC::Yarr::execute):
-        * yarr/YarrParser.h:
-        * yarr/YarrPattern.cpp:
-        (JSC::Yarr::compile):
-        (JSC::Yarr::YarrPattern::YarrPattern):
-        * yarr/YarrPattern.h:
+        * wtf/Platform.h:
 
-2011-01-12  Peter Varga  <pvarga@webkit.org>
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Gavin Barraclough.
+        Reviewed by Oliver Hunt.
 
-        Add Yarr.h to YARR
-        https://bugs.webkit.org/show_bug.cgi?id=51021
+        Fixed a weak-handle-related leak in RegisterFile
+        https://bugs.webkit.org/show_bug.cgi?id=57793
 
-        Move other common constants and functions from YARR's different files
-        to Yarr.h.
-        Use Yarr.h header instead of including other YARR headers where it
-        is possible.
+        * interpreter/RegisterFile.cpp: Nixed leaky GlobalObjectNotifier.
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::GlobalObjectOwner::finalize):
+        (JSC::RegisterFile::RegisterFile): Replaced GlobalObjectNotifier with
+        a per-RegisterFile weak handle owner, which does not leak.
 
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/RegExp.cpp:
-        * yarr/Yarr.h: Added.
-        * yarr/YarrInterpreter.cpp:
-        * yarr/YarrInterpreter.h:
-        * yarr/YarrJIT.cpp:
-        (JSC::Yarr::jitCompile):
-        (JSC::Yarr::execute):
-        * yarr/YarrJIT.h:
-        * yarr/YarrParser.h:
-        * yarr/YarrPattern.cpp:
-        (JSC::Yarr::YarrPattern::compile):
-        (JSC::Yarr::YarrPattern::YarrPattern):
-        * yarr/YarrPattern.h:
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::set): Allow set() to take a context argument, since
+        RegisterFile now needs this. (Seems like it was an accidental omission
+        all along.)
 
-2011-01-11  Michael Saboff  <msaboff@apple.com>
+2011-04-04  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Geoffrey Garen.
 
-        Missing call to popTempSortVector() for exception case in JSArray::sort.
-        https://bugs.webkit.org/show_bug.cgi?id=50718
-
-        Fix to patch of 50718 that added pushTempSortVector() and 
-        popTempSortVector() to JSArray::sort() to mark elements during sort.
-        Need to add popTempSortVector() for the return case if toString()
-        had an exception.
-
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::sort): Added popTempSortVector()
-
-2011-01-11  Xan Lopez  <xlopez@igalia.com>
+        Make malloc validation useful
+        https://bugs.webkit.org/show_bug.cgi?id=57502
 
-        Reviewed by Darin Adler.
+        This patch changes FAST_MALLOC_MATCH_VALIDATION with a general
+        corruption check that tags the beginning and end of all allocations
+        to check for write overflows and overwrites the contents of
+        memory on free in order to (hopefully) show up use-after-free issues
+        sooner.
 
-        Microoptimization in ~JSString
-        https://bugs.webkit.org/show_bug.cgi?id=52222
+        We also turn it on by default for debug builds.
 
-        The case where m_fibers is 0 seems to be the most common one
-        (almost 1/2 of the time, followed at some distance by m_fibers = 1
-        in 1/4 of the cases in a typical SunSpider execution). We can save
-        one comparison in this common case by doing a bit of refactoring
-        in the JSString destructor; overall a 0.3% progression, but only
-        the string tests show improvement.
+        * JavaScriptCore.exp:
+        * wtf/FastMalloc.cpp:
+        (WTF::tryFastMalloc):
+        (WTF::fastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::fastCalloc):
+        (WTF::fastFree):
+        (WTF::tryFastRealloc):
+        (WTF::fastRealloc):
+        (WTF::TCMalloc_PageHeap::isScavengerSuspended):
+        (WTF::TCMalloc_PageHeap::scheduleScavenger):
+        (WTF::TCMalloc_PageHeap::suspendScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMallocStats::malloc):
+        (WTF::TCMallocStats::free):
+        (WTF::TCMallocStats::fastCalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::calloc):
+        (WTF::TCMallocStats::fastRealloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        (WTF::TCMallocStats::realloc):
+        * wtf/FastMalloc.h:
+        (WTF::Internal::fastMallocValidationHeader):
+        (WTF::Internal::fastMallocValidationSuffix):
+        (WTF::Internal::fastMallocMatchValidationType):
+        (WTF::Internal::setFastMallocMatchValidationType):
+        (WTF::fastMallocMatchValidateFree):
+        (WTF::fastMallocValidate):
+        * wtf/Platform.h:
 
-        * runtime/JSString.h:
-        (JSC::RopeBuilder::~JSString):
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
 
-2011-01-10  Michael Saboff  <msaboff@apple.com>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Geoffrey Garen.
+        Renamed clearWeakPointers => updateWeakHandles and removed misleading comment
+        https://bugs.webkit.org/show_bug.cgi?id=57790
 
-        ASSERTION Failure in JSC::binaryChop
-        https://bugs.webkit.org/show_bug.cgi?id=25614
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::updateWeakHandles): Updated for rename.
 
-        Changed JITStubs::cti_register_file_check() to use the current stack's
-        return PC to find the bytecode for handling the exception in the prior
-        frame.  Also added the appropriate arrity check routine call to the
-        JIT to bytecode vector (m_callReturnIndexVector) in the CodeBlock.
+        * collector/handles/HandleHeap.h: Removed comment claiming that this
+        function should only be called during teardown, because it's actually
+        called after every GC pass.
 
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile): Changed the arrity check call location
-        so that it gets added to the m_calls list so that it's included in
-        CodeBlock::m_callReturnIndexVector.
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION): Use the current call frame's return PC.
+        * runtime/Heap.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots): Updated for rename.
 
-2011-01-10  Daniel Bates  <dbates@rim.com>
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Martin Robinson.
+        Reviewed by Oliver Hunt.
 
-        Remove extraneous COMPILER(GCC) condition when checking GCC_VERSION_AT_LEAST()
-        https://bugs.webkit.org/show_bug.cgi?id=52178
+        Standardized handling of handles for immediate values
+        https://bugs.webkit.org/show_bug.cgi?id=57788
 
-        It is sufficient to test GCC_VERSION_AT_LEAST() instead of both COMPILER(GCC) and
-        GCC_VERSION_AT_LEAST(). Notice GCC_VERSION_AT_LEAST() is defined to be 0 when we
-        are not compiling with GCC.
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::clearWeakPointers): Don't check for null or non-cell
+        values here, because our write barrier guarantees that such values are
+        not in the weak list.
 
-        Fixes style issues at the callsites (i.e. replace comma with comma-space in
-        macro function argument list). Also, makes a spelling correction in a comment.
+        (JSC::HandleHeap::writeBarrier): Standardized on checking for null before
+        checking for cell, and on using early return instead of if/else.
 
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutableAllocator::cacheFlush):
-        * wtf/Platform.h:
+        * collector/handles/HandleHeap.h:
+        (JSC::HandleHeap::deallocate):
+        (JSC::HandleHeap::makeWeak): Ditto.
 
-2011-01-10  Geoffrey Garen  <ggaren@apple.com>
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
 
-        Build fix: removed some uses of nextNumber that I missed last time.
-
-        * runtime/Heap.cpp:
-        (JSC::Heap::reset):
-        (JSC::Heap::collectAllGarbage):
+        Not reviewed.
 
-2011-01-10  Daniel Bates  <dbates@rim.com>
+        Removed a redundant variable from HandleHeap
+        https://bugs.webkit.org/show_bug.cgi?id=57786
+        
+        Forgot to commit the file that actually removes the data member!
+        
+        * collector/handles/HandleHeap.h:
 
-        Reviewed by Darin Adler.
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
 
-        Use __builtin_expect when compiling using RVCT in GNU mode
-        https://bugs.webkit.org/show_bug.cgi?id=51866
+        Reviewed by Oliver Hunt.
 
-        We should only use __builtin_expect if we are compiling with GCC or RVCT 3 or higher in GNU mode
-        as pointed out by Siddharth Mathur per <http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0202h/Cjabddedbde.html>.
+        Removed a redundant variable from HandleHeap
+        https://bugs.webkit.org/show_bug.cgi?id=57786
+        
+        We don't need a specific variable to indicate that we're in the middle
+        of the finalization phase, since m_nextToFinalize already does this.
 
-        * wtf/AlwaysInline.h:
-        * wtf/Platform.h: Removed define WTF_COMPILER_RVCT4_OR_GREATER. Instead added macro
-        function RVCT_VERSION_AT_LEAST so that we can test for an arbitrary minimum RVCT
-        version.
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::HandleHeap):
+        (JSC::HandleHeap::clearWeakPointers):
+        (JSC::HandleHeap::writeBarrier):
 
-2011-01-10  Geoffrey Garen  <ggaren@apple.com>
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Moved Collector.* => Heap.*, since the file contains a class named "Heap".
-
-        * API/JSCallbackObject.cpp:
-        * Android.mk:
-        * CMakeLists.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * interpreter/Interpreter.cpp:
+        Renamed Finalizer => WeakHandleOwner (in preparation for adding a reachability callback)
+        https://bugs.webkit.org/show_bug.cgi?id=57775
+        
+        Also renamed noFinalizer => emptyWeakOwner, since this is really an
+        optimization for a weak owner with empty callbacks.
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::clearWeakPointers): Updated for renames. Removed
+        redundant initialization of m_nextToFinalize. Moved deletion check inside
+        weak owner check, since the weak owner can't delete the node if there is
+        no weak owner!
+
+        * collector/handles/HandleHeap.h:
+        (JSC::WeakHandleOwner::~WeakHandleOwner):
+        (JSC::HandleHeap::makeWeak): Updated for renames.
+
+        (JSC::HandleHeap::hasWeakOwner): Changed getFinalizer to hasWeakOwner,
+        to clarify this function's role in assertions.
+
+        (JSC::HandleHeap::Node::Node):
+        (JSC::HandleHeap::Node::makeWeak):
+        (JSC::HandleHeap::Node::isWeak):
+        (JSC::HandleHeap::Node::weakOwner):
+        (JSC::HandleHeap::Node::weakOwnerContext):
+        (JSC::HandleHeap::Node::emptyWeakOwner):
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::globalObjectCollectedNotifier):
         * interpreter/RegisterFile.h:
-        * jit/JITStubs.cpp:
-        * runtime/Collector.cpp: Removed.
-        * runtime/Collector.h: Removed.
-        * runtime/CollectorHeapIterator.h:
-        * runtime/GCActivityCallbackCF.cpp:
-        * runtime/Heap.cpp: Copied from JavaScriptCore/runtime/Collector.cpp.
-        * runtime/Heap.h: Copied from JavaScriptCore/runtime/Collector.h.
-        * runtime/InitializeThreading.cpp:
-        * runtime/JSCell.h:
-        * runtime/JSGlobalData.cpp:
-        * runtime/JSGlobalData.h:
-        * runtime/JSLock.cpp:
-        * runtime/JSNumberCell.h:
-        * runtime/MachineStackMarker.cpp:
-        * runtime/MemoryStatistics.h:
-        * runtime/Protect.h:
-        * runtime/UString.cpp:
         * runtime/WeakGCMap.h:
         * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::set): Updated for renames.
 
-2011-01-10  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Remove unused isString() case in JSString::toPrimitiveString()
-        https://bugs.webkit.org/show_bug.cgi?id=52167
-
-        We never call toPrimitiveString() with strings, so remove the
-        check and add an ASSERT ensuring this never happens. 0.7% overall
-        progression in sunspider, since one of the call sites is very hot.
-
-        * runtime/JSString.h:
-        (JSC::JSValue::toPrimitiveString):
-
-2011-01-10  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Gavin Barraclough.
-
-        Rename the existing YARR files and classes
-        https://bugs.webkit.org/show_bug.cgi?id=51872
-
-        Replace the "Regex" prefix with "Yarr" in the name of YARR files and classes.
-
-        * Android.mk:
-        * CMakeLists.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::compile):
-        (JSC::RegExp::match):
-        (JSC::RegExp::printTraceData):
-        * yarr/YarrInterpreter.cpp: Renamed from Source/JavaScriptCore/yarr/RegexInterpreter.cpp.
-        (JSC::Yarr::Interpreter::appendParenthesesDisjunctionContext):
-        (JSC::Yarr::Interpreter::popParenthesesDisjunctionContext):
-        (JSC::Yarr::Interpreter::DisjunctionContext::DisjunctionContext):
-        (JSC::Yarr::Interpreter::DisjunctionContext::operator new):
-        (JSC::Yarr::Interpreter::allocDisjunctionContext):
-        (JSC::Yarr::Interpreter::freeDisjunctionContext):
-        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
-        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::operator new):
-        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::restoreOutput):
-        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::getDisjunctionContext):
-        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
-        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
-        (JSC::Yarr::Interpreter::InputStream::InputStream):
-        (JSC::Yarr::Interpreter::InputStream::next):
-        (JSC::Yarr::Interpreter::InputStream::rewind):
-        (JSC::Yarr::Interpreter::InputStream::read):
-        (JSC::Yarr::Interpreter::InputStream::readPair):
-        (JSC::Yarr::Interpreter::InputStream::readChecked):
-        (JSC::Yarr::Interpreter::InputStream::reread):
-        (JSC::Yarr::Interpreter::InputStream::prev):
-        (JSC::Yarr::Interpreter::InputStream::getPos):
-        (JSC::Yarr::Interpreter::InputStream::setPos):
-        (JSC::Yarr::Interpreter::InputStream::atStart):
-        (JSC::Yarr::Interpreter::InputStream::atEnd):
-        (JSC::Yarr::Interpreter::InputStream::checkInput):
-        (JSC::Yarr::Interpreter::InputStream::uncheckInput):
-        (JSC::Yarr::Interpreter::InputStream::isNotAvailableInput):
-        (JSC::Yarr::Interpreter::testCharacterClass):
-        (JSC::Yarr::Interpreter::checkCharacter):
-        (JSC::Yarr::Interpreter::checkCasedCharacter):
-        (JSC::Yarr::Interpreter::checkCharacterClass):
-        (JSC::Yarr::Interpreter::tryConsumeBackReference):
-        (JSC::Yarr::Interpreter::matchAssertionBOL):
-        (JSC::Yarr::Interpreter::matchAssertionEOL):
-        (JSC::Yarr::Interpreter::matchAssertionWordBoundary):
-        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
-        (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
-        (JSC::Yarr::Interpreter::matchCharacterClass):
-        (JSC::Yarr::Interpreter::backtrackCharacterClass):
-        (JSC::Yarr::Interpreter::matchBackReference):
-        (JSC::Yarr::Interpreter::backtrackBackReference):
-        (JSC::Yarr::Interpreter::recordParenthesesMatch):
-        (JSC::Yarr::Interpreter::resetMatches):
-        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
-        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
-        (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
-        (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
-        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
-        (JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
-        (JSC::Yarr::Interpreter::matchParenthesesTerminalEnd):
-        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
-        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalEnd):
-        (JSC::Yarr::Interpreter::matchParentheticalAssertionBegin):
-        (JSC::Yarr::Interpreter::matchParentheticalAssertionEnd):
-        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin):
-        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionEnd):
-        (JSC::Yarr::Interpreter::matchParentheses):
-        (JSC::Yarr::Interpreter::backtrackParentheses):
-        (JSC::Yarr::Interpreter::lookupForBeginChars):
-        (JSC::Yarr::Interpreter::matchDisjunction):
-        (JSC::Yarr::Interpreter::matchNonZeroDisjunction):
-        (JSC::Yarr::Interpreter::interpret):
-        (JSC::Yarr::Interpreter::Interpreter):
-        (JSC::Yarr::ByteCompiler::ParenthesesStackEntry::ParenthesesStackEntry):
-        (JSC::Yarr::ByteCompiler::ByteCompiler):
-        (JSC::Yarr::ByteCompiler::compile):
-        (JSC::Yarr::ByteCompiler::checkInput):
-        (JSC::Yarr::ByteCompiler::assertionBOL):
-        (JSC::Yarr::ByteCompiler::assertionEOL):
-        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
-        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
-        (JSC::Yarr::ByteCompiler::atomCharacterClass):
-        (JSC::Yarr::ByteCompiler::atomBackReference):
-        (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
-        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
-        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
-        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
-        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
-        (JSC::Yarr::ByteCompiler::popParenthesesStack):
-        (JSC::Yarr::ByteCompiler::dumpDisjunction):
-        (JSC::Yarr::ByteCompiler::closeAlternative):
-        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
-        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
-        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
-        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
-        (JSC::Yarr::ByteCompiler::regexBegin):
-        (JSC::Yarr::ByteCompiler::regexEnd):
-        (JSC::Yarr::ByteCompiler::alternativeBodyDisjunction):
-        (JSC::Yarr::ByteCompiler::alternativeDisjunction):
-        (JSC::Yarr::ByteCompiler::emitDisjunction):
-        (JSC::Yarr::byteCompile):
-        (JSC::Yarr::interpret):
-        * yarr/YarrInterpreter.h: Renamed from Source/JavaScriptCore/yarr/RegexInterpreter.h.
-        (JSC::Yarr::ByteTerm::ByteTerm):
-        (JSC::Yarr::ByteTerm::BOL):
-        (JSC::Yarr::ByteTerm::CheckInput):
-        (JSC::Yarr::ByteTerm::EOL):
-        (JSC::Yarr::ByteTerm::WordBoundary):
-        (JSC::Yarr::ByteTerm::BackReference):
-        (JSC::Yarr::ByteTerm::BodyAlternativeBegin):
-        (JSC::Yarr::ByteTerm::BodyAlternativeDisjunction):
-        (JSC::Yarr::ByteTerm::BodyAlternativeEnd):
-        (JSC::Yarr::ByteTerm::AlternativeBegin):
-        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
-        (JSC::Yarr::ByteTerm::AlternativeEnd):
-        (JSC::Yarr::ByteTerm::SubpatternBegin):
-        (JSC::Yarr::ByteTerm::SubpatternEnd):
-        (JSC::Yarr::ByteTerm::invert):
-        (JSC::Yarr::ByteTerm::capture):
-        (JSC::Yarr::ByteDisjunction::ByteDisjunction):
-        (JSC::Yarr::BytecodePattern::BytecodePattern):
-        (JSC::Yarr::BytecodePattern::~BytecodePattern):
-        * yarr/YarrJIT.cpp: Renamed from Source/JavaScriptCore/yarr/RegexJIT.cpp.
-        (JSC::Yarr::YarrGenerator::optimizeAlternative):
-        (JSC::Yarr::YarrGenerator::matchCharacterClassRange):
-        (JSC::Yarr::YarrGenerator::matchCharacterClass):
-        (JSC::Yarr::YarrGenerator::jumpIfNoAvailableInput):
-        (JSC::Yarr::YarrGenerator::jumpIfAvailableInput):
-        (JSC::Yarr::YarrGenerator::checkInput):
-        (JSC::Yarr::YarrGenerator::atEndOfInput):
-        (JSC::Yarr::YarrGenerator::notAtEndOfInput):
-        (JSC::Yarr::YarrGenerator::jumpIfCharEquals):
-        (JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
-        (JSC::Yarr::YarrGenerator::readCharacter):
-        (JSC::Yarr::YarrGenerator::storeToFrame):
-        (JSC::Yarr::YarrGenerator::storeToFrameWithPatch):
-        (JSC::Yarr::YarrGenerator::loadFromFrame):
-        (JSC::Yarr::YarrGenerator::loadFromFrameAndJump):
-        (JSC::Yarr::YarrGenerator::IndirectJumpEntry::IndirectJumpEntry):
-        (JSC::Yarr::YarrGenerator::IndirectJumpEntry::addJump):
-        (JSC::Yarr::YarrGenerator::AlternativeBacktrackRecord::AlternativeBacktrackRecord):
-        (JSC::Yarr::YarrGenerator::GenerationState::GenerationState):
-        (JSC::Yarr::YarrGenerator::GenerationState::addIndirectJumpEntry):
-        (JSC::Yarr::YarrGenerator::GenerationState::emitIndirectJumpTable):
-        (JSC::Yarr::YarrGenerator::GenerationState::incrementParenNestingLevel):
-        (JSC::Yarr::YarrGenerator::GenerationState::decrementParenNestingLevel):
-        (JSC::Yarr::YarrGenerator::GenerationState::addParenthesesTail):
-        (JSC::Yarr::YarrGenerator::GenerationState::emitParenthesesTail):
-        (JSC::Yarr::YarrGenerator::GenerationState::addJumpToNextInteration):
-        (JSC::Yarr::YarrGenerator::GenerationState::addJumpsToNextInteration):
-        (JSC::Yarr::YarrGenerator::GenerationState::addDataLabelToNextIteration):
-        (JSC::Yarr::YarrGenerator::GenerationState::linkToNextIteration):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::BacktrackDestination):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::clear):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::clearDataLabel):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::hasDestination):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::isStackOffset):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::isLabel):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::isJumpList):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::hasDataLabel):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::copyTarget):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::copyTo):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::addBacktrackJump):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::setStackOffset):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::setLabel):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::setNextBacktrackLabel):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::copyBacktrackToLabel):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::setBacktrackToLabel):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::setBacktrackJumpList):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::setBacktrackSourceLabel):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::setDataLabel):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::setSubDataLabelPtr):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkToNextBacktrack):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::getStackOffset):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::getLabel):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::getBacktrackJumps):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::getDataLabel):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::jumpToBacktrack):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkDataLabelToHereIfExists):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::plantJumpToBacktrackIfExists):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkAlternativeBacktracks):
-        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkAlternativeBacktracksTo):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::TermGenerationState):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::resetAlternative):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::alternativeValid):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::nextAlternative):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::alternative):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::isLastAlternative):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::resetTerm):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::termValid):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::nextTerm):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::term):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::isLastTerm):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::getSubParenNum):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::isMainDisjunction):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::setParenthesesTail):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::getParenthesesTail):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::lookaheadTerm):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::isSinglePatternCharacterLookaheadTerm):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::inputOffset):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::clearBacktrack):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::jumpToBacktrack):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::plantJumpToBacktrackIfExists):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::addBacktrackJump):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::setBacktrackDataLabel):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::setBackTrackStackOffset):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::setBacktrackLabel):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::linkAlternativeBacktracks):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::linkAlternativeBacktracksTo):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::setBacktrackLink):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::chainBacktracks):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::chainBacktrackJumps):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::getBacktrackDestination):
-        (JSC::Yarr::YarrGenerator::TermGenerationState::propagateBacktrackingFrom):
-        (JSC::Yarr::YarrGenerator::ParenthesesTail::ParenthesesTail):
-        (JSC::Yarr::YarrGenerator::ParenthesesTail::processBacktracks):
-        (JSC::Yarr::YarrGenerator::ParenthesesTail::setNextIteration):
-        (JSC::Yarr::YarrGenerator::ParenthesesTail::addAfterParenJump):
-        (JSC::Yarr::YarrGenerator::ParenthesesTail::generateCode):
-        (JSC::Yarr::YarrGenerator::generateAssertionBOL):
-        (JSC::Yarr::YarrGenerator::generateAssertionEOL):
-        (JSC::Yarr::YarrGenerator::matchAssertionWordchar):
-        (JSC::Yarr::YarrGenerator::generateAssertionWordBoundary):
-        (JSC::Yarr::YarrGenerator::generatePatternCharacterSingle):
-        (JSC::Yarr::YarrGenerator::generatePatternCharacterPair):
-        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
-        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
-        (JSC::Yarr::YarrGenerator::generatePatternCharacterNonGreedy):
-        (JSC::Yarr::YarrGenerator::generateCharacterClassSingle):
-        (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
-        (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
-        (JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
-        (JSC::Yarr::YarrGenerator::generateParenthesesDisjunction):
-        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
-        (JSC::Yarr::YarrGenerator::generateParenthesesGreedyNoBacktrack):
-        (JSC::Yarr::YarrGenerator::generateParentheticalAssertion):
-        (JSC::Yarr::YarrGenerator::generateTerm):
-        (JSC::Yarr::YarrGenerator::generateDisjunction):
-        (JSC::Yarr::YarrGenerator::generateEnter):
-        (JSC::Yarr::YarrGenerator::generateReturn):
-        (JSC::Yarr::YarrGenerator::YarrGenerator):
-        (JSC::Yarr::YarrGenerator::generate):
-        (JSC::Yarr::YarrGenerator::compile):
-        (JSC::Yarr::jitCompile):
-        * yarr/YarrJIT.h: Renamed from Source/JavaScriptCore/yarr/RegexJIT.h.
-        (JSC::Yarr::YarrCodeBlock::YarrCodeBlock):
-        (JSC::Yarr::YarrCodeBlock::~YarrCodeBlock):
-        (JSC::Yarr::YarrCodeBlock::setFallBack):
-        (JSC::Yarr::YarrCodeBlock::isFallBack):
-        (JSC::Yarr::YarrCodeBlock::set):
-        (JSC::Yarr::YarrCodeBlock::execute):
-        (JSC::Yarr::YarrCodeBlock::getAddr):
-        (JSC::Yarr::execute):
-        * yarr/YarrParser.h: Renamed from Source/JavaScriptCore/yarr/RegexParser.h.
-        (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
-        (JSC::Yarr::Parser::CharacterClassParserDelegate::begin):
-        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
-        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
-        (JSC::Yarr::Parser::CharacterClassParserDelegate::end):
-        (JSC::Yarr::Parser::CharacterClassParserDelegate::assertionWordBoundary):
-        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBackReference):
-        (JSC::Yarr::Parser::Parser):
-        (JSC::Yarr::Parser::parseEscape):
-        (JSC::Yarr::Parser::parseAtomEscape):
-        (JSC::Yarr::Parser::parseCharacterClassEscape):
-        (JSC::Yarr::Parser::parseCharacterClass):
-        (JSC::Yarr::Parser::parseParenthesesBegin):
-        (JSC::Yarr::Parser::parseParenthesesEnd):
-        (JSC::Yarr::Parser::parseQuantifier):
-        (JSC::Yarr::Parser::parseTokens):
-        (JSC::Yarr::Parser::parse):
-        (JSC::Yarr::Parser::saveState):
-        (JSC::Yarr::Parser::restoreState):
-        (JSC::Yarr::Parser::atEndOfPattern):
-        (JSC::Yarr::Parser::peek):
-        (JSC::Yarr::Parser::peekIsDigit):
-        (JSC::Yarr::Parser::peekDigit):
-        (JSC::Yarr::Parser::consume):
-        (JSC::Yarr::Parser::consumeDigit):
-        (JSC::Yarr::Parser::consumeNumber):
-        (JSC::Yarr::Parser::consumeOctal):
-        (JSC::Yarr::Parser::tryConsume):
-        (JSC::Yarr::Parser::tryConsumeHex):
-        (JSC::Yarr::parse):
-        * yarr/YarrPattern.cpp: Renamed from Source/JavaScriptCore/yarr/RegexPattern.cpp.
-        (JSC::Yarr::CharacterClassConstructor::CharacterClassConstructor):
-        (JSC::Yarr::CharacterClassConstructor::reset):
-        (JSC::Yarr::CharacterClassConstructor::append):
-        (JSC::Yarr::CharacterClassConstructor::putChar):
-        (JSC::Yarr::CharacterClassConstructor::isUnicodeUpper):
-        (JSC::Yarr::CharacterClassConstructor::isUnicodeLower):
-        (JSC::Yarr::CharacterClassConstructor::putRange):
-        (JSC::Yarr::CharacterClassConstructor::charClass):
-        (JSC::Yarr::CharacterClassConstructor::addSorted):
-        (JSC::Yarr::CharacterClassConstructor::addSortedRange):
-        (JSC::Yarr::BeginCharHelper::BeginCharHelper):
-        (JSC::Yarr::BeginCharHelper::addBeginChar):
-        (JSC::Yarr::BeginCharHelper::merge):
-        (JSC::Yarr::BeginCharHelper::addCharacter):
-        (JSC::Yarr::BeginCharHelper::linkHotTerms):
-        (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
-        (JSC::Yarr::YarrPatternConstructor::~YarrPatternConstructor):
-        (JSC::Yarr::YarrPatternConstructor::reset):
-        (JSC::Yarr::YarrPatternConstructor::assertionBOL):
-        (JSC::Yarr::YarrPatternConstructor::assertionEOL):
-        (JSC::Yarr::YarrPatternConstructor::assertionWordBoundary):
-        (JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
-        (JSC::Yarr::YarrPatternConstructor::atomBuiltInCharacterClass):
-        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassBegin):
-        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassAtom):
-        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassRange):
-        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassBuiltIn):
-        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassEnd):
-        (JSC::Yarr::YarrPatternConstructor::atomParenthesesSubpatternBegin):
-        (JSC::Yarr::YarrPatternConstructor::atomParentheticalAssertionBegin):
-        (JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
-        (JSC::Yarr::YarrPatternConstructor::atomBackReference):
-        (JSC::Yarr::YarrPatternConstructor::copyDisjunction):
-        (JSC::Yarr::YarrPatternConstructor::copyTerm):
-        (JSC::Yarr::YarrPatternConstructor::quantifyAtom):
-        (JSC::Yarr::YarrPatternConstructor::disjunction):
-        (JSC::Yarr::YarrPatternConstructor::regexBegin):
-        (JSC::Yarr::YarrPatternConstructor::regexEnd):
-        (JSC::Yarr::YarrPatternConstructor::regexError):
-        (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):
-        (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets):
-        (JSC::Yarr::YarrPatternConstructor::setupOffsets):
-        (JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
-        (JSC::Yarr::YarrPatternConstructor::optimizeBOL):
-        (JSC::Yarr::YarrPatternConstructor::addBeginTerm):
-        (JSC::Yarr::YarrPatternConstructor::setupDisjunctionBeginTerms):
-        (JSC::Yarr::YarrPatternConstructor::setupAlternativeBeginTerms):
-        (JSC::Yarr::YarrPatternConstructor::setupBeginChars):
-        (JSC::Yarr::compile):
-        (JSC::Yarr::YarrPattern::YarrPattern):
-        * yarr/YarrPattern.h: Renamed from Source/JavaScriptCore/yarr/RegexPattern.h.
-        (JSC::Yarr::CharacterRange::CharacterRange):
-        (JSC::Yarr::CharacterClassTable::create):
-        (JSC::Yarr::CharacterClassTable::CharacterClassTable):
-        (JSC::Yarr::CharacterClass::CharacterClass):
-        (JSC::Yarr::PatternTerm::PatternTerm):
-        (JSC::Yarr::PatternTerm::ForwardReference):
-        (JSC::Yarr::PatternTerm::BOL):
-        (JSC::Yarr::PatternTerm::EOL):
-        (JSC::Yarr::PatternTerm::WordBoundary):
-        (JSC::Yarr::PatternTerm::invert):
-        (JSC::Yarr::PatternTerm::capture):
-        (JSC::Yarr::PatternTerm::quantify):
-        (JSC::Yarr::PatternAlternative::PatternAlternative):
-        (JSC::Yarr::PatternAlternative::lastTerm):
-        (JSC::Yarr::PatternAlternative::removeLastTerm):
-        (JSC::Yarr::PatternAlternative::setOnceThrough):
-        (JSC::Yarr::PatternAlternative::onceThrough):
-        (JSC::Yarr::PatternDisjunction::PatternDisjunction):
-        (JSC::Yarr::PatternDisjunction::~PatternDisjunction):
-        (JSC::Yarr::PatternDisjunction::addNewAlternative):
-        (JSC::Yarr::TermChain::TermChain):
-        (JSC::Yarr::BeginChar::BeginChar):
-        (JSC::Yarr::YarrPattern::~YarrPattern):
-        (JSC::Yarr::YarrPattern::reset):
-        (JSC::Yarr::YarrPattern::containsIllegalBackReference):
-        (JSC::Yarr::YarrPattern::newlineCharacterClass):
-        (JSC::Yarr::YarrPattern::digitsCharacterClass):
-        (JSC::Yarr::YarrPattern::spacesCharacterClass):
-        (JSC::Yarr::YarrPattern::wordcharCharacterClass):
-        (JSC::Yarr::YarrPattern::nondigitsCharacterClass):
-        (JSC::Yarr::YarrPattern::nonspacesCharacterClass):
-        (JSC::Yarr::YarrPattern::nonwordcharCharacterClass):
-
-2011-01-10  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix.
-
-        * parser/SyntaxChecker.h:
-
-2011-01-10  Dave Tapuska  <dtapuska@rim.com>
+2011-04-04  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Gavin Barraclough.
+        Fix WinCE build.
 
-        Add CTI ASM versions for RVCT ARM THUMB2 mode.
+        * bytecode/Instruction.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
 
-        https://bugs.webkit.org/show_bug.cgi?id=52154
+2011-04-04  Adam Roben  <aroben@apple.com>
 
-        * jit/JITStubs.cpp:
-        (JSC::ctiTrampoline):
-        (JSC::ctiVMThrowTrampoline):
-        (JSC::ctiOpThrowNotCaught):
+        Delete mt.dep files when doing a clean build due to .vsprops file changes
 
-2011-01-10  Gavin Barraclough  <barraclough@apple.com>
+        Apparently this is yet another file that Visual Studio can't figure out it needs to rebuild.
 
-        Qt build fix.
+        Fixes <http://webkit.org/b/57777> r82850 failed to build on Windows Debug (Build)
 
-        * JavaScriptCore.pro:
+        Reviewed by Brian Weinstein.
 
-2011-01-10  Gavin Barraclough  <barraclough@apple.com>
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        (main): Added dep to the list of extensions we look for when choosing files to delete.
 
-        Reviewed by Oliver Hunt.
+2011-04-01  Oliver Hunt  <oliver@apple.com>
 
-        Bug 52079 - Syntax errors should be early errors.
+        Reviewed by Geoffrey Garen.
 
-        From chapter 16 the spec:
-            An implementation must report most errors at the time the relevant ECMAScript language construct is
-            evaluated. An early error is an error that can be detected and reported prior to the evaluation of
-            any construct in the Program containing the error. An implementation must report early errors in a
-            Program prior to the first evaluation of that Program. Early errors in eval code are reported at
-            the time eval is called but prior to evaluation of any construct within the eval code. All errors
-            that are not early errors are runtime errors.
+        Make StructureChain GC allocated
+        https://bugs.webkit.org/show_bug.cgi?id=56695
 
-            An implementation must treat any instance of the following kinds of errors as an early error:
-                * Any syntax error."
+        Make StructureChain GC allocated, and make the various owners
+        mark it correctly.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-            Added new files.
+        * JavaScriptCore.exp:
         * bytecode/CodeBlock.cpp:
-            Removed op_throw_syntax_error.
-        * bytecode/Opcode.h:
-            Removed op_throw_syntax_error.
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        (JSC::PolymorphicAccessStructureList::markAggregate):
+        (JSC::Instruction::Instruction):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::markAggregate):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
         * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::generate):
-            If m_expressionTooDeep then throw a runtime error.
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-            Initialize m_expressionTooDeep.
-        (JSC::BytecodeGenerator::emitThrowExpressionTooDeepException):
-            Sets m_expressionTooDeep.
-        * bytecompiler/BytecodeGenerator.h:
-            Added m_expressionTooDeep, removed emitThrowSyntaxError.
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::RegExpNode::emitBytecode):
-        (JSC::ContinueNode::emitBytecode):
-        (JSC::BreakNode::emitBytecode):
-        (JSC::ReturnNode::emitBytecode):
-        (JSC::LabelNode::emitBytecode):
-            Conditions that threw syntax error are now handled during parsing;
-            during bytecompilation these are now just ASSERTs.
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        * collector/handles/Handle.h:
+        (JSC::HandleConverter::operator->):
+        (JSC::HandleConverter::operator*):
         * interpreter/Interpreter.cpp:
         (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JIT.h:
         * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
         * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
         * jit/JITStubs.cpp:
-        * jit/JITStubs.h:
-            Removed op_throw_syntax_error.
-        * parser/ASTBuilder.h:
-        (JSC::ASTBuilder::createRegExp):
-            Renamed; added syntax check.
-        * parser/JSParser.cpp:
-        (JSC::JSParser::breakIsValid):
-        (JSC::JSParser::hasLabel):
-        (JSC::JSParser::Scope::Scope):
-        (JSC::JSParser::Scope::setIsFunction):
-        (JSC::JSParser::Scope::isFunctionBoundary):
-        (JSC::JSParser::ScopeRef::hasContainingScope):
-        (JSC::JSParser::ScopeRef::containingScope):
-        (JSC::JSParser::AutoPopScopeRef::AutoPopScopeRef):
-        (JSC::JSParser::AutoPopScopeRef::~AutoPopScopeRef):
-        (JSC::JSParser::AutoPopScopeRef::setPopped):
-        (JSC::JSParser::popScopeInternal):
-        (JSC::JSParser::popScope):
-        (JSC::jsParse):
-        (JSC::JSParser::JSParser):
-        (JSC::JSParser::parseProgram):
-        (JSC::JSParser::parseBreakStatement):
-        (JSC::JSParser::parseContinueStatement):
-        (JSC::JSParser::parseReturnStatement):
-        (JSC::JSParser::parseTryStatement):
-        (JSC::JSParser::parseFunctionInfo):
-        (JSC::JSParser::parseExpressionOrLabelStatement):
-        (JSC::JSParser::parsePrimaryExpression):
-        * parser/JSParser.h:
-        * parser/Nodes.h:
-        * parser/Parser.cpp:
-        (JSC::Parser::parse):
-        * parser/SyntaxChecker.h:
-        (JSC::SyntaxChecker::createRegExp):
-            Renamed; added syntax check.
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createOutOfMemoryError):
-        (JSC::throwOutOfMemoryError):
-        * runtime/ExceptionHelpers.h:
-            Broke out createOutOfMemoryError.
-        * runtime/Executable.cpp:
-        (JSC::EvalExecutable::compileInternal):
-        (JSC::ProgramExecutable::compileInternal):
-        (JSC::FunctionExecutable::compileForCallInternal):
-        (JSC::FunctionExecutable::compileForConstructInternal):
-            Add check for exception after bytecode generation.
-        * runtime/RegExpConstructor.cpp:
-        (JSC::constructRegExp):
-        * runtime/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncCompile):
-            RegExp error prefixes not included in error string.
-        * yarr/RegexParser.h:
-        (JSC::Yarr::Parser::parse):
-            Removed regexBegin/regexEnd/regexError.
-        * yarr/RegexPattern.cpp:
-        (JSC::Yarr::RegexPatternConstructor::regexBegin):
-            Removed regexEnd/regexError.
-        (JSC::Yarr::compileRegex):
-            Add call to regexBegin (no longer called from the parser).
-        * yarr/YarrSyntaxChecker.cpp: Added.
-        (JSC::Yarr::SyntaxChecker::assertionBOL):
-        (JSC::Yarr::SyntaxChecker::assertionEOL):
-        (JSC::Yarr::SyntaxChecker::assertionWordBoundary):
-        (JSC::Yarr::SyntaxChecker::atomPatternCharacter):
-        (JSC::Yarr::SyntaxChecker::atomBuiltInCharacterClass):
-        (JSC::Yarr::SyntaxChecker::atomCharacterClassBegin):
-        (JSC::Yarr::SyntaxChecker::atomCharacterClassAtom):
-        (JSC::Yarr::SyntaxChecker::atomCharacterClassRange):
-        (JSC::Yarr::SyntaxChecker::atomCharacterClassBuiltIn):
-        (JSC::Yarr::SyntaxChecker::atomCharacterClassEnd):
-        (JSC::Yarr::SyntaxChecker::atomParenthesesSubpatternBegin):
-        (JSC::Yarr::SyntaxChecker::atomParentheticalAssertionBegin):
-        (JSC::Yarr::SyntaxChecker::atomParenthesesEnd):
-        (JSC::Yarr::SyntaxChecker::atomBackReference):
-        (JSC::Yarr::SyntaxChecker::quantifyAtom):
-        (JSC::Yarr::SyntaxChecker::disjunction):
-        (JSC::Yarr::checkSyntax):
-        * yarr/YarrSyntaxChecker.h: Added.
-            Check RegExp syntax.
-
-2011-01-10  Adam Roben  <aroben@apple.com>
-
-        Roll out r75289
-
-        It was causing assertion failures. See <http://webkit.org/b/52156>.
-
-        * wtf/StackBounds.cpp:
-        (WTF::StackBounds::initialize):
-
-2011-01-08  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Unify string table adding in AtomicString
-        https://bugs.webkit.org/show_bug.cgi?id=51927
-
-        Move code for adding a string into a separate function.
-        This removes multiple occurrence of the same logic.
-
-        * wtf/text/AtomicString.cpp:
-        (WTF::addToStringTable): Added.
-        (WTF::AtomicString::add): Use addToStringTable().
-        (WTF::AtomicString::fromUTF8): Ditto.
-
-2011-01-07  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Split machine stack marking functions into their own class (MachineStackMarker)
-        https://bugs.webkit.org/show_bug.cgi?id=52088
-
-        * API/APIShims.h:
-        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Moved registerThread()
-        call behind an #ifdef because we shouldn't be registering threads at all
-        if we don't support usage on multiple threads.
-
-        * Android.mk:
-        * CMakeLists.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj: Updated projects.
-
-        * runtime/Collector.cpp:
-        (JSC::Heap::Heap):
-        (JSC::Heap::destroy):
-        (JSC::Heap::markRoots):
-        * runtime/Collector.h:
-        (JSC::Heap::machineStackMarker): Moved code to machineStackMarker.
-
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
         * runtime/JSGlobalData.h:
-        (JSC::JSGlobalData::makeUsableFromMultipleThreads): Removed an unnecessary
-        level of indirection, to make Heap less of a God class.
-
-        * runtime/MachineStackMarker.h: Copied from Source/JavaScriptCore/runtime/Collector.h.
-        * runtime/MachineStackMarker.cpp: Copied from Source/JavaScriptCore/runtime/Collector.cpp.
-        (JSC::MachineStackMarker::MachineStackMarker):
-        (JSC::MachineStackMarker::~MachineStackMarker):
-        (JSC::MachineStackMarker::makeUsableFromMultipleThreads):
-        (JSC::MachineStackMarker::registerThread):
-        (JSC::MachineStackMarker::unregisterThread):
-        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
-        (JSC::MachineStackMarker::markCurrentThreadConservatively):
-        (JSC::MachineStackMarker::markOtherThreadConservatively):
-        (JSC::MachineStackMarker::markMachineStackConservatively): Moved code from Heap.
-
-2011-01-07  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 26276 - Need a mechanism to determine stack extent on WINDOWS, SOLARIS, OPENBSD, SYMBIAN, HAIKU, WINCE platforms
-
-        Fix for win32.  The base of the stack is stored in the "deallocation stack" field of the
-        Thread Information Block - see: http://en.wikipedia.org/wiki/Win32_Thread_Information_Block
-        for more information!
-
-        * wtf/StackBounds.cpp:
-        (WTF::StackBounds::initialize):
-
-2011-01-07  Adam Roben  <aroben@apple.com>
-
-        Update react-to-vsprops-changes.py after r74855
-
-        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
-
-2011-01-07  Carlos Garcia Campos  <cgarcia@igalia.com>
-
-        Reviewed by Martin Robinson.
-
-        [GTK] Port scrollbar painting to GtkStyleContext
-        https://bugs.webkit.org/show_bug.cgi?id=52051
-
-        * wtf/gobject/GTypedefs.h: Add GtkStyleContext forward
-        declaration.
-
-2011-01-07  Daniel Bates  <dbates@rim.com>
-
-        Reviewed by Martin Robinson.
-
-        Enable PCRE computed gotos when compiling with RCVT 4.0 or greater in GNU mode
-        https://bugs.webkit.org/show_bug.cgi?id=52034
-
-        Derived from a patch by Eli Fidler.
-
-        RVCT 4 or greater in GNU mode supports the computed goto GNU language extension
-        as per <http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0348c/ch03s07s12.html>.
-
-        * pcre/pcre_exec.cpp: Modified to check for feature, HAVE(COMPUTED_GOTO), instead
-        of hardcoding the GCC compiler.
-        * wtf/Platform.h: Define WTF_COMPILER_RVCT4_OR_GREATER if __ARMCC_VERSION >= 400000.
-
-2011-01-06  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 52035 - Unregistering DOMWrapperWorlds is unsafe
-
-        The method DOMWrapperWorld::unregisterWorld() effectively calls the DOMWrapperWorld's
-        destructor early, in order to release wrappers once we know we no longer intend to use them.
-        Whilst it is okay to have a method to throw away wrappers (assuming we know we're willing to
-        lose any state stored on them) it is not okay to deregister the world from the JSGlobalData.
-        A sequence of events that triggers the bug would look like this:
-
-        (1) Create a DOMWrapperWorld.
-        (2) Register a timer in the world.
-        (3) Call unregisterWorld() on the world.
-        (4) Timer goes off, code is executed in the world, creates a Node not attached to a Document.
-        (5) We attempt to lookup a wrapper map for the world on the JSGlobalData, but because we've
-            called forgetWorld() none exists.
-        (6) Attempt to add a wrapper to a NULL map.
-
-        Fix the problem by not removing the JSGlobalData's wrapper map until the world really goes away.
-
-        * runtime/WeakGCMap.h:
-        (JSC::WeakGCMap::clear):
-
-2011-01-06  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 52021 - zeroDouble broken on ARMv7
-
-        The bug here is that zeroDouble was working incorrectly,
-        leading to op_loop_if_true failing - specifically in the
-        case where the value being checked is 0.0 encoded as a
-        double (rather than an integer immediate).
-
-        Additionally this patch removes a redundant duplicate compare
-        in some (many) case.
-
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::vcmp_F64):
-        (JSC::ARMv7Assembler::vcmpz_F64):
-        * assembler/MacroAssemblerARM.h:
-        (JSC::MacroAssemblerARM::branchDoubleNonZero):
-        (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
-        * assembler/MacroAssemblerARMv7.h:
-        (JSC::MacroAssemblerARMv7::branchDouble):
-        (JSC::MacroAssemblerARMv7::branchDoubleNonZero):
-        (JSC::MacroAssemblerARMv7::branchDoubleZeroOrNaN):
-        (JSC::MacroAssemblerARMv7::compare32):
-        * assembler/MacroAssemblerMIPS.h:
-        (JSC::MacroAssemblerMIPS::branchDoubleNonZero):
-        (JSC::MacroAssemblerMIPS::branchDoubleZeroOrNaN):
-        * assembler/MacroAssemblerX86Common.h:
-        (JSC::MacroAssemblerX86Common::branchDoubleNonZero):
-        (JSC::MacroAssemblerX86Common::branchDoubleZeroOrNaN):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_jfalse):
-        (JSC::JIT::emit_op_jtrue):
-
-2011-01-06  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Added debug code to compare the results of JIT regexp with 
-        interpreted regexp and displays discrepencies.  This debug code is
-        controlled by the ENABLE_YARR_JIT_DEBUG macro in wtf/Platform.h and
-        is only valid if ENABLE_YARR_JIT is enabled.
-
-        Fixed a discovered problem in RegExp::printTraceData, changing
-        m_pattern to the getter pattern().
-        Also deleted an extraneous semicolon.
-
-        Enhancement: Add Regexp Debug Compare between JIT and Interpreter
-        https://bugs.webkit.org/show_bug.cgi?id=51834
-
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::compile):
-        (JSC::RegExp::match):
-        (JSC::RegExp::printTraceData):
-        * wtf/Platform.h:
-
-2011-01-06  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        [WINCE] Remove JSC::g_stackBase
-        https://bugs.webkit.org/show_bug.cgi?id=51779
-
-        * wtf/StackBounds.cpp:
-
-2011-01-06  Joone Hur  <joone.hur@collabora.co.uk>
-
-        Reviewed by Eric Seidel.
-
-        WML Parser should treat line/column number in a consistent way
-        https://bugs.webkit.org/show_bug.cgi?id=51601
-
-        Add the equality operators to TextPosition class.
-
-        * wtf/text/TextPosition.h:
-        (WTF::TextPosition::operator==): Added.
-        (WTF::TextPosition::operator!=): Added.
-        (WTF::TextPosition::belowRangePosition): Use belowBase() instead of base().
-        (WTF::ZeroBasedNumber::operator==): Added.
-        (WTF::ZeroBasedNumber::operator!=): Added.
-        (WTF::OneBasedNumber::operator==): Added.
-        (WTF::OneBasedNumber::operator!=): Added.
-
-2011-01-06  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        [WINCE] Determine stack extent
-        https://bugs.webkit.org/show_bug.cgi?id=26276
-
-        Scan the stack for writeable pages and use the limits.
-
-        * wtf/StackBounds.cpp:
-        (WTF::detectGrowingDownward):
-        (WTF::isPageWritable):
-        (WTF::getLowerStackBound):
-        (WTF::getUpperStackBound):
-        (WTF::StackBounds::initialize):
-
-2011-01-05  Steve Falkenburg  <sfalken@apple.com>
-
-        Windows build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Revert change to additional library search path needed to find ICU.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeChain):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::get):
+        (JSC::JSPropertyNameIterator::markChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        * runtime/JSZombie.cpp:
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::markAggregate):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        (JSC::StructureChain::~StructureChain):
+        (JSC::StructureChain::markChildren):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::createStructure):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
 
-2011-01-05  Steve Falkenburg  <sfalken@apple.com>
+2011-04-01  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Darin Adler.
+        Reviewed by Oliver Hunt.
 
-        Debug and Release builds on Windows clobber each other
-        https://bugs.webkit.org/show_bug.cgi?id=49185
+        Removed some complexity from HandleHeap
+        https://bugs.webkit.org/show_bug.cgi?id=57650
         
-        Changes the structure of WebKitBuild build products directory so we
-        completely separate each build configuration into independent directories.
+        Eliminated pointer-tagging flags.
         
-        Although we previously had per-configuration directories for obj, this change adds
-        per-configuration directories for bin, lib, obj, and include. Each configuration's
-        build products are stored within a directory inside of WebKitBuild.
-        
-        Most use of $(WebKitOutputDir) in the build files has been replaced by $(ConfigurationBuildDir),
-        defined in common.vsprops to be $(WebKitOutputDir)\$(ConfigurationName).
-        
-        For PGO, $(ConfigurationBuildDir) points to the same directory (Release_PGO) to allow
-        for proper operation of the instrumentation/optimization scripts.
-
-        * JavaScriptCore.vcproj/JavaScriptCore.make:
-        * JavaScriptCore.vcproj/JavaScriptCore.sln:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePGOOptimize.vsprops: Added.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd:
-        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
-        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
-        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
-        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd:
-        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
-        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd:
-        * JavaScriptCore.vcproj/jsc/jscPreBuild.cmd:
-        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
-        * JavaScriptCore.vcproj/testapi/testapiPostBuild.cmd:
-        * JavaScriptCore.vcproj/testapi/testapiPreBuild.cmd:
-
-2011-01-05  Brent Fulgham  <bfulgham@webkit.org>
-
-        Unreviewed build fix.
-
-        * wtf/Encoder.h: Add <stdint.h> include for systems that
-        do not natively know about uint8_t, etc.
-
-2011-01-05  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Andreas Kling.
-
-        [CMake] Fix the usage of SOURCE_GROUP
-        https://bugs.webkit.org/show_bug.cgi?id=51739
-
-        * CMakeLists.txt:
-
-2011-01-05  Andras Becsi  <abecsi@webkit.org>
-
-        Reviewed by Csaba Osztrogonác.
-
-        [Qt][V8] Fix the build after recent changes.
-
-        * pcre/pcre.pri: Correct the path after Source was introduced.
-
-2011-01-04  Steve Falkenburg  <sfalken@apple.com>
-
-        Build fix. Update path to FindSafari after source code reorganization.
-
-        * JavaScriptCore.vcproj/JavaScriptCore.sln:
-
-2011-01-04  Daniel Bates  <dbates@rim.com>
-
-        Fix the Android build after changeset 74975 <http://trac.webkit.org/changeset/74975>
-        (https://bugs.webkit.org/show_bug.cgi?id=51855).
-
-        * wtf/ThreadingPthreads.cpp: Add include of PassOwnPtr.h.
-        (WTF::runThreadWithRegistration): Use -> instead of . to dereference pointer.
-
-2011-01-04  Martin Robinson  <mrobinson@igalia.com>
-
-        Try to fix the EFL build.
-
-        * wtf/CMakeLists.txt: Remove PlatformRefPtr from the CMake source list.
-
-2011-01-04  James Robinson  <jamesr@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        StackBounds initialization in WTFThreadData should be guarded by #if USE(JSC)
-        https://bugs.webkit.org/show_bug.cgi?id=51881
-
-        The StackBounds class is only used by JavaScriptCore.
-
-        * wtf/WTFThreadData.cpp:
-        (WTF::WTFThreadData::WTFThreadData):
-        * wtf/WTFThreadData.h:
-        (WTF::WTFThreadData::resetCurrentIdentifierTable):
-
-2011-01-03  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Darin Adler.
-
-        Remove the last non-GObject usage of PlatformRefPtr and move the code to GRefPtr
-        https://bugs.webkit.org/show_bug.cgi?id=51846
-
-        * GNUmakefile.am: Remove PlatformRefPtr.h from the sources list.
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
-        * jit/ExecutableAllocator.h: Change references to PlatformRefPtr to RefPtr.
-        (JSC::ExecutableAllocator::cacheFlush): Ditto.
-        * wtf/PlatformRefPtr.h: Removed.
-        * wtf/RandomNumber.cpp: Change references to PlatformRefPtr to RefPtr.
-        (WTF::randomNumber): Ditto.
-        * wtf/brew/RefPtrBrew.h: Ditto.
-        (WTF::refIfNotNull): Added.
-        (WTF::derefIfNotNull): Added.
-        * wtf/brew/ShellBrew.h: Change references to PlatformRefPtr to RefPtr.
-        (WTF::createRefPtrInstance): Modified to return a RefPtr.
-        * wtf/gobject/GRefPtr.cpp: 
-        (WTF::refGPtr): Moved from PlatformRefPtr here.
-        (WTF::derefGPtr): Ditto.
-        * wtf/gobject/GRefPtr.h: Ditto.
-        (WTF::GRefPtr::GRefPtr): Ditto.
-        (WTF::GRefPtr::~GRefPtr): Ditto.
-        (WTF::GRefPtr::clear): Ditto.
-        (WTF::GRefPtr::isHashTableDeletedValue): Ditto.
-        (WTF::GRefPtr::get): Ditto.
-        (WTF::GRefPtr::operator*): Ditto.
-        (WTF::GRefPtr::operator->): Ditto.
-        (WTF::GRefPtr::operator!): Ditto.
-        (WTF::GRefPtr::operator UnspecifiedBoolType): Ditto.
-        (WTF::GRefPtr::hashTableDeletedValue): Ditto.
-        (WTF::::operator): Ditto.
-        (WTF::::swap): Ditto.
-        (WTF::swap): Ditto.
-        (WTF::operator==): Ditto.
-        (WTF::operator!=): Ditto.
-        (WTF::static_pointer_cast): Ditto.
-        (WTF::const_pointer_cast): Ditto.
-        (WTF::getPtr): Ditto.
-        (WTF::adoptGRef): Ditto.
-        (WTF::refGPtr): Ditto.
-        (WTF::derefGPtr): Ditto.
-
-2011-01-04  Daniel Bates  <dbates@rim.com>
-
-        Reviewed by Adam Roben.
-
-        LEAK: Deallocate instance of ThreadFunctionInvocation if thread creation fails
-        https://bugs.webkit.org/show_bug.cgi?id=51860
-
-        * wtf/ThreadingWin.cpp:
-        (WTF::createThreadInternal):
-
-2011-01-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        [Qt][Symbian] Make sure that WebKit headers are included before platform headers on Symbian
-        https://bugs.webkit.org/show_bug.cgi?id=31273
-
-        On Symbian PREPEND_INCLUDEPATH is the best way to make sure that WebKit headers
-        are included before platform headers. On all other platforms continue to use
-        INCLUDEPATH (as before). This is a continuation of r65877.
-
-        No new tests as there is no new functionality.
-
-        * JavaScriptCore.pri:
-
-2011-01-04  Darin Adler  <darin@apple.com>
-
-        Try to fix Windows build.
-
-        * wtf/ThreadingWin.cpp: Added include of PassOwnPtr.h. Fixed paragraphing
-        of conditional includes.
-        (WTF::wtfThreadEntryPoint): Use -> instead of . to dereference pointer.
-        (WTF::createThreadInternal): Tweaked #if to not need separate macro.
-
-2011-01-04  Daniel Bates  <dbates@rim.com>
-
-        Reviewed by Adam Roben.
-
-        Extract ThreadFunctionInvocation into separate file and share between Apple Windows and Android
-        https://bugs.webkit.org/show_bug.cgi?id=51855
-
-        Both the Apple Windows and Android ports implement a similar adapter structure,
-        called ThreadFunctionInvocation and ThreadData respectively, as part of
-        their thread creation process. Instead, we should share such an adapter
-        structure and remove duplicate code.
-
-        * JavaScriptCore.gypi: Added header wtf/ThreadFunctionInvocation.h.
-        * wtf/ThreadFunctionInvocation.h: Added.
-        (WTF::ThreadFunctionInvocation::ThreadFunctionInvocation):
-        * wtf/ThreadingPthreads.cpp: Removed Android-specific structure ThreadData; Instead, use ThreadFunctionInvocation.
-        (WTF::runThreadWithRegistration):
-        (WTF::createThreadInternal): 
-        * wtf/ThreadingWin.cpp: Moved structure ThreadFunctionInvocation to its own file so that
-        it can be shared with the Android implementation of createThreadInternal().
-        (WTF::wtfThreadEntryPoint): Use OwnPtr to hold passed instance of ThreadFunctionInvocation.
-
-2011-01-04  Daniel Bates  <dbates@rim.com>
-
-        Reviewed by Darin Adler.
-
-        Use __builtin_expect when compiling using RVCT in GNU mode
-        https://bugs.webkit.org/show_bug.cgi?id=51866
-
-        Derived from a patch by Dave Tapuska.
-
-        * wtf/AlwaysInline.h:
-
-2011-01-03  Darin Adler  <darin@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        * wtf/Forward.h: Added Decoder and Encoder.
-
-2011-01-03  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Add Encode/Decode machinery Darin and I plan to work with for back/forward stuff in WebKit2.
-
-        Starting out with a pure virtual interface to be implemented in WK2, but we might change that later.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/CMakeLists.txt:
-
-        * wtf/Decoder.h: Added.
-        * wtf/Encoder.h: Added.
-
-2011-01-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed build fix.
-
-        [Qt] Add NullPtr.cpp introduced in r71155 to the Qt build system.
-
-        This fix is required for builds where HAVE(NULLPTR) is false
-        (e.g. some MSVC and Symbian builds).
-
-        * wtf/wtf.pri:
-
-2011-01-02  Dan Bernstein  <mitz@apple.com>
-
-        Rubber-stamped by Simon Fraser.
-
-        <rdar://problem/8812159> Update copyright strings
-
-        * Info.plist:
-
-2011-01-02  Csaba Osztrogonác  <ossy@webkit.org>
-
-        Fix GTK+ build after r74855.
-
-        Reviewed by Xan Lopez.
-
-        * GNUmakefile.am: Fix include pathes.
-
-2011-01-02  Adam Barth  <abarth@webkit.org>
-
-        One more .. missing in the Qt build.
-
-        * jsc.pro:
-
-2011-01-02  Xan Lopez  <xlopez@igalia.com>
-
-        Fix GTK+ build.
-
-        * GNUmakefile.am: add -I$(srcdir)/Source to the JSC cppflags so
-        that anyone can include its headers without adding the prefix
-        'Source/'.
-
-2011-01-02  Carl Lobo  <carllobo@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        Fix Windows Build for non-production where VSPropsRedirectionDir is not defined.
-        https://bugs.webkit.org/show_bug.cgi?id=51797
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
-
-2011-01-01  Adam Barth  <abarth@webkit.org>
-
-        Fix relative include paths in an attempt to fix the Qt build.
-
-        * JavaScriptCore.pri:
-        * JavaScriptCore.pro:
-
-2011-01-01  Adam Barth  <abarth@webkit.org>
-
-        Another speculative build fix for GTK.
-
-        * GNUmakefile.am:
-
-2011-01-01  Adam Barth  <abarth@webkit.org>
-
-        Speculative build fix for GTK.  Update the paths in GNUmakefile to
-        include "Source".
-
-        * GNUmakefile.am:
-
-2011-01-01  Adam Barth  <abarth@webkit.org>
-
-        Update relative paths in JavaScriptCore.gyp to account for the extra
-        level of directories.
-
-        * JavaScriptCore.gyp/JavaScriptCore.gyp:
-
-2010-12-31  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Add a fast case for ASCII strings in HashAndUTF8CharactersTranslator::equal
-        https://bugs.webkit.org/show_bug.cgi?id=50517
-
-        This change shows about 2% performance win on the xml-parser benchmark.
-
-        * wtf/text/AtomicString.cpp:
-        (WTF::HashAndUTF8CharactersTranslator::equal):
-
-2010-12-30  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Ariya Hidayat.
-
-        [CMake] Add WTF_HEADERS
-        https://bugs.webkit.org/show_bug.cgi?id=51741
-
-        Add the WTF headers to show them in Visual Studio.
-
-        * wtf/CMakeLists.txt:
-        * wtf/CMakeListsWinCE.txt:
-
-2010-12-30  Konstantin Tokarev  <annulen@yandex.ru>
-
-        Reviewed by David Kilzer.
-
-        [Qt] Don't build wtf/TCSystemAlloc.cpp if --system-malloc option is
-        used
-        https://bugs.webkit.org/show_bug.cgi?id=51672
-
-        * wtf/wtf.pri: Replaced USE_SYSTEM_MALLOC with USE_SYSTEM_MALLOC=1
-
-2010-12-30  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Use OS(WINDOWS) instead of COMPILER(MSVC) in FastMalloc.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=51743
-
-        Most of the ifdefs belong to windows and not to the MSVC compiler.
-
-        * wtf/FastMalloc.cpp:
-
-2010-12-29  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 51724 - In strict mode string literals should allow \0, but disallow \8 and \9.
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::parseString):
+        Tied being weak to having a finalizer (or at least a finalizer sentinel).
 
-2010-12-29  Helder Correia  <helder@sencha.com>
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::clearWeakPointers): Removed the special self-destroying
+        flag. It was unused. If we bring it back, we'll probably use a shared
+        autodeallocating finalizer instead.
 
-        Reviewed by Eric Seidel.
-
-        <VT> and <FF> are not valid JSON whitespace characters
-        https://bugs.webkit.org/show_bug.cgi?id=51671
-
-        Vertical Tab and Form Feed are not allowed white spaces by the JSON
-        RFC 4627: http://www.ietf.org/rfc/rfc4627.txt (2. JSON Grammar).
+        * collector/handles/HandleHeap.h:
+        (JSC::HandleHeap::makeWeak): makeWeak and adding a finalizer are now
+        a single, atomic operation -- this makes the relationship between
+        finalizers and weak pointers clearer, and impossible to get wrong.
 
-        Tests: ietestcenter/Javascript/15.12.1.1-0-2.html
-               ietestcenter/Javascript/15.12.1.1-0-3.html
+        (JSC::HandleHeap::Node::Node):
+        (JSC::HandleHeap::Node::handleHeap): No more flags.
 
-        * runtime/LiteralParser.cpp:
-        (JSC::isJSONWhiteSpace):
-        (JSC::LiteralParser::Lexer::lex):
-
-2010-12-28  Helder Correia  <helder@sencha.com>
-
-        Reviewed by Eric Seidel.
-
-        JSON.stringify must exist as a function taking 3 parameters
-        https://bugs.webkit.org/show_bug.cgi?id=51667
-
-        The reported function length is 1 instead.
-
-        Test: ietestcenter/Javascript/15.12.3-0-2.html
-
-        * runtime/JSONObject.cpp:
+        (JSC::HandleHeap::Node::makeWeak):
+        (JSC::HandleHeap::Node::isWeak): Ditto above. We use a special sentienl
+        value in the finalizer slot to indicate that a handle is weak but doesn't
+        require an external function call for finalization.
 
-2010-12-28  Helder Correia  <helder@sencha.com>
+2011-04-01  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Sam Weinig.
-
-        JSON.parse must exist as a function taking 2 parameters
-        https://bugs.webkit.org/show_bug.cgi?id=51666
-
-        Support for revivers was introduced in bug 26591, but the function
-        length has since remained unchanged.
-
-        Test: ietestcenter/Javascript/15.12.2-0-2.html
-
-        * runtime/JSONObject.cpp:
-
-2010-12-27  Jake Helfert  <jake@jakeonthenet.com>
-
-        Reviewed and reworked by Darin Adler.
+        Reviewed by Oliver Hunt.
 
-        Building WebKit with Visual Studio 2010 fails due
-        to ambiguous assignment operator errors.
-        https://bugs.webkit.org/show_bug.cgi?id=51116
+        Removed WeakGCMap::deprecatedRemove because it was deprecated and unused
+        https://bugs.webkit.org/show_bug.cgi?id=57648
 
-        * wtf/NullPtr.h: Added a HAVE(NULLPTR) definition for use with
-        Platform.h HAVE macro, and included the Visual Studio 2010 compiler
-        as one of the ones that has nullptr.
-        * wtf/NullPtr.cpp: Updated condition to match.
-        
-        * wtf/PassOwnArrayPtr.h: Don't include the operator=(nullptr_t)
-        overload if we are compiling in loose mode and the compiler has
-        nullptr, because assignment of 0 will otherwise encounter
-        ambiguitity with this overload and the overload for loose mode
-        that takes a raw pointer. The conditional can be removed when we
-        get rid of loose mode.
-        * wtf/PassOwnPtr.h: Ditto.
-
-        * wtf/PassRefPtr.h: Don't include the operator=(nullptr_t) overload
-        if the compiler has nullptr, because assignment of 0 would be
-        ambiguous with the overload that takes a raw pointer. The conditional
-        can be removed if we ever decide we no longer need to support
-        assigning 0, but might need a way to catch that usage on older compilers.
-        * wtf/RefPtr.h: Ditto.
-        * wtf/RetainPtr.h: Ditto
-
-        * JavaScriptCore.xcodeproj/project.pbxproj: Added NullPtr.cpp,
-        accidentally omitted when the file was first added.
-
-2010-12-26  Xan Lopez  <xlopez@igalia.com>
+        * runtime/WeakGCMap.h:
 
-        Reviewed by Eric Seidel.
+2011-04-01  Adam Roben  <aroben@apple.com>
 
-        [GTK] Add standalone target for JSC
-        https://bugs.webkit.org/show_bug.cgi?id=51607
+        Maintain the invariant that Lexer::m_current is set to -1 when at the end of the code buffer
 
-        * GNUmakefile.am: add convenience target to only build jsc and its
-        dependencies.
+        Covered by existing tests.
 
-2010-12-24  Patrick Gansterer  <paroga@webkit.org>
+        Fixes <http://webkit.org/b/56699>.
 
-        Reviewed by Eric Seidel.
-
-        [WINCE] Add CPU(MIPS) detection
-        https://bugs.webkit.org/show_bug.cgi?id=51342
+        Reviewed by Oliver Hunt.
 
-        WinCE usually defines MIPS and _MIPS_.
+        * parser/Lexer.h:
+        (JSC::Lexer::setOffset): Copied code from Lexer::shift to update m_current, because
+        supposedly the idiom that function uses is fast.
 
-        * wtf/Platform.h:
+2011-03-31  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
 
-2010-12-23  Gavin Barraclough  <barraclough@apple.com>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Sam Weinig.
+        SH4 JIT SUPPORT.
+        https://bugs.webkit.org/show_bug.cgi?id=44329
 
-        Rename RegexCompiler.cpp to RegexPattern.cpp.
-        Implicitly call compileRegex from RegexPattern's constructor.
+        Add YARR support for SH4 platforms (disabled by default).
 
-        * Android.mk:
-        * CMakeLists.txt:
         * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::compile):
-        * yarr/RegexCompiler.cpp: Removed.
-        * yarr/RegexCompiler.h: Removed.
-        * yarr/RegexInterpreter.cpp:
-        * yarr/RegexJIT.cpp:
-        * yarr/RegexPattern.cpp: Copied from JavaScriptCore/yarr/RegexCompiler.cpp.
-        (JSC::Yarr::compileRegex):
-        (JSC::Yarr::RegexPattern::RegexPattern):
-        * yarr/RegexPattern.h:
-
-2010-12-23  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed build fix for WinCE after r74360.
-
-        Move the OS(WINDOWS) section after the OS(WINCE) section
-        and add missing argument to the getStackMax call.
-
-        * wtf/StackBounds.cpp:
-        (WTF::StackBounds::initialize):
-
-2010-12-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Unreviewed build fix.
-
-        [Symbian] Make sure OSAllocatorSymbian builds
-
-        This patch only addresses the build problem.
-
-        https://bugs.webkit.org/show_bug.cgi?id=51128 tracks the full
-        (re)implementation of the Symbian allocator.
-
-        * wtf/OSAllocatorSymbian.cpp:
-        (WTF::OSAllocator::reserveUncommitted):
-        (WTF::OSAllocator::reserveAndCommit):
-        (WTF::OSAllocator::commit):
-
-2010-12-22  Dan Bernstein  <mitz@apple.com>
-
-        Changed WebKitTools to Tools.
-
-        * JavaScriptCore.vcproj/JavaScriptCore.sln:
-
-2010-12-22  Dan Bernstein  <mitz@apple.com>
-
-        Rubber-stamped by Mark Rowe.
-
-        Changed WebKitTools to Tools in script build phases.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2010-12-22  Andrei Popescu  <andreip@google.com>
-
-        Unreviewed build fix.
-
-        Fix Chromium Linux shared library build.
-        [Chromium] r74431 broke the Chromium Linux shared library build
-        https://bugs.webkit.org/show_bug.cgi?id=51462
-
-        * JavaScriptCore.gyp/JavaScriptCore.gyp:
-        * JavaScriptCore.gypi:
-
-2010-12-21  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r74462.
-        http://trac.webkit.org/changeset/74462
-        https://bugs.webkit.org/show_bug.cgi?id=51449
-
-        broke chromium win (Requested by tonyg-cr on #webkit).
-
-        * JavaScriptCore.gypi:
-
-2010-12-21  Tony Gentilcore  <tonyg@chromium.org>
-
-        Unreviewed build fix.
-
-        [chromium] Build fix after r74431
-        https://bugs.webkit.org/show_bug.cgi?id=51447
-
-        * JavaScriptCore.gypi:
-
-2010-12-21  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-12-21  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-12-21  Gavin Barraclough  <barraclough@apple.com>
-
-        Speculative build fix.
-
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutableAllocator::underMemoryPressure):
-
-2010-12-21  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26276 - Need a mechanism to determine stack extent
-
-        This patch adds accurate stack size calculation for:
-            DARWIN, QNX, UNIX
-        We still need to fix:
-            WINDOWS, SOLARIS, OPENBSD, SYMBIAN, HAIKU, WINCE
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerSH4.cpp: Added.
+        * assembler/MacroAssemblerSH4.h: Added.
+        * assembler/SH4Assembler.h: Added.
+        * yarr/YarrJIT.cpp:
 
-        * wtf/StackBounds.cpp:
-        (WTF::StackBounds::initialize):
+2011-03-30  Adam Roben  <aroben@apple.com>
 
-2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+        Clean build fix
 
-         Reviewed by Geoff Garen.
- 
-        <rdar://problem/8765333> CRASH running out of executable memory, loading io9.com
-        https://bugs.webkit.org/show_bug.cgi?id=51443
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Serialized project dependencies so projects
+        don't try to build in parallel (which doesn't mesh with our buildfailed mechanism).
 
-        The problem here is that each page uses a reasonable amount of memory, (~4Mb),
-        and that when miultiple pages are open we keep all JIT code for all functions
-        in all pages alive.
+2011-03-30  Oliver Hunt  <oliver@apple.com>
 
-        Add a check to detect high memory pressure situations in the executable allocator
-        (>50% of available memory allocated), and upon a top level entry into JSC (no code
-        running on the stack) in this situation throw away all JIT code.
+        Rollout r82500
 
-        * JavaScriptCore.exp:
-        * debugger/Debugger.cpp:
-        (JSC::Debugger::recompileAllJSFunctions): stop passing exec to recompile.
-        * jit/ExecutableAllocator.h:
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::ExecutablePool::systemAlloc): Count allocations.
-        (JSC::ExecutablePool::systemRelease): Count deallocations.
-        (JSC::ExecutablePool::underMemoryPressure): Check memory pressure.
-        * jit/ExecutableAllocatorPosix.cpp:
-        (JSC::ExecutablePool::underMemoryPressure): Stub out; only meaningful with FixedVMPool.
-        * jit/ExecutableAllocatorWin.cpp:
-        (JSC::ExecutablePool::underMemoryPressure): Stub out; only meaningful with FixedVMPool.
-        * runtime/Executable.cpp:
-        (JSC::FunctionExecutable::recompile): Remove ExecState argument to recompile.
-        * runtime/Executable.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        (JSC::Instruction::Instruction):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITStubs.cpp:
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
         * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::recompileAllJSFunctions): throws away all JIT code.
+        (JSC::JSGlobalData::JSGlobalData):
         * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
         * runtime/JSGlobalObject.h:
-        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): add check / call to throw away.
+        (JSC::Structure::prototypeChain):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::get):
+        (JSC::JSPropertyNameIterator::markChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/Structure.h:
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
 
-2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+2011-03-29  Matthew Delaney  <mdelaney@apple.com>
 
-        Reviewed by Geoff Garen.
+        Reviewed by Simon Fraser.
 
-        <rdar://problem/8241425> JIT executable memory excessive usage due to regex caching
-        https://bugs.webkit.org/show_bug.cgi?id=51434
+        Use the Accelerate vImage vectorized (un)premultiplyImageData functions for ImageBufferCG
 
-        Reduce the amount of memory the RegExpCache can hold on to on iOS.
-        Currently the RegExpCache can hold 256 RegExp objects. If each falls into a separate
-        ExecutablePool, with a common size of 16Kb, this means we end up holding onto 4Mb of
-        memory. Firstly, we can reduce this by simply reducing the size of the cache to 32
-        entries. Secondly, we can use a separate set of ExecutablePools for JIT code generated
-        from RegExp objects. This helps in two ways (1) it increases the probability that
-        RegExps in the cache share the same pool, and (2) it means that a RegExp can't end
-        up holding on to a large ExecutablePool containing a translation of JS code.
-        (A RegExp could end up keeping a larger RegExp alive that happened to be sharing the
-        same pool, but large RegExp patterns are less common).
+        https://bugs.webkit.org/show_bug.cgi?id=53134
 
-        * runtime/JSGlobalData.h:
-        * runtime/RegExpCache.h:
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::compile):
+        * wtf/Platform.h: Added in WTF flag for using the Accelerate framework
 
-2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
 
-        Windows build fix.
+        Reviewed by Adam Roben.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Share most vsprops between Release and Production builds in releaseproduction.vsprops
+        https://bugs.webkit.org/show_bug.cgi?id=57508
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFProduction.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFRelease.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscProduction.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscRelease.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiProduction.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiRelease.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops:
+
+2011-03-30  Mark Rowe  <mrowe@apple.com>
 
-2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+        Reviewed by Adam Roben.
 
-        Eeeep! build fix!
+        Explicitly prevent testapi and minidom from being installed rather than relying
+        on Xcode's current behavior of not installing if INSTALL_PATH is not explicitly
+        set at the target level.
 
-        * wtf/OSAllocator.h:
-        (WTF::OSAllocator::decommitAndRelease):
+        <rdar://problem/9206357>
 
-2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+        * JavaScriptCore.xcodeproj/project.pbxproj:
 
-        Ooops, fixed typo in comment.
+2011-03-30  Timur Iskhodzhanov  <timurrrr@google.com>
 
-        * wtf/OSAllocator.h:
+        Reviewed by Alexey Proskuryakov.
 
-2010-12-21  Geoffrey Garen  <ggaren@apple.com>
+        Add some dynamic annotations to JavaScriptCore/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=53747
 
-        Reviewed by Gavin Barraclough & Oliver Hunt.
+        By using these annotations we can improve the precision of finding
+        WebKit errors using dynamic analysis tools like ThreadSanitizer and Valgrind.
+        These annotations don't affect the compiled binaries unless USE(DYNAMIC_ANNOTATIONS) is "1".
 
-        Added PageAllocationAligned, a cross-platform abstraction for memory allocations with arbitrary alignment requirements
-        https://bugs.webkit.org/show_bug.cgi?id=51359
-        
-        I think this patch fixes <rdar://problem/8107952> [5.0.1] WER crash in
-        Heap::allocateBlock (1902752929), and some other leaks and crashes as well.
+        These files don't add new functionality, so don't need extra tests.
 
-        * Android.mk:
-        * CMakeLists.txt:
         * GNUmakefile.am:
         * JavaScriptCore.gypi:
         * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj: Updated build files.
-
-        * runtime/AlignedMemoryAllocator.h: Removed. Supplanted by
-        PageAllocationAligned.
-
-        * runtime/Collector.cpp:
-        (JSC::Heap::destroy):
-        (JSC::Heap::allocateBlock):
-        (JSC::Heap::freeBlock):
-        (JSC::Heap::addWeakGCHandle):
-        * runtime/Collector.h: Switched from AlignedMemoryAllocator to
-        PageAllocationAligned.
-
-        * runtime/GCHandle.cpp:
-        * runtime/GCHandle.h: Ditto.
-
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::PageAllocation): Removed aligned memory allocation
-        functions. Supplanted by PageAllocationAligned.
-
-        * wtf/PageAllocationAligned.cpp: Added.
-        (WTF::PageAllocationAligned::allocate):
-        (WTF::PageAllocationAligned::deallocate):
-        * wtf/PageAllocationAligned.h: Added.
-        (WTF::PageAllocationAligned::PageAllocationAligned): New cross-platform
-        class for doing aligned memory allocation. This class properly matches
-        allocation and deallocation library calls, fixing a long-standing bug
-        in PageAllocation.
-
-        * wtf/Platform.h: Removed some defunction VM platform defines.
-
-        * wtf/wtf.pri: Updated build files.
-
-2010-12-21  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        ASSERTION FAILED: base->index() == m_codeBlock->argumentsRegister() while loading taobao.com
-        https://bugs.webkit.org/show_bug.cgi?id=49006
-
-        This problem was caused by having a parameter named 'arguments'.
-        The fix is to treat parameters named 'arguments' as shadowing
-        the actual arguments property, and so logically turn the function
-        into one that doesn't "use" arguments.
-
-        This required a bit of fiddling in the parser to ensure we correctly
-        propagate the 'feature' of shadowing is set correctly.
-
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
-          Change assertion to an early return as we may now reference
-          a property named 'arguments' without being in a function that
-          has the ArgumentsFeature
-        * parser/JSParser.cpp:
-        (JSC::JSParser::Scope::Scope):
-        (JSC::JSParser::Scope::declareParameter):
-        (JSC::JSParser::Scope::shadowsArguments):
-        (JSC::JSParser::parseProgram):
-        (JSC::JSParser::parseFormalParameters):
-        (JSC::JSParser::parseFunctionInfo):
-        * parser/Nodes.h:
-        (JSC::ScopeNode::usesArguments):
-
-2010-12-21  Daniel Bates  <dbates@rim.com>
-
-        Reviewed by Eric Seidel and Darin Adler.
-
-        Deallocate GregorianDateTime.timeZone (if allocated) when copying so that we don't leak memory.
-        https://bugs.webkit.org/show_bug.cgi?id=51367
-
-        Inspired by a patch by George Staikos.
-
-        * wtf/DateMath.cpp:
-        (JSC::msToGregorianDateTime): Modified to set timeZone to nullptr since timeZone is now
-        of type OwnPtrArray<char>.
-        * wtf/DateMath.h: Change timeZone to type OwnArrayPtr<char>; Removed destructor since it is no longer needed.
-        (JSC::GregorianDateTime::GregorianDateTime): Modified to use OwnPtrArray semantics for timeZone.
-        (JSC::GregorianDateTime::operator tm): Ditto.
-        (JSC::GregorianDateTime::copyFrom): Ditto.
-
-2010-12-21  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r74402.
-        http://trac.webkit.org/changeset/74402
-        https://bugs.webkit.org/show_bug.cgi?id=51402
-
-        This patch broke the Windows 7 Release Layout Tests (Requested
-        by jessieberlin on #webkit).
-
-        * wtf/StackBounds.cpp:
-        (WTF::estimateStackBound):
-        (WTF::StackBounds::initialize):
-
-2010-12-21  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Csaba Osztrogonác.
-
-        Unify the name of parentheses in YARR: rename parenthesis to
-        parentheses.
-
-        * yarr/RegexCompiler.cpp:
-        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
-
-2010-12-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Andreas Kling.
-
-        [Qt] Set BUILDING_QT__ consistently
-        https://bugs.webkit.org/show_bug.cgi?id=51341
-
-        * JavaScriptCore.pri: Remove the definition of BUILDING_QT__ as it
-        is already defined in WebKit.pri.
-
-2010-12-20  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26276 - Need a mechanism to determine stack extent
-
-        This patch adds accurate stack size calculation for:
-            DARWIN, WINDOWS, QNX, UNIX
-        We still need to fix:
-            SOLARIS, OPENBSD, SYMBIAN, HAIKU, WINCE
-
-        * wtf/StackBounds.cpp:
-        (WTF::StackBounds::initialize):
-
-2010-12-20  Gavin Barraclough  <barraclough@apple.com>
-
-        PPC build fix; stop using std::swap on PageAllocation/PageReservation,
-        this was failing on some compilers since the lack of default construction
-        for the m_executable/m_writable fields meant the value being swapped may
-        not have been fully initialized.
-
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::deallocate):
-        * wtf/PageBlock.h:
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::deallocate):
-
-2010-12-20  Oliver Hunt  <oliver@apple.com>
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/DynamicAnnotations.cpp: Added.
+        (WTFAnnotateBenignRaceSized):
+        (WTFAnnotateHappensBefore):
+        (WTFAnnotateHappensAfter):
+        * wtf/DynamicAnnotations.h: Added.
+        * wtf/ThreadSafeRefCounted.h:
+        (WTF::ThreadSafeRefCountedBase::derefBase):
+        * wtf/text/StringStatics.cpp:
+        (WTF::StringImpl::empty):
+
+2011-03-30  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Geoffrey Garen.
 
-        |delete name| in strict mode code should be an early error
-        https://bugs.webkit.org/show_bug.cgi?id=50431
-
-        Disallow the |delete IDENTIFIER| production in strict mode, and removed
-        a bunch of now unnecessary code.
-
-        * parser/JSParser.cpp:
-        (JSC::JSParser::Scope::collectFreeVariables):
-        (JSC::jsParse):
-        (JSC::JSParser::parseProgram):
-        (JSC::JSParser::parseUnaryExpression):
-        * parser/JSParser.h:
-        * parser/Parser.cpp:
-        (JSC::Parser::parse):
-        * parser/Parser.h:
-        (JSC::Parser::parse):
-
-2010-12-20  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Olver Hunt.
-
-        Bug 51358 - Should check stack depth rather than using recursion limits in byte compilation
-
-        The current implementation of recursion limit checking is not safe on smaller stacks.
-        Switch to using a common mechanism, shared with the parser, to check recursion limits.
+        Make StructureChain GC allocated
+        https://bugs.webkit.org/show_bug.cgi?id=56695
 
-        Make bytecompiler use StackBounds. Empirical testing shows emitStrcat to have the largest
-        footprint on the stack, at just under 1k on x86-64.  Given this, the default recursion
-        check (requiring 4k of available space to recurse) seems reasonable.
+        Make StructureChain GC allocated, and make the various owners
+        mark it correctly.
 
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        (JSC::PolymorphicAccessStructureList::markAggregate):
+        (JSC::Instruction::Instruction):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::markAggregate):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
         * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::emitNode):
-        (JSC::BytecodeGenerator::emitNodeInConditionContext):
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::BinaryOpNode::emitStrcat):
-
-2010-12-20  Tony Gentilcore  <tonyg@chromium.org>
-
-        Unreviewed build fix.
-
-        Include pthread to fix chromium mac build (broken by r74360)
-        https://bugs.webkit.org/show_bug.cgi?id=51356
-
-        * wtf/StackBounds.cpp:
-
-2010-12-20  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        * GNUmakefile.am: add missing files.
-
-2010-12-18  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 26276 - Need a mechanism to determine stack extent
-
-        This patch adds a class 'StackBounds', to hold information about the machine stack.
-        The implementation of this class broadly adheres to the current implmentation of
-        stack limit checking, and as such does not solve the problem of determining stack
-        extent, but gives us a common place to do so.
-
-        Currently two mechanism are provided to determine the stack origin (the point the
-        stack is growing away from). currentThreadStackBase() in Collector provides a
-        more accurate determination of the stack origin, so use this to calculate
-        StackBounds::m_origin; WTFThreadData::approximatedStackStart is less accurate, and
-        as such can be removed.  Cache the StackBounds on WTFThreadData such that they
-        need only be determined once per thread, and for non-API contexts cache this
-        information in JSGlobalData, to save a thread-specific access.
-
-        For the time being retain the estimate of stack size used by JSC's parser
-        (128 * sizeof(void*) * 1024), with a view to replacing this with something more
-        accurate in the near future.
-
-        * parser/JSParser.cpp:
-        (JSC::JSParser::canRecurse):
-        (JSC::JSParser::JSParser):
-            Change to use StackBounds.
-        * runtime/Collector.cpp:
-        (JSC::Heap::registerThread):
-        (JSC::Heap::markCurrentThreadConservativelyInternal):
-            Change to use StackBounds, cached on JSGlobalData.
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITStubs.cpp:
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
         * runtime/JSGlobalData.cpp:
         (JSC::JSGlobalData::JSGlobalData):
         * runtime/JSGlobalData.h:
-        (JSC::JSGlobalData::stack):
-            Add a cached copy of StackBounds.
-        * wtf/StackBounds.cpp: Copied from JavaScriptCore/runtime/Collector.cpp.
-        (WTF::estimateStackBound):
-        (WTF::StackBounds::initialize):
-        (WTF::getStackMax):
-            Copy code from Collector.cpp to determine stack origin.
-        * wtf/StackBounds.h: Added.
-        (WTF::StackBounds::StackBounds):
-            No argument constructor; returns a null StackBounds.
-        (WTF::StackBounds::currentThreadStackBounds):
-            Returns a StackBounds object representing the stack limits
-            of the current thread.
-        (WTF::StackBounds::origin):
-            Returns to stack origin (the point the stack is growing away
-            from; the highest extent of the stack on machines where the
-            stack grows downwards.
-        (WTF::StackBounds::recursionLimit):
-            Returns a limit value that is 'a comfortable distance from
-            the end of the stack'. Our concept of this is currently 1 page
-            away from the end, however the default value may be tuned in
-            the future, and clients may override passing a larger delta;
-            should only be called on StackBounds object representing the
-            stack of the thread this method is called on (checked by
-            checkConsistency).
-        (WTF::StackBounds::recursionCheck):
-            Checks whether we are currently 'a comfortable distance from
-            the end of the stack'. Our concept of this is currently 1 page
-            away from the end, however the default value may be tuned in
-            the future, and clients may override passing a larger delta
-            to apply when checking, if they wish to do so. This method
-            should only be called on StackBounds object representing the
-            stack of the thread this method is called on (checked by
-            checkConsistency).
-        (WTF::StackBounds::current):
-            Approximate current stack position. On machines where the stack
-            is growing downwards this is the lowest address that might need
-            conservative collection.
-        (WTF::StackBounds::isGrowingDownward):
-            True for all platforms other than WINCE, which has to check.
-        (WTF::StackBounds::checkConsistency):
-            This is called in methods that shoulds only be operating on a
-            valid set of bounds; as such we expect m_origin != m_bounds
-            (i.e. stack size != zero) - we're really testing that this
-            object is not null (the constructor initializes both fields
-            to zero).  Also checks that current() is within the stack's
-            bounds.
-        * wtf/WTFThreadData.cpp:
-        (WTF::WTFThreadData::WTFThreadData):
-        * wtf/WTFThreadData.h:
-        (WTF::WTFThreadData::stack):
-            Add the StackBounds member variable.
-
-2010-12-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Factored common page set management into a new PageBlock base class
-        https://bugs.webkit.org/show_bug.cgi?id=51285
-
-        * Android.mk:
-        * CMakeLists.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * interpreter/RegisterFile.h:
-        (JSC::RegisterFile::RegisterFile):
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutableAllocator::intializePageSize):
-        * wtf/PageAllocation.cpp: Removed.
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::deallocate):
-        (WTF::PageAllocation::PageAllocation):
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::commit):
-        (WTF::PageReservation::decommit):
-        (WTF::PageReservation::deallocate):
-        (WTF::PageReservation::PageReservation):
-        * wtf/wtf.pri:
-
-2010-12-17  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        RegExp Jit'ed expression crashes clicking link on yelp.com
-        https://bugs.webkit.org/show_bug.cgi?id=51284
-
-        When transitioning between an non-repeating beginning of line
-        anchored expression and the remaining refactored repeating 
-        expression, we should not clear any residual datalabel in 
-        state's m_backtrack.  It will be resolved and cleared in subsequent
-        code when linkAlternativeBacktracks() is called for the repeating
-        alternative(s).
-
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::clear):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::clearBacktrack):
-
-2010-12-17  Dan Bernstein  <mitz@apple.com>
-
-        Rubber-stamped by Mark Rowe.
-
-        Updated for the renaming of WebKitTools to Tools
-
-        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
-
-2010-12-17  Ariya Hidayat  <ariya@sencha.com>
-
-        Reviewed by Oliver Hunt.
-
-        [JSC] parseAssignmentExpression should use TreeBuilder::CreatesAST
-        https://bugs.webkit.org/show_bug.cgi?id=51268
-
-        * parser/JSParser.cpp:
-        (JSC::JSParser::parseAssignmentExpression):
-
-2010-12-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Removed RChunk from PageAllocation/PageReservation, since it's now unused.
-        https://bugs.webkit.org/show_bug.cgi?id=51276
-
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::PageAllocation):
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::PageReservation):
-
-2010-12-17  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Incorrect encoding of some constants in ARMv7 JIT
-        https://bugs.webkit.org/show_bug.cgi?id=51273
-        <rdar://problem/8650210>
-
-        When using immediate encoding 3 we need to write the byte
-        that holds a duplicated value.
-
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMThumbImmediate::makeEncodedImm):
-
-2010-12-16  Evan Martin  <evan@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [chromium] useless warnings when building on Windows
-        https://bugs.webkit.org/show_bug.cgi?id=50985
-
-        Disable some compiler warnings that aren't indicative of real problems.
-
-        * JavaScriptCore.gyp/JavaScriptCore.gyp:
-
-2010-12-16  Pratik Solanki  <psolanki@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=51166
-        ExecutableAllocator::cacheFlush should call sys_cache_control
-
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutableAllocator::cacheFlush): Use the more correct and forward looking API -
-        sys_cache_control(kCacheFunctionPrepareForExecution,...).
-
-2010-12-16  Ariya Hidayat  <ariya@sencha.com>
-
-        Reviewed by Andreas Kling.
-
-        [JSC] Const correctness in ASTBuilder and SyntaxChecker
-        https://bugs.webkit.org/show_bug.cgi?id=51141
-
-        * parser/ASTBuilder.h:
-        (JSC::ASTBuilder::getName):
-        (JSC::ASTBuilder::getType):
-        (JSC::ASTBuilder::isResolve):
-        * parser/SyntaxChecker.h:
-        (JSC::SyntaxChecker::operatorStackPop):
-
-2010-12-15  Kenneth Russell  <kbr@google.com>
-
-        Reviewed by James Robinson.
-
-        Web Audio API: port FFTFrame to MKL
-        https://bugs.webkit.org/show_bug.cgi?id=50986
-
-        Fixed bug in log2 emulation function provided for Windows port of
-        Web Audio API.
-
-        * wtf/MathExtras.h:
-        (log2):
-
-2010-12-14  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        <http://webkit.org/b/51064> Reproducible crash inside WebCore::MediaPlayerPrivateQTKit::createQTMovie when loading <video>
-
-        * wtf/text/WTFString.h: Prevent String from being implicitly convertable to bool.
-        It was previously implicitly convertible to bool on Mac via operator NSString*,
-        but since that always has a non-zero return value it would give unexpected results.
-
-2010-12-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        [Qt] [Symbian] Do not use pkg-config on Symbian as it is not supported
-        https://bugs.webkit.org/show_bug.cgi?id=50231
-
-        Guard CONFIG+=link_pkgconfig with !symbian.
-
-        * jsc.pro:
-
-2010-12-14  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Revert accidental change disabling the JIT for most platforms.
-
-        * wtf/Platform.h:
-
-2010-12-13  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Clang fails to build the JSC interpreter
-        https://bugs.webkit.org/show_bug.cgi?id=51016
-
-        Clang does not allow indirect gotos out of scopes with cleanup. GCC 4.2 allows
-        them, but it does not correctly generate the cleanup, causing a leak if the
-        cleanup decrements a reference count.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute): Put an Identifier into its own scope.
-
-2010-12-14  Carlos Garcia Campos  <cgarcia@igalia.com>
-
-        Reviewed by Martin Robinson.
-
-        [GTK] Simplify context-menu handling code
-        https://bugs.webkit.org/show_bug.cgi?id=49658
-
-        * wtf/PlatformRefPtr.h: Add leakRef()
-
-2010-12-13  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        JavaScriptCore should not use "asm volatile" outside of a function
-        https://bugs.webkit.org/show_bug.cgi?id=50991
-
-        * jit/JITStubs.cpp: Remove the volatile keyword from asm statements.
-
-2010-12-13  Steve Falkenburg  <sfalken@apple.com>
-
-        Windows production build fix.
-        Try copying ICU 4.6 in addition to 4.4 and 4.2.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeChain):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::get):
+        (JSC::JSPropertyNameIterator::markChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/Structure.h:
+        (JSC::Structure::cachedPrototypeChainSlot):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::createStructure):
 
-        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd:
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
 
-2010-12-13  Michael Saboff  <msaboff@apple.com>
+        Reviewed by Adam Roben.
 
-        Reviewed by Oliver Hunt.
+        Update Windows production build logic for new production configurations
+        https://bugs.webkit.org/show_bug.cgi?id=57494
 
-        REGRESSION: mobileme mail viewing is broken
-        https://bugs.webkit.org/show_bug.cgi?id=50884
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFProduction.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscProduction.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiProduction.vsprops:
 
-        Fixed problem where simple parenthesis (those without capture and
-        with a fixed count) where not propagating backtrack to labels for 
-        nested parentheses.  Also added the nesting level for the parentheses 
-        state created in that case as well.
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
 
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::copyBacktrackToLabel):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastTerm):
-        (JSC::Yarr::RegexGenerator::ParenthesesTail::generateCode):
-        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        Reviewed by Adam Roben.
 
-2010-12-13  Peter Varga  <pvarga@inf.u-szeged.hu>
+        Rename Windows configuration Release_LTCG to Production for clarity
+        https://bugs.webkit.org/show_bug.cgi?id=57465
 
-        Reviewed by Gavin Barraclough.
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseLTCG.vsprops.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseLTCG.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseLTCG.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFReleaseLTCG.vsprops: Removed.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseLTCG.vsprops.
+        * JavaScriptCore.vcproj/jsc/jscReleaseLTCG.vsprops: Removed.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseLTCG.vsprops.
+        * JavaScriptCore.vcproj/testapi/testapiReleaseLTCG.vsprops: Removed.
 
-        Reduce the size of the RegexStackSpaceForBackTrackInfoParentheses in YARR
-        https://bugs.webkit.org/show_bug.cgi?id=49385
+2011-03-30  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
-        Remove the BackTrackInfoParentheses struct prevBegin and prevEnd members.
+        Reviewed by Maciej Stachowiak.
 
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::Interpreter::matchParentheses):
-        (JSC::Yarr::Interpreter::backtrackParentheses):
-        * yarr/RegexPattern.h:
+        Add the NEXT_OPCODE() macro to the DFG-JIT parser
+        https://bugs.webkit.org/show_bug.cgi?id=57322
 
-2010-12-10  Michael Saboff  <msaboff@apple.com>
+        In JavaScriptCore we use macros to jump to the next opcode
+        (both in interpreter and JIT). This macro is added to the
+        DFG-JIT parser as well.
 
-        Reviewed by Gavin Barraclough.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
 
-        REGRESSION Hang inside Yarr::RegexCodeBlock::execute when visiting
-        bugs.webkit.org
-        https://bugs.webkit.org/show_bug.cgi?id=50816
-
-        First nested parentheses of the second or greater alternative
-        where backtracking to the prior parentheses.  Changed the default
-        handling of initial parentheses for all alternatives to go back
-        to the immediate outer paren.
-
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::GenerationState::addParenthesesTail):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::TermGenerationState):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastTerm):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::getTermIndex):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::setParenthesesTail):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::getParenthesesTail):
-        (JSC::Yarr::RegexGenerator::ParenthesesTail::ParenthesesTail):
-        (JSC::Yarr::RegexGenerator::ParenthesesTail::processBacktracks):
-        (JSC::Yarr::RegexGenerator::ParenthesesTail::generateCode):
-        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
-
-2010-12-11  Patrick Gansterer  <paroga@webkit.org>
+2011-03-29  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Darin Adler.
 
-        Add an overload to makeString for Vector<char>
-        https://bugs.webkit.org/show_bug.cgi?id=50123
-
-        Also cleanup StringTypeAdapter.
-
-        * wtf/text/StringConcatenate.h:
-
-2010-12-10  Siddharth Mathur  <siddharth.mathur@nokia.com>
-
-        Reviewed by Eric Seidel.
-
-        [Qt] Build fix for Symbian: don't compile POSIX memory management implementation 
-        https://bugs.webkit.org/show_bug.cgi?id=50707
-
-        * wtf/wtf.pri:
-
-2010-12-10  Steve Falkenburg  <sfalken@apple.com>
-
-        Windows production build fix.
+        ~25% regression on v8-splay in the SunSpider harness
+        https://bugs.webkit.org/show_bug.cgi?id=56128
         
-        Don't stop if react-to-vsprops-changes.py exits with an error,
-        since this will occur in production builds.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
-
-2010-12-10  Brian Weinstein  <bweinstein@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Turn on USE(CROSS_PLATFORM_CONTEXT_MENUS) for Windows.
+        I'm not sure if this is the root cause of the regression Stephanie
+        measured, but it seems to get us back to previous v8-splay times.
+        
+        SunSpider reports no change. v8-splay says 41% faster.
 
-        * wtf/Platform.h:
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset): Make marking proportional to 1X the size of the heap,
+        not .5X the size of the heap. When the heap is large, this makes a big
+        difference. (Our old heap growth policy matched this. You can see by
+        looking at resizeBlocks in revisions prior to r77699.)
 
-2010-12-10  Martin Robinson  <mrobinson@igalia.com>
+2011-03-29  Steve Falkenburg  <sfalken@apple.com>
 
-        Unreviewed, rolling out r73703.
-        http://trac.webkit.org/changeset/73703
-        https://bugs.webkit.org/show_bug.cgi?id=49658
+        Reviewed by Darin Adler.
 
-        This patch is causing crashes on the GTK+ bots.
+        Use per-configuration vsprops in JavaScriptCore to avoid WebKitVSPropsRedirectionDir removal by MSVC IDE
+        https://bugs.webkit.org/show_bug.cgi?id=57350
+        
+        Visual Studio's IDE was removing instances of $(WebKitVSPropsRedirectionDir) from
+        InheritedPropertySheet rules in our vcproj files when the vcproj was edited from within
+        the IDE. To avoid this, add a separate vsprops file for each project configuration that
+        contains the required inherited property sheets.
 
-        * wtf/PlatformRefPtr.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseLTCG.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFReleaseLTCG.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscReleaseLTCG.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiReleaseLTCG.vsprops: Added.
 
-2010-12-10  Patrick Gansterer  <paroga@webkit.org>
+2011-03-29  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Eric Seidel.
 
-        Cleanup StringWx.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=50525
+        REGRESSION(r82173): Causes assertion and test failures in run-javascriptcore-tests on Windows (Requested by aroben on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=57333
 
-        Use StringImpl::createUninitialized to avoid memcpy and fix style issues.
+        constructDate now takes the global object explicitly as it may be called
+        by functions other than the constructor itself.
 
-        * wtf/wx/StringWx.cpp:
-        (WTF::String::String):
-
-2010-12-10  Carlos Garcia Campos  <cgarcia@igalia.com>
-
-        Reviewed by Martin Robinson.
-
-        [GTK] Simplify context-menu handling code
-        https://bugs.webkit.org/show_bug.cgi?id=49658
-
-        * wtf/PlatformRefPtr.h:
-
-2010-12-09  Michael Saboff  <msaboff@apple.com>
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeDate):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::constructWithDateConstructor):
+        * runtime/DateConstructor.h:
 
-        Reviewed by Gavin Barraclough.
+2011-03-29  Ben Taylor  <bentaylor.solx86@gmail.com>
 
-        REGRESSION (r73065?): A regex no longer works 
-        https://bugs.webkit.org/show_bug.cgi?id=50570
-
-        Changed the handling of adjacent parentheses backtracks in two ways.
-        First, only outer most paren backtracks default to back tracking
-        to the "next character" looping code.  Second, added a jump around 
-        backtracks that fall through to the next backtrack where the
-        second backtrack has some greedy processing before the backtracking
-        from outside the parentheses code.
-        Also cleaned up extraneous white spce, removing white space at the
-        end of or that makes up a whole line.
-
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::GenerationState::GenerationState):
-        (JSC::Yarr::RegexGenerator::GenerationState::incrementParenNestingLevel):
-        (JSC::Yarr::RegexGenerator::GenerationState::decrementParenNestingLevel):
-        (JSC::Yarr::RegexGenerator::GenerationState::addParenthesesTail):
-        (JSC::Yarr::RegexGenerator::GenerationState::emitParenthesesTail):
-        (JSC::Yarr::RegexGenerator::ParenthesesTail::ParenthesesTail):
-        (JSC::Yarr::RegexGenerator::ParenthesesTail::setNextIteration):
-        (JSC::Yarr::RegexGenerator::ParenthesesTail::generateCode):
-        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
-
-2010-12-09  Michael Saboff  <msaboff@apple.com>
+        Reviewed by Benjamin Poulain.
 
-        Reviewed by Geoffrey Garen.
+        https://bugs.webkit.org/show_bug.cgi?id=41953
 
-        Addressed the "FIXME" issues in array sort for toString() methods that
-        mutate the array in either size or contents.  The change is to mark
-        the temporary array contents so that they are not garbage collected
-        and to make sure the array is large enough to hold the contents
-        of the sorted temporary vector.
-        https://bugs.webkit.org/show_bug.cgi?id=50718
+        Fix compile error on Solaris 10/Sun Studio 12 CC emanating from MathExtras.h
 
-        * runtime/Collector.cpp:
-        (JSC::Heap::addTempSortVector):
-        (JSC::Heap::removeTempSortVector):
-        (JSC::Heap::markTempSortVectors):
-        (JSC::Heap::markRoots):
-        * runtime/Collector.h:
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::sort):
-        * runtime/JSValue.h:
+        * wtf/MathExtras.h:
 
-2010-12-09  Michael Saboff  <msaboff@apple.com>
+2011-03-29  Ben Taylor  <bentaylor.solx86@gmail.com>
 
         Reviewed by Darin Adler.
 
-        Changed setting of backtrack labels to not overwrite a prior
-        label.  Where losing prior labe which then reverted back to 
-        next character label.
-        https://bugs.webkit.org/show_bug.cgi?id=50579
-
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::setBacktrackToLabel):
-
-2010-12-08  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Permit Character Class Escape in CharacterRange in Character Class.
-        https://bugs.webkit.org/show_bug.cgi?id=50483
-        https://bugs.webkit.org/show_bug.cgi?id=50538
-        https://bugs.webkit.org/show_bug.cgi?id=50654
-        https://bugs.webkit.org/show_bug.cgi?id=50646
-
-        We recently tightened up our spec conformance in generating syntax
-        error in these cases, however testing in the wild has shown this
-        to be problematic. This reverts the previous change in allowing
-        class escapes (e.g. \d) in ranges in character classes ([]), but
-        does retain some closer conformance to the spec in only allowing
-        ranges that would be permitted per the grammar rules in the spec
-        (e.g. in /[\d-a-z]/ "a-z" cannot be considered as a range).
-
-        * yarr/RegexParser.h:
-        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
-        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
-        (JSC::Yarr::Parser::parse):
-
-2010-12-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Try to fix crash-on-launch seen on Windows builder.
-
-        * wtf/OSAllocatorWin.cpp:
-        (WTF::OSAllocator::release): Disabled an ASSERT, because it checks for
-        a bug that hasn't been fixed yet.
-
-2010-12-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated .def file.
-
-2010-12-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated .def
-        file to remove a symbol -- the next build failure will say which symbol
-        to add back.
-
-2010-12-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated .def file.
-
-2010-12-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix GTK Linux build.
-
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutablePool::systemAlloc):
-        * runtime/AlignedMemoryAllocator.h:
-        (JSC::::AlignedMemoryAllocator): Updated for Usage enum moving to OSAllocator.
-
-2010-12-07  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Migrated OS-specific allocation code from PageReservation and PageAllocation to OSAllocator
-        https://bugs.webkit.org/show_bug.cgi?id=50653
-
-        * JavaScriptCore.exp: Updated for new function signature.
-
-        * interpreter/RegisterFile.h:
-        (JSC::RegisterFile::RegisterFile):
-        (JSC::RegisterFile::grow):
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::reuse):
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator): Removed checkAllocatedOkay.
-        OSAllocator is now the central location for verifying that allocation succeeds.
-        This allowed me to remove some complicating cross-platform cruft.
-
-        * runtime/AlignedMemoryAllocator.h:
-        (JSC::::allocate): Updated for code motion.
-
-        * wtf/OSAllocator.h: Added Usage, writable, and executable parameters, to
-        support VM features required by clients of PageAllocation and PageReservation.
-
-        * wtf/OSAllocatorPosix.cpp:
-        (WTF::OSAllocator::reserve):
-        (WTF::OSAllocator::reserveAndCommit):
-        (WTF::OSAllocator::commit): Moved PageAllocation support for randomizing
-        executable memory here.
-
-        * wtf/OSAllocatorSymbian.cpp:
-        (WTF::OSAllocator::reserve):
-        (WTF::OSAllocator::reserveAndCommit):
-        (WTF::OSAllocator::commit): Updated for new function signatures.
-
-        * wtf/OSAllocatorWin.cpp:
-        (WTF::protection):
-        (WTF::OSAllocator::reserve):
-        (WTF::OSAllocator::reserveAndCommit):
-        (WTF::OSAllocator::commit):
-        (WTF::OSAllocator::release): Updated for new function signatures. Moved
-        some protection-related and WINCE-related code from PageAllocation here.
-
-        * wtf/PageAllocation.cpp: Nixed cross-platform lastError abstraction, since
-        it was only used by checkAllocatedOkay, which is now gone.
-
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::allocate):
-        (WTF::PageAllocation::allocateAligned):
-        (WTF::PageAllocation::deallocate):
-        (WTF::PageAllocation::isPowerOfTwo):
-        (WTF::PageAllocation::systemAllocateAligned): Removed system* functions,
-        and replaced calls to them with calls to OSAllocator.
-
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::commit):
-        (WTF::PageReservation::decommit):
-        (WTF::PageReservation::reserve):
-        (WTF::PageReservation::deallocate):
-        (WTF::PageReservation::PageReservation): Ditto. Added m_writable and
-        m_executable because these flags are now required when committing memory.
-
-2010-12-08  Chris Rogers  <crogers@google.com>
-
-        Reviewed by Kenneth Russell.
-
-        Add web audio files to mac port Xcode projects
-        https://bugs.webkit.org/show_bug.cgi?id=50721
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2010-12-08  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Marking the active global object re-enters through markConservatively
-        https://bugs.webkit.org/show_bug.cgi?id=50711
-
-        draining of the MarkStack is not allowed to be re-entrant, we got away
-        with this simply due to the logic in MarkStack::drain implicitly handling
-        changes that could be triggered by the re-entry.
-
-        Just to be safe this patch removes the re-entry through markConservatively
-        so we don't accidentally introduce such an issue in future.  I've also
-        added an assertion to catch such errors.
-
-        * runtime/Collector.cpp:
-        (JSC::Heap::markConservatively):
-        (JSC::Heap::markCurrentThreadConservativelyInternal):
-        (JSC::Heap::markOtherThreadConservatively):
-        * runtime/JSArray.h:
-        (JSC::MarkStack::drain):
-        * runtime/MarkStack.h:
-        (JSC::MarkStack::MarkStack):
+        https://bugs.webkit.org/show_bug.cgi?id=57231
+        Add conditional for SUNCC supporting alignment macros
 
-2010-12-08  Chris Marrin  <cmarrin@apple.com>
+        Compile fix for Solaris 10/Sun Studio 12 CC
 
-        Reviewed by Simon Fraser.
-
-        Share code between Mac (CA) and Windows (CACF) GraphicsLayer implementations
-        https://bugs.webkit.org/show_bug.cgi?id=49388
-
-        Added a WTF_PLATFORM_CA flag. Set when platform is MAC or IOS or (WINDOWS AND CG)
-        which was decided was the best way to identify a build with CoreAnimation
-
-        * wtf/Platform.h:
-
-2010-12-07  Anders Carlsson  <andersca@apple.com>
-
-        Build fix follow up build fix.
-
-        * pcre/pcre_ucp_searchfuncs.cpp:
-        (jsc_pcre_ucp_othercase):
+        * wtf/Vector.h:
 
-2010-12-07  Anders Carlsson  <andersca@apple.com>
+2011-03-29  Ben Taylor  <bentaylor.solx86@gmail.com>
 
         Reviewed by Darin Adler.
 
-        Fix clang++ build
-        https://bugs.webkit.org/show_bug.cgi?id=50645
-
-        Explicitly cast offset to int.
+        https://bugs.webkit.org/show_bug.cgi?id=57256
 
-        * pcre/pcre_ucp_searchfuncs.cpp:
-        (jsc_pcre_ucp_othercase):
+        Fix crash on misaligned reads on Solaris 10/Sparc
 
-2010-12-07  Kenneth Russell  <kbr@google.com>
-
-        Reviewed by David Levin.
-
-        Fix compilation of core web audio files on Windows
-        https://bugs.webkit.org/show_bug.cgi?id=50603
-
-        Added log2 definition to MathExtras.h on Windows platform.
+        * wtf/text/AtomicString.cpp:
+        (WTF::equal):
 
-        * wtf/MathExtras.h:
-        (log2):
+2011-03-28  Oliver Hunt  <oliver@apple.com>
 
-2010-12-07  Antti Koivisto  <antti@apple.com>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Gavin Barraclough.
+        instanceof Array test fails when using iframes
+        https://bugs.webkit.org/show_bug.cgi?id=17250
 
-        https://bugs.webkit.org/show_bug.cgi?id=50412
-        http://www.wunderground.com/US/CA/Hayward.html causes big memory spike during page loading 
-        
-        Creating a substring caused the original string be flattened if it was in the rope form. This could use
-        significant amount of memory by reducing buffer sharing between strings.
-        
-        Add a rope specific substring function that constructs the substring by reusing the rope fibers
-        instead of flattening the rope.
-        
-        No change observed in SunSpider.
+        This is a problem with all built in constructors, the use of
+        lexicalGlobalObject rather than the constructors own 
+        global object reference means that a builtin will always use
+        the prototype from the lexical global object rather than that
+        of the constructors origin.
 
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeRegExp):
+        * JavaScriptCore.exp:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanConstructor.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DateInstance.cpp:
+        * runtime/DateInstance.h:
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructWithErrorConstructor):
+        (JSC::callErrorConstructor):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructWithFunctionConstructor):
+        (JSC::callFunctionConstructor):
+        (JSC::constructFunction):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getOwnPropertySlot):
+        (JSC::JSCell::put):
+        (JSC::JSCell::deleteProperty):
+        (JSC::JSCell::toThisObject):
+        (JSC::JSCell::toObject):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toObject):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toObject):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::toObject):
+        * runtime/JSObject.h:
         * runtime/JSString.cpp:
-        (JSC::JSString::substringFromRope):
+        (JSC::StringObject::create):
+        (JSC::JSString::toObject):
+        (JSC::JSString::toThisObject):
         * runtime/JSString.h:
-        (JSC::jsSubstring):
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncSubstr):
-        (JSC::stringProtoFuncSubstring):
-
-2010-12-06  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Simplified some ASLR-related code in PageAllocation/Reservation
-        https://bugs.webkit.org/show_bug.cgi?id=50599
-        
-        Removed reserveAt, allocateAt, and friends, since they all existed to
-        serve one feature: ASLR for executable memory on x86_64 on Mac. Moved
-        ASLR code down into systemAllocate -- now, any time you allocate
-        executable memory on a supporting platform, the memory's location is
-        randomized.
-
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator): No need for the caller
-        to randomize anything.
-
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::systemAllocate): Removed some *At() functions, and
-        beefed up executable allocation with randomization.
-
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::systemReserve): Removed some *At() functions.
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::toThisObjectSlowCase):
+        (JSC::JSValue::synthesizeObject):
+        * runtime/JSValue.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::constructWithObjectConstructor):
+        (JSC::callObjectConstructor):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        (JSC::constructWithRegExpConstructor):
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::constructWithStringConstructor):
+        * runtime/StringObject.h:
 
-2010-12-06  Geoffrey Garen  <ggaren@apple.com>
+2011-03-28  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Maciej Stachowiak.
+        Reviewed by Oliver Hunt.
 
-        reserveAndCommit doesn't commit on MADVISE_FREE_REUSE systems
-        https://bugs.webkit.org/show_bug.cgi?id=50588
+        REGRESSION [r78794-r79249] Allocation of memory is slow when number of active objects is large
+        https://bugs.webkit.org/show_bug.cgi?id=56823
         
-        * wtf/OSAllocatorPosix.cpp:
-        (WTF::OSAllocator::reserve):
-        (WTF::OSAllocator::reserveAndCommit):
-        (WTF::OSAllocator::commit): Tightened up some comments. Changed
-        reserveAndCommit to actually commit on MADVISE_FREE_REUSE systems.
-
-2010-12-06  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Andreas Kling.
-
-        [WINCE] Add build system
-        https://bugs.webkit.org/show_bug.cgi?id=50522
-
-        * CMakeListsWinCE.txt: Added.
-        * shell/CMakeListsWinCE.txt: Added.
-        * wtf/CMakeListsWinCE.txt: Added.
-
-2010-12-06  John Tantalo  <john.tantalo@gmail.com>
-
-        Reviewed by Geoffrey Garen.
-
-        jsc does not ignore shebang
-        https://bugs.webkit.org/show_bug.cgi?id=49576
-
-        * jsc.cpp:
-        (fillBufferWithContentsOfFile):
-          - translate shebang into a valid JavaScript comment so the lexer ignores it
-
-2010-12-05  Adam Roben  <aroben@apple.com>
-
-        Windows production build fix
-
-        Put spaces after trailing backslashes when setting
-        %WebKitVSPropsRedirectionDir%. According to MSDN
-        <http://msdn.microsoft.com/en-us/library/2kzfk8c7(v=VS.80).aspx>:
+        Partial fix for most of the problem. (TOT still shows a regression, though.)
 
-           A backslash ( \ ) followed by a newline character is interpreted as
-           a space in the command; use a backslash at the end of a line to
-           continue a command onto the next line. NMAKE interprets the
-           backslash literally if any other character, including a space or
-           tab, follows the backslash.
-
-        * JavaScriptCore.vcproj/JavaScriptCore.make:
-
-2010-12-04  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed, build fix after r69132.
-
-        * shell/CMakeLists.txt: Fix directory name (jsc -> shell).
-
-2010-12-04  Xan Lopez  <xlopez@igalia.com>
+        * runtime/Heap.cpp:
+        (JSC::Heap::reportExtraMemoryCostSlowCase): Use highWaterMark(), instead of
+        capacity(), since capacity() is O(n) relative to the size of the heap.
 
-        Reviewed by Martin Robinson.
+        In limited circumstances, capacity() is also worse than highWaterMark()
+        for measuring extra cost relative to heap size, since capacity() only
+        measures the *current* capacity of the heap, but the heap will grow if
+        necessary to attain highWaterMark().
 
-        [GTK] Drop GdkDrawable usage, it's deprecated in GTK+3.x and we can use GdkWindow
-        https://bugs.webkit.org/show_bug.cgi?id=50451
+2011-03-28  Oliver Hunt  <oliver@apple.com>
 
-        * wtf/gobject/GTypedefs.h: add GdkWindow defines.
+        REGRESSION(r82130): It made all tests crash (Requested by Ossy on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=57251
 
-2010-12-03  Gavin Barraclough  <barraclough@apple.com>
+        Build fix, had remnant of another patch in r82130
 
-        Rubber stamped by Oliver Hunt.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
 
-        Bug 50509 - set* methods on MacroAssembler are awfully named.
+2011-03-27  Oliver Hunt  <oliver@apple.com>
 
-        Methods set32 and setTest32 compare 32-bit operands, and set a 32-bit results based on the comparison.
-        set8 compares 32-bit operands, and sets an 8-bit result based on the comparison.
-        setTest8 compares 8-bit operands, and sets a 32-bit result based on the comparison.
+        Reviewed by Maciej Stachowiak.
 
-        Rename to clarify.
+        Add additional immediate types to allow us to distinguish the source of a JIT immediate
+        https://bugs.webkit.org/show_bug.cgi?id=57190
 
-        set32 -> set32Compare32
-        setTest32 -> set32Test32
-        set8 -> set8Compare32
-        setTest8 -> set32Test8
+        Allow us to distinguish whether a JIT immediate is a value that we
+        control (TrustedImm32 and TrustedImmPtr) vs. ones that can be controlled
+        or influenced by code we are compiling.  Currently we do nothing with this
+        information -- this change is large and mechanical but would obscure any
+        logic changes that we would have made.
 
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
+        (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr):
+        (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32):
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
         * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::pop):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::andPtr):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::xorPtr):
         (JSC::MacroAssembler::setPtr):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::branchTestPtr):
+        (JSC::MacroAssembler::branchSubPtr):
+        (JSC::MacroAssembler::branchTest8):
         * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::add32):
+        (JSC::MacroAssemblerARM::and32):
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::mul32):
+        (JSC::MacroAssemblerARM::or32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::urshift32):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::xor32):
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::push):
+        (JSC::MacroAssemblerARM::move):
+        (JSC::MacroAssemblerARM::branch8):
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARM::branch16):
+        (JSC::MacroAssemblerARM::branchTest8):
+        (JSC::MacroAssemblerARM::branchTest32):
+        (JSC::MacroAssemblerARM::branchAdd32):
+        (JSC::MacroAssemblerARM::branchMul32):
+        (JSC::MacroAssemblerARM::branchSub32):
         (JSC::MacroAssemblerARM::set32Compare32):
         (JSC::MacroAssemblerARM::set8Compare32):
         (JSC::MacroAssemblerARM::set32Test32):
         (JSC::MacroAssemblerARM::set32Test8):
+        (JSC::MacroAssemblerARM::moveWithPatch):
+        (JSC::MacroAssemblerARM::branchPtrWithPatch):
+        (JSC::MacroAssemblerARM::storePtrWithPatch):
         * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::add32):
+        (JSC::MacroAssemblerARMv7::and32):
+        (JSC::MacroAssemblerARMv7::lshift32):
+        (JSC::MacroAssemblerARMv7::mul32):
+        (JSC::MacroAssemblerARMv7::or32):
+        (JSC::MacroAssemblerARMv7::rshift32):
+        (JSC::MacroAssemblerARMv7::urshift32):
+        (JSC::MacroAssemblerARMv7::sub32):
+        (JSC::MacroAssemblerARMv7::xor32):
+        (JSC::MacroAssemblerARMv7::load32):
+        (JSC::MacroAssemblerARMv7::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARMv7::load16):
+        (JSC::MacroAssemblerARMv7::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARMv7::store32):
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        (JSC::MacroAssemblerARMv7::push):
+        (JSC::MacroAssemblerARMv7::move):
+        (JSC::MacroAssemblerARMv7::compare32):
+        (JSC::MacroAssemblerARMv7::test32):
+        (JSC::MacroAssemblerARMv7::branch32):
+        (JSC::MacroAssemblerARMv7::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARMv7::branch16):
+        (JSC::MacroAssemblerARMv7::branch8):
+        (JSC::MacroAssemblerARMv7::branchTest32):
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        (JSC::MacroAssemblerARMv7::branchAdd32):
+        (JSC::MacroAssemblerARMv7::branchMul32):
+        (JSC::MacroAssemblerARMv7::branchSub32):
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
         (JSC::MacroAssemblerARMv7::set32Compare32):
         (JSC::MacroAssemblerARMv7::set8Compare32):
         (JSC::MacroAssemblerARMv7::set32Test32):
         (JSC::MacroAssemblerARMv7::set32Test8):
+        (JSC::MacroAssemblerARMv7::moveWithPatch):
+        (JSC::MacroAssemblerARMv7::branchPtrWithPatch):
+        (JSC::MacroAssemblerARMv7::storePtrWithPatch):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+        (JSC::MacroAssemblerARMv7::makeJump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+        (JSC::MacroAssemblerARMv7::setupArmAddress):
+        (JSC::MacroAssemblerARMv7::makeBaseIndexBase):
+        (JSC::MacroAssemblerARMv7::moveFixedWidthEncoding):
         * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::add32):
+        (JSC::MacroAssemblerMIPS::and32):
+        (JSC::MacroAssemblerMIPS::lshift32):
+        (JSC::MacroAssemblerMIPS::mul32):
+        (JSC::MacroAssemblerMIPS::or32):
+        (JSC::MacroAssemblerMIPS::rshift32):
+        (JSC::MacroAssemblerMIPS::urshift32):
+        (JSC::MacroAssemblerMIPS::sub32):
+        (JSC::MacroAssemblerMIPS::xor32):
+        (JSC::MacroAssemblerMIPS::load32):
+        (JSC::MacroAssemblerMIPS::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::store32):
+        (JSC::MacroAssemblerMIPS::push):
+        (JSC::MacroAssemblerMIPS::move):
+        (JSC::MacroAssemblerMIPS::branch8):
+        (JSC::MacroAssemblerMIPS::branch32):
+        (JSC::MacroAssemblerMIPS::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::branch16):
+        (JSC::MacroAssemblerMIPS::branchTest32):
+        (JSC::MacroAssemblerMIPS::branchTest8):
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+        (JSC::MacroAssemblerMIPS::branchMul32):
+        (JSC::MacroAssemblerMIPS::branchSub32):
         (JSC::MacroAssemblerMIPS::set8Compare32):
         (JSC::MacroAssemblerMIPS::set32Compare32):
         (JSC::MacroAssemblerMIPS::set32Test8):
         (JSC::MacroAssemblerMIPS::set32Test32):
+        (JSC::MacroAssemblerMIPS::moveWithPatch):
+        (JSC::MacroAssemblerMIPS::branchPtrWithPatch):
+        (JSC::MacroAssemblerMIPS::storePtrWithPatch):
+        (JSC::MacroAssemblerMIPS::tailRecursiveCall):
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::storeDouble):
+        (JSC::MacroAssemblerMIPS::branchTruncateDoubleToInt32):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::add32):
+        (JSC::MacroAssemblerX86::addWithCarry32):
+        (JSC::MacroAssemblerX86::and32):
+        (JSC::MacroAssemblerX86::or32):
+        (JSC::MacroAssemblerX86::sub32):
+        (JSC::MacroAssemblerX86::store32):
+        (JSC::MacroAssemblerX86::branch32):
+        (JSC::MacroAssemblerX86::moveWithPatch):
+        (JSC::MacroAssemblerX86::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86::storePtrWithPatch):
         * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::lshift32):
+        (JSC::MacroAssemblerX86Common::mul32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::rshift32):
+        (JSC::MacroAssemblerX86Common::urshift32):
+        (JSC::MacroAssemblerX86Common::sub32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::store32):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::push):
+        (JSC::MacroAssemblerX86Common::move):
+        (JSC::MacroAssemblerX86Common::branch8):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerX86Common::branch16):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
         (JSC::MacroAssemblerX86Common::set8Compare32):
         (JSC::MacroAssemblerX86Common::set32Compare32):
         (JSC::MacroAssemblerX86Common::set32Test8):
         (JSC::MacroAssemblerX86Common::set32Test32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::add32):
+        (JSC::MacroAssemblerX86_64::and32):
+        (JSC::MacroAssemblerX86_64::or32):
+        (JSC::MacroAssemblerX86_64::sub32):
+        (JSC::MacroAssemblerX86_64::loadDouble):
+        (JSC::MacroAssemblerX86_64::addDouble):
+        (JSC::MacroAssemblerX86_64::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86_64::store32):
+        (JSC::MacroAssemblerX86_64::call):
+        (JSC::MacroAssemblerX86_64::tailRecursiveCall):
+        (JSC::MacroAssemblerX86_64::makeTailRecursiveCall):
+        (JSC::MacroAssemblerX86_64::addPtr):
+        (JSC::MacroAssemblerX86_64::andPtr):
+        (JSC::MacroAssemblerX86_64::orPtr):
+        (JSC::MacroAssemblerX86_64::subPtr):
+        (JSC::MacroAssemblerX86_64::xorPtr):
+        (JSC::MacroAssemblerX86_64::storePtr):
+        (JSC::MacroAssemblerX86_64::setPtr):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (JSC::MacroAssemblerX86_64::moveWithPatch):
+        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        (JSC::MacroAssemblerX86_64::branchTest8):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::callOperation):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::jitAssertIsInt32):
+        (JSC::DFG::JITCompiler::emitCount):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::emitPutImmediateToCallFrameHeader):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitTimeoutCheck):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_urshift):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emit_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emit_op_jlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitRightShift):
+        (JSC::JIT::emitRightShiftSlowCase):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSub32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutCellToCallFrameHeader):
+        (JSC::JIT::emitPutIntToCallFrameHeader):
+        (JSC::JIT::emitPutImmediateToCallFrameHeader):
+        (JSC::JIT::emitLoadCharacterString):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::setSamplingFlag):
+        (JSC::JIT::clearSamplingFlag):
+        (JSC::JIT::emitCount):
+        (JSC::JIT::sampleInstruction):
+        (JSC::JIT::sampleCodeBlock):
+        (JSC::JIT::emitStoreInt32):
+        (JSC::JIT::emitStoreCell):
+        (JSC::JIT::emitStoreBool):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitTagAsBoolImmediate):
         * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_eq):
-        (JSC::JIT::emit_op_neq):
-        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_push_new_scope):
+        (JSC::JIT::emit_op_catch):
         (JSC::JIT::emit_op_eq_null):
         (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_init_lazy_reg):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_convert_this_strict):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
+        (JSC::JIT::emit_op_new_regexp):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emitSlow_op_load_varargs):
+        (JSC::JIT::emit_op_new_func):
         * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_tear_off_arguments):
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
         (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
         (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
         (JSC::JIT::compileOpStrictEq):
         (JSC::JIT::emit_op_eq_null):
         (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_push_new_scope):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_convert_this_strict):
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::softModulo):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::emit_op_get_by_pname):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument):
+        * jit/JITStubs.cpp:
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitJumpIfNotJSCell):
+        (JSC::JSInterfaceJIT::emitLoadInt32):
+        (JSC::JSInterfaceJIT::emitLoadDouble):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::loadJSStringArgument):
+        (JSC::SpecializedThunkJIT::tagReturnAsInt32):
+        (JSC::SpecializedThunkJIT::tagReturnAsJSCell):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charToString):
+        (JSC::powThunkGenerator):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::matchCharacterClass):
+        (JSC::Yarr::YarrGenerator::storeToFrame):
+        (JSC::Yarr::YarrGenerator::storeToFrameWithPatch):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterSingle):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+        (JSC::Yarr::YarrGenerator::generateDisjunction):
 
-2010-12-03  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Incorrect logic for returning memory at the end of linking.
-        Reviewed by Geoff Garen.
-
-        At the end of linking we return any space at the end of the
-        allocated executable region that was saved due to branch
-        compaction.  This is currently by done by subtracting the
-        different from the m_freePtr in the allocation pool.  This
-        can be incorrect if your allocation was made from a new
-        page that was not selected for subsequent allocations.
-
-        This patch corrects this behaviour by verifying that the
-        memory being returned actually comes from the current
-        allocation pool.
-
-        * assembler/LinkBuffer.h:
-        (JSC::LinkBuffer::linkCode):
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutablePool::tryShrink):
-
-2010-12-03  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Gavin Barraclough
-
-        Changes to significantly reduce branches to branches in JIT'ed
-        parentheses backtrack processing.  The changes include the following:
-        - Taking the backtracking processing out of line and adding it as
-          code at the end of the JIT'ed routine.
-        - Allow backtracks to be direct via an indirect branch for an address
-          pushed onto the stack.  If the use of an indirect branch is from a
-          conditional jump, then we emit a trampoline at the end of the 
-          routine.
-        - Propogate backtracks instead of adding trampolines.  Backtracks are
-          propogated to where they are used.  This change also eliminated 
-          trampoline branch code that aren't used.
-        - Added global expression state to keep track of parentheses tail
-          code and indirect branches.
-        Other changes made to support these changes.
-        - Split invertOrCapture flag on Patterns to two separate flags.  Added
-          getters for these flags.  Rippled these changes to both the JIT 
-          and interpreter code.
-        - Split BacktrackDestination out off TermGenerationState struct.
-          This is done to hold references to a backtrack for later code
-          generation.
-        https://bugs.webkit.org/show_bug.cgi?id=50295
-
-        * assembler/ARMAssembler.h:
-        (JSC::ARMAssembler::JmpDst::isSet):
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::JmpDst::isSet):
-        * assembler/AbstractMacroAssembler.h:
-        (JSC::AbstractMacroAssembler::Label::isSet):
-        (JSC::AbstractMacroAssembler::DataLabelPtr::isUsed):
-        (JSC::AbstractMacroAssembler::DataLabelPtr::used):
-        (JSC::AbstractMacroAssembler::JumpList::clear):
-        * assembler/MIPSAssembler.h:
-        (JSC::MIPSAssembler::JmpDst::isSet):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::JmpDst::isSet):
-        * yarr/RegexCompiler.cpp:
-        (JSC::Yarr::RegexPatternConstructor::atomParenthesesSubpatternBegin):
-        (JSC::Yarr::RegexPatternConstructor::atomParentheticalAssertionBegin):
-        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
-        (JSC::Yarr::RegexPatternConstructor::setupAlternativeBeginTerms):
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
-        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
-        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
-        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
-        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
-        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
-        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
-        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
-        (JSC::Yarr::ByteCompiler::emitDisjunction):
-        * yarr/RegexInterpreter.h:
-        (JSC::Yarr::ByteTerm::ByteTerm):
-        (JSC::Yarr::ByteTerm::BackReference):
-        (JSC::Yarr::ByteTerm::invert):
-        (JSC::Yarr::ByteTerm::capture):
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::IndirectJumpEntry::IndirectJumpEntry):
-        (JSC::Yarr::RegexGenerator::IndirectJumpEntry::addJump):
-        (JSC::Yarr::RegexGenerator::GenerationState::GenerationState):
-        (JSC::Yarr::RegexGenerator::GenerationState::addIndirectJumpEntry):
-        (JSC::Yarr::RegexGenerator::GenerationState::emitIndirectJumpTable):
-        (JSC::Yarr::RegexGenerator::GenerationState::addParenthesesTail):
-        (JSC::Yarr::RegexGenerator::GenerationState::emitParenthesesTail):
-        (JSC::Yarr::RegexGenerator::GenerationState::addJumpToNextInteration):
-        (JSC::Yarr::RegexGenerator::GenerationState::addJumpsToNextInteration):
-        (JSC::Yarr::RegexGenerator::GenerationState::addDataLabelToNextIteration):
-        (JSC::Yarr::RegexGenerator::GenerationState::linkToNextIteration):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::BacktrackDestination):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::clear):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::clearDataLabel):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::haveDestination):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::isStackOffset):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::isLabel):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::isJumpList):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::haveDataLabel):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::copyTarget):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::copyTo):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::addBacktrackJump):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::setStackOffset):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::setLabel):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::setNextBacktrackLabel):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::setBacktrackToLabel):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::setBacktrackJumpList):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::setBacktrackSourceLabel):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::setDataLabel):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::setSubDataLabelPtr):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::linkToNextBacktrack):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::getStackOffset):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::getLabel):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::getBacktrackJumps):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::getDataLabel):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::jumpToBacktrack):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::linkDataLabelToHereIfExists):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::plantJumpToBacktrackIfExists):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::linkAlternativeBacktracks):
-        (JSC::Yarr::RegexGenerator::BacktrackDestination::linkAlternativeBacktracksTo):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::TermGenerationState):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::resetAlternative):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastAlternative):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::clearBacktrack):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::jumpToBacktrack):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::plantJumpToBacktrackIfExists):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::addBacktrackJump):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::setDataLabelPtr):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::setBackTrackStackOffset):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::setBacktrackLabel):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracks):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracksTo):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::setBacktrackLink):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::chainBacktracks):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::chainBacktrackJumps):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::getBacktrackDestination):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::propagateBacktrackingFrom):
-        (JSC::Yarr::RegexGenerator::ParenthesesTail::ParenthesesTail):
-        (JSC::Yarr::RegexGenerator::ParenthesesTail::processBacktracks):
-        (JSC::Yarr::RegexGenerator::ParenthesesTail::setNextIteration):
-        (JSC::Yarr::RegexGenerator::ParenthesesTail::generateCode):
-        (JSC::Yarr::RegexGenerator::generateAssertionBOL):
-        (JSC::Yarr::RegexGenerator::generateAssertionEOL):
-        (JSC::Yarr::RegexGenerator::generateAssertionWordBoundary):
-        (JSC::Yarr::RegexGenerator::generatePatternCharacterSingle):
-        (JSC::Yarr::RegexGenerator::generatePatternCharacterPair):
-        (JSC::Yarr::RegexGenerator::generatePatternCharacterFixed):
-        (JSC::Yarr::RegexGenerator::generatePatternCharacterGreedy):
-        (JSC::Yarr::RegexGenerator::generatePatternCharacterNonGreedy):
-        (JSC::Yarr::RegexGenerator::generateCharacterClassSingle):
-        (JSC::Yarr::RegexGenerator::generateCharacterClassFixed):
-        (JSC::Yarr::RegexGenerator::generateCharacterClassGreedy):
-        (JSC::Yarr::RegexGenerator::generateCharacterClassNonGreedy):
-        (JSC::Yarr::RegexGenerator::generateParenthesesDisjunction):
-        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
-        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
-        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
-        (JSC::Yarr::RegexGenerator::generateDisjunction):
-        (JSC::Yarr::RegexGenerator::compile):
-        * yarr/RegexPattern.h:
-        (JSC::Yarr::PatternTerm::PatternTerm):
-        (JSC::Yarr::PatternTerm::invert):
-        (JSC::Yarr::PatternTerm::capture):
-
-2010-12-03  Chris Rogers  <crogers@google.com>
-
-        Reviewed by Kenneth Russell.
-
-        First steps to adding web audio files to build systems
-        https://bugs.webkit.org/show_bug.cgi?id=49952
-
-        * wtf/Complex.h:
-
-2010-12-03  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Andreas Kling.
-
-        Move StringWx.cpp into wtf directory
-        https://bugs.webkit.org/show_bug.cgi?id=50060
-
-        * wtf/wx/StringWx.cpp: Renamed from WebCore/platform/text/wx/StringWx.cpp.
-        (WTF::String::String):
-
-2010-12-03  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Andreas Kling.
-
-        Move StringBrew.cpp into wtf directory
-        https://bugs.webkit.org/show_bug.cgi?id=50058
-
-        * wtf/brew/StringBrew.cpp: Renamed from WebCore/platform/text/brew/StringBrew.cpp.
-        (WTF::String::String):
-
-2010-12-03  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Andreas Kling.
-
-        Move StringHaiku.cpp into wtf directory
-        https://bugs.webkit.org/show_bug.cgi?id=50057
-
-        * wtf/haiku/StringHaiku.cpp: Renamed from WebCore/platform/text/haiku/StringHaiku.cpp.
-        (WTF::String::String):
-        (WTF::String::operator BString):
-
-2010-12-02  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix Windows build.
-
-        * runtime/GCActivityCallback.cpp:
-        (JSC::DefaultGCActivityCallback::synchronize): Added a non-CF implementation.
-
-2010-12-02  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Gavin Barraclough.
+2011-03-28  Andras Becsi  <abecsi@webkit.org>
 
-        Fixed <rdar://problem/8310571> CrashTracer: 60 crashes in Photo Booth at
-        com.apple.JavaScriptCore: JSC::Heap::markRoots + 746
-        
-        * API/APIShims.h:
-        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Call our new
-        synchronize() function.
+        Reviewed by Csaba Osztrogonác.
 
-        * runtime/Collector.cpp:
-        (JSC::Heap::activityCallback):
-        * runtime/Collector.h: Added an activityCallback() accessor, for the
-        call above.
+        [Qt] Fix the linking of jsc with MinGW after r81963.
 
-        * runtime/GCActivityCallback.h:
-        (JSC::GCActivityCallback::synchronize):
-        * runtime/GCActivityCallbackCF.cpp:
-        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
-        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
-        (JSC::DefaultGCActivityCallback::operator()):
-        (JSC::DefaultGCActivityCallback::synchronize): Track the run loop we're
-        scheduled in. If we begin/resume execution within a new run loop, reschedule
-        on it. This prevents a crash when using a lockless context group on
-        multiple threads -- the crash would happen if the GC timer scheduled on
-        thread A, then you continued execution on thread B, then the thread A
-        timer fired.
+        * jsc.pro: add -l and remove the lib suffix.
 
-2010-12-02  Darin Adler  <darin@apple.com>
+2011-03-27  Ben Taylor  <bentaylor.solx86@gmail.com>
 
-        * wtf/ASCIICType.h: Fix wrong type from last check-in.
+        Reviewed by Alexey Proskuryakov.
 
-2010-12-02  Darin Adler  <darin@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=57170  Fix last elements
+        in an enum to remove a trailing comma. Sun Studio 12 CC errors out.
 
-        Try to fix certain builds (Qt Windows).
+        Compile fix only, no actual code change.
 
-        * wtf/ASCIICType.h: Added an overload for unsigned because in obsolete
-        versions of ICU, UChar32 can be a typedef for unsigned. Adding this
-        overload should make us compatible with these old ICUs.
+        * wtf/MessageQueue.h:
 
-2010-12-02  Patrick Gansterer  <paroga@webkit.org>
+2011-03-25  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Darin Adler.
 
-        Add AtomicString::fromUTF8
-        https://bugs.webkit.org/show_bug.cgi?id=45594
-
-        Unicode::calculateStringHashFromUTF8 creates a StringHash out of UTF8 input data and
-        calculates the required length for the UTF16 conversation in one step.
-        This is then used in a specialized translator for the string table of AtomicString.
-
-        * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * wtf/text/AtomicString.cpp:
-        (WTF::CStringTranslator::equal):
-        (WTF::HashAndUTF8CharactersTranslator::hash):
-        (WTF::HashAndUTF8CharactersTranslator::equal):
-        (WTF::HashAndUTF8CharactersTranslator::translate):
-        (WTF::AtomicString::add):
-        (WTF::AtomicString::addSlowCase):
-        (WTF::AtomicString::find):
-        (WTF::AtomicString::fromUTF8):
-        * wtf/text/AtomicString.h:
-        * wtf/text/StringImpl.h:
-        * wtf/text/WTFString.h:
-        * wtf/unicode/UTF8.cpp:
-        (WTF::Unicode::readUTF8Sequence):
-        (WTF::Unicode::convertUTF8ToUTF16):
-        (WTF::Unicode::calculateStringHashFromUTF8):
-        (WTF::Unicode::equalUTF16WithUTF8):
-        * wtf/unicode/UTF8.h:
-
-2010-12-02  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
+        Allow defineOwnProperty to work on DOMObjects
+        https://bugs.webkit.org/show_bug.cgi?id=57129
 
-        Added a little hardening to OSAllocator.
+        Fix a couple of places where we uses getter()/setter() rather
+        than [gs]etterPresent().
 
-        * wtf/OSAllocatorPosix.cpp:
-        (WTF::OSAllocator::release):
-        * wtf/OSAllocatorWin.cpp:
-        (WTF::OSAllocator::reserve):
-        (WTF::OSAllocator::reserveAndCommit):
-        (WTF::OSAllocator::commit):
-        (WTF::OSAllocator::decommit):
-        (WTF::OSAllocator::release): CRASH() if the OS's virtual memory system
-        reports an error.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnProperty):
 
-2010-12-02  Csaba Osztrogonác  <ossy@webkit.org>
+2011-03-25  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Geoffrey Garen.
+        Reviewed by Oliver Hunt.
 
-        [Qt] Make platform managing of OSAllocator better than r73106
-        https://bugs.webkit.org/show_bug.cgi?id=50385
+        Crash when paused at a breakpoint caused by inaccurate Activation records.
+        https://bugs.webkit.org/show_bug.cgi?id=57120
 
-        * wtf/OSAllocatorPosix.cpp: Remove platform specific guard.
-        * wtf/OSAllocatorSymbian.cpp: Remove platform specific guard.
-        * wtf/OSAllocatorWin.cpp: Remove platform specific guard.
-        * wtf/wtf.pri: Add the correct platform specific source file instead of all of them.
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
 
-2010-12-02  Patrick Gansterer  <paroga@webkit.org>
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Andreas Kling.
+        Reviewed by Oliver Hunt.
 
-        [WINCE] Use GetTickCount() for srand()
-        https://bugs.webkit.org/show_bug.cgi?id=50338
+        Crash in debugger beneath MarkStack::drain @ me.com, ibm.com
+        https://bugs.webkit.org/show_bug.cgi?id=57080
+        <rdar://problem/8525907>
 
-        time() is not a native function on WinCE, so use GetTickCount() instead.
+        The crash was caused by changes in the executable after recompilation.
 
-        * wtf/RandomNumberSeed.h:
-        (WTF::initializeRandomNumberGenerator):
+        The fix is for the activation to copy the data it needs instead of
+        relying on the data in the executable.
+        
+        SunSpider and v8 report no change.
 
-2010-12-02  Norbert Leser  <norbert.leser@nokia.com>
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters): Use our own data members instead of
+        reading data out of the executable.
 
-        Reviewed by Laszlo Gombos.
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation): Initialize our data members.
 
-        [Qt] [Symbian] Reintroduce compiler optimizations for JSC
-        https://bugs.webkit.org/show_bug.cgi?id=50270
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        (JSC::JSActivation::isDynamicScope):
+        (JSC::JSActivation::argumentsGetter): Use our own data members instead of
+        reading data out of the executable.
 
-        Add compiler optimization (symbian ARM target) which was lost after split from WebCore.
-        Tested via Sunspider and V8 - both of which show significant performance improvement.
+        * runtime/JSActivation.h: Added new data members to track data previously
+        tracked by the executable. Since I've removed the executable pointer,
+        on a 64bit system, I've only made activations bigger by an int.
 
-        * JavaScriptCore.pro:
+2011-03-25  David Kilzer  <ddkilzer@apple.com>
 
-2010-12-02  Peter Varga  <pvarga@inf.u-szeged.hu>
+        Remove duplicate entry from JavaScriptCore.exp
 
-        Reviewed by Gavin Barraclough.
+        JSC::createStackOverflowError(JSC::ExecState*) was originally
+        exported in r60057, then duplicated in r60392.
 
-        Move regex parsing and fallback handling to runtime/RegExp.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=50015
+        * JavaScriptCore.exp: Removed duplicate entry.
 
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::create):
-        (JSC::RegExp::compile):
-        (JSC::RegExp::match):
-        (JSC::RegExp::printTraceData):
-        * runtime/RegExp.h:
-        (JSC::RegExp::pattern):
-        * yarr/RegexInterpreter.cpp:
-        * yarr/RegexInterpreter.h:
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::compile):
-        (JSC::Yarr::jitCompileRegex):
-        * yarr/RegexJIT.h:
-        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
-        (JSC::Yarr::RegexCodeBlock::setFallBack):
-        (JSC::Yarr::RegexCodeBlock::isFallBack):
-        (JSC::Yarr::executeRegex):
+2011-03-25  Jarred Nicholls  <jarred@sencha.com>
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Ariya Hidayat.
 
-        Try to fix the GTK build.
+        [Qt] MSVC Build Error - need to link advapi32.lib for jsc.exe
+        https://bugs.webkit.org/show_bug.cgi?id=56098
 
-        * GNUmakefile.am: Use a full path to OSAllocator*.cpp.
+        Need to link advapi32.lib for jsc.exe since wtf/OSRandomSource.cpp uses the Win32 Crypto API
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+        * jsc.pro:
 
-        Try to fix the EFL Linux build.
+2011-03-24  Nikolas Zimmermann  <nzimmermann@rim.com>
 
-        * CMakeListsEfl.txt: Added OSAllocator to the project.
+        Reviewed by Darin Adler.
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+        Introduce WTF HexNumber.h
+        https://bugs.webkit.org/show_bug.cgi?id=56099
 
-        Try to fix the Qt build: Include all OS files for Qt's sake, and then
-        use #ifdefs in the files to exclude things based on OS.
-        
-        This is a pretty bad way to manage platforms -- hopefully we can
-        fix the Qt build system and move away from this in the future.
+        Introduce a set of functions that ease converting from a bye or a number to a hex string,
+        replacing several of these conversions and String::format("%x") usages all over WebCore.
 
-        * wtf/OSAllocatorPosix.cpp:
-        * wtf/OSAllocatorSymbian.cpp:
-        * wtf/OSAllocatorWin.cpp:
-        * wtf/wtf.pri:
+        * GNUmakefile.am: Add HexNumber.h to build.
+        * JavaScriptCore.exp: Export StringBuilder::reserveCapacity.
+        * JavaScriptCore.gypi: Add HexNumber.h to build.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export StringBuilder::reserveCapacity.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add HexNumber.h to build.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * wtf/CMakeLists.txt: Ditto.
+        * wtf/HexNumber.h: Added.
+        (WTF::Internal::hexDigitsForMode): Internal helper.
+        (WTF::appendByteAsHex): Free function, that appends a byte as hex string into a destination.
+        (WTF::placeByteAsHex): Ditto, but places the result using *foo++ = '..' or foo[index++] = '..'
+        (WTF::appendUnsignedAsHex): Free function, that appends a number as hex string into a destination.
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
 
-        Try to fix the Chromium build.
+        Windows build fix take 2: Add new symobl.
         
-        * JavaScriptCore.gypi: This is a Windows build file, so use OSAllocatorWin.cpp.
+        (I should have used the EWS bots for this!)
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix the GTK build.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        * GNUmakefile.am: Added OSAllocator to another project.
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+        Windows build fix take 1: Removed old symobl.
 
-        Try to fix the GTK Linux build.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        * JavaScriptCore.gypi: Added OSAllocator to the project.
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Oliver Hunt.
 
-        Try to fix the Qt Linux build.
+        Ensure that all compilation takes place within a dynamic global object scope
+        https://bugs.webkit.org/show_bug.cgi?id=57054
+        <rdar://problem/9083011>        
 
-        * wtf/OSAllocatorPosix.cpp: Use the right errno.h.
+        Otherwise, entry to the global object scope might throw away the code
+        we just compiled, causing a crash.
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+        * JavaScriptCore.exp: Updated for signature change.
 
-        Try to fix Windows build: export some more symbols.
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate): Removed explicit compilation calls
+        here because (a) they took place outside a dynamic global object scope
+        and (b) they were redundant.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall): Updated for signature change.
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct): Declare our dynamic global object
+        scope earlier, to ensure that compilation takes place within it.
 
-        Try to fix the Qt Linux build.
+        * runtime/Completion.cpp:
+        (JSC::evaluate): Removed explicit compilation calls here because (a)
+        they took place outside a dynamic global object scope and (b) they were
+        redundant.
 
-        * wtf/wtf.pri: Use the POSIX OSAllocator for Qt Linux.
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::compile):
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct): Added an ASSERT to
+        verify our new invariant that all compilation takes place within a
+        dynamic global object scope.
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+        * runtime/JSGlobalObject.h: Changed the signature of DynamicGlobalObjectScope
+        to require a JSGlobalData instead of an ExecState* since it is often
+        easier to provide the former, and the latter was not necessary.
 
-        Windows build fix: commit doesn't have a return value.
+2011-03-24  Oliver Hunt  <oliver@apple.com>
 
-        * wtf/OSAllocatorWin.cpp:
-        (WTF::OSAllocator::commit):
+        Reviewed by Geoffrey Garen.
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+        REGRESSION (r79987-r80210): Crash in JSWeakObjectMapClear
+        https://bugs.webkit.org/show_bug.cgi?id=55671
 
-        Build fix: Export some symbols.
+        This is no longer necessary, and it seems that with the new weakmap
+        model it's simply unsafe, so this reduces it to a no-op. 
 
-        * JavaScriptCore.exp:
+        * API/JSWeakObjectMapRefPrivate.cpp:
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+2011-03-24  Ben Taylor  <bentaylor.solx86@gmail.com>
 
-        Build fix.
+        Reviewed by Darin Adler.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj: Export OSAllocator.h as private
-        so other projects can see it.
+        https://bugs.webkit.org/show_bug.cgi?id=20302
+        Correct implementation of signbit on Solaris
 
-        * wtf/OSAllocatorPosix.cpp: #include UnusedParam.h for UNUSED_PARAM.
+        * wtf/MathExtras.h:
+        (signbit):
 
-2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+2011-03-23  Mark Rowe  <mrowe@apple.com>
 
-        Reviewed by Sam Weinig.
-
-        Baby step toward a cross-platform virtual memory abstraction: created
-        an all-static OSAllocator class and changed MarkStack to use it.
+        Reviewed by Darin Adler.
 
-        * JavaScriptCore.exp: These functions are inlined now.
+        <rdar://problem/7959320> Threads that use APIs above the BSD layer must be registered with the Obj-C GC.
 
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added OSAllocatorWin.cpp.
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeCurrentThreadInternal):
 
-        * JavaScriptCore.xcodeproj/project.pbxproj: Added OSAllocatorPosix.cpp.
+2011-03-23  Mark Rowe  <mrowe@apple.com>
 
-        * runtime/MarkStack.h:
-        (JSC::MarkStack::allocateStack):
-        (JSC::MarkStack::releaseStack): Use OSAllocator instead of rolling our
-        own platform-specific code.
+        Stop setting OTHER_OPTIONS in JavaScriptCore's Makefile.
 
-        * runtime/MarkStackNone.cpp: Removed. Nothing used this.
+        It's not necessary to pass "-target All" as xcodebuild always builds the
+        first target in the project unless otherwise specified. The presence of
+        that option also breaks "make clean" since that results in both the
+        -target and -alltargets options being passed to xcodebuild.
 
-        * runtime/MarkStackPosix.cpp: 
-        * runtime/MarkStackSymbian.cpp:
-        * runtime/MarkStackWin.cpp: Removed custom platform-specific code, since
-        we use the OSAllocator abstraction now.
+        * Makefile:
 
-        * wtf/OSAllocator.h: Added.
-        * wtf/OSAllocatorPosix.cpp: Added.
-        (WTF::OSAllocator::reserve):
-        (WTF::OSAllocator::reserveAndCommit):
-        (WTF::OSAllocator::commit):
-        (WTF::OSAllocator::decommit):
-        (WTF::OSAllocator::release):
-        * wtf/OSAllocatorSymbian.cpp: Added.
-        (WTF::OSAllocator::reserve):
-        (WTF::OSAllocator::reserveAndCommit):
-        (WTF::OSAllocator::commit):
-        (WTF::OSAllocator::decommit):
-        (WTF::OSAllocator::release):
-        * wtf/OSAllocatorWin.cpp: Added.
-        (WTF::OSAllocator::reserve):
-        (WTF::OSAllocator::reserveAndCommit):
-        (WTF::OSAllocator::commit):
-        (WTF::OSAllocator::decommit):
-        (WTF::OSAllocator::release): The new OSAllocator abstraction.
+2011-03-23  Pavel Feldman  <pfeldman@chromium.org>
 
-        * wtf/wtf.pri: Added OSAllocatorSymbian.cpp.
+        Not reviewed: bring back Vector::contains that was removed as a part of roll back.
 
-2010-12-01  Steve Falkenburg  <sfalken@apple.com>
+        * wtf/Vector.h:
+        (WTF::::contains):
 
-        Reviewed by Adam Roben.
+2011-03-23  Sheriff Bot  <webkit.review.bot@gmail.com>
 
-        WinCairo build should not use link-time code generation (LTCG)
-        https://bugs.webkit.org/show_bug.cgi?id=50353
+        Unreviewed, rolling out r81686.
+        http://trac.webkit.org/changeset/81686
+        https://bugs.webkit.org/show_bug.cgi?id=56914
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
-
-010-12-01  Steve Falkenburg  <sfalken@apple.com>
-
-        Reviewed by Adam Roben.
+        Breaks webkit_tests in Chromium again. (Requested by pfeldman
+        on #webkit).
 
-        vcproj changes can't be applied cleanly by the Windows EWS bot
-        https://bugs.webkit.org/show_bug.cgi?id=50328
-
-        * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Modified property svn:eol-style.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops: Added property svn:eol-style.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops: Added property svn:eol-style.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Added property svn:eol-style.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Modified property svn:eol-style.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops: Added property svn:eol-style.
-        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Modified property svn:eol-style.
-        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops: Added property svn:eol-style.
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Modified property svn:eol-style.
-        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added property svn:eol-style.
-        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Modified property svn:eol-style.
-        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Added property svn:eol-style.
-
-2010-12-01  Gavin Barraclough  <barraclough@apple.com>
+        * wtf/Vector.h:
 
-        Reviewed by Sam Weinig.
+2011-03-23  Adam Barth  <abarth@webkit.org>
 
-        Bug 50298 - /()()()()()()()()()(?:(\10a|b)(X|Y))+/.exec("bXXaYYaY") ASSERTs
+        Reviewed by Eric Seidel.
 
-        For unmatched subpattens we previously used to set the subpattern end to -1,
-        but now we only set the start value. E.g. consider the following:
-            /a(b)?c/.exec("ac");
-        Previously we would generate an internal results array of:
-            [ 0, 2, -1, -1 ]
-        Since fairly recently we have generated results of:
-            [ 0, 2, -1, ??? ]
-        (With the end index of the subpattern uninitialized).
+        JavaScriptCore GYP build should work on a case-sensitive file system
+        https://bugs.webkit.org/show_bug.cgi?id=56911
 
-        Update these ASSERTs to account for this.
+        The issue is that there are two UString.h headers, one named UString.h
+        and one named ustring.h.  This patch excludes ustring.h from the header
+        map to avoid confusion.  While I was editing this part of the GYP file,
+        I cleaned up the exclude rules to be more modern.
 
-        Also, when stripping out self-referencing backreferences, (e.g. /(\1)/) we
-        were checking the wrong property on the pattern term. We should have been
-        looking at term.parentheses.subpatternId, but instead were checking
-        term.subpatternId. The latter is actually only the subpatternId for
-        back reference terms. Rename this to backReferenceSubpatternId.
+        * gyp/JavaScriptCore.gyp:
 
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::Interpreter::matchBackReference):
-        (JSC::Yarr::Interpreter::backtrackBackReference):
+2011-03-22  Geoffrey Garen  <ggaren@apple.com>
 
-2010-11-30  Gavin Barraclough  <barraclough@apple.com>
+        Reviewed by Maciej Stachowiak.
 
-        Rubber stamped by Sam Weinig.
+        REGRESSION (r78382): No scripts appear in the Web Inspector's Scripts
+        panel on Windows, and many inspector regression tests are failing
+        https://bugs.webkit.org/show_bug.cgi?id=54490
+        
+        The bug was caused by two different classes using the same name (Recompiler).
 
-        Bug 50297 - \s in YARR should match BOMs.
+        * debugger/Debugger.cpp:
+        * runtime/JSGlobalData.cpp:
+        (WTF::Recompiler::operator()): Put Recompiler in an anonymous namespace,
+        so our two recompilers' inline functions don't stomp each other at
+        link time.
 
-        From section 15.10.2.12 CharacterClassEscape contains:
+2011-03-22  Sam Weinig  <sam@webkit.org>
 
-        The production CharacterClassEscape :: s evaluates by returning the set of characters containing the
-        characters that are on the right-hand side of the WhiteSpace (7.2) or LineTerminator (7.3) productions.
+        Reviewed by Mark Rowe.
 
-        Table 2 in section 7.2 contains:
+        Remove USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER.
+        <rdar://problem/8944718> 
 
-        \uFEFF Byte Order Mark <BOM>
+        * DerivedSources.make:
+        Remove generation of USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER.
 
-        * create_regex_tables:
-            Add BOM to spaces table.
+2011-03-22  Gabor Loki  <loki@webkit.org>
 
-2010-11-30  Gavin Barraclough  <barraclough@apple.com>
+        Reviewed by Csaba Osztrogonác.
 
-        Reviewed by Darin Adler.
+        [Qt] Add DFG module to build system (disabled by default).
+        https://bugs.webkit.org/show_bug.cgi?id=56845
 
-        Fixed review comments following bug #48101.
-        Mostly typos, plus gave quantifyInfinite a symbolic name.
-
-        * yarr/RegexCompiler.cpp:
-        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
-        (JSC::Yarr::RegexPatternConstructor::checkForTerminalParentheses):
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
-        (JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
-        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
-        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalEnd):
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::generatePatternCharacterGreedy):
-        (JSC::Yarr::RegexGenerator::generatePatternCharacterNonGreedy):
-        (JSC::Yarr::RegexGenerator::generateCharacterClassGreedy):
-        * yarr/RegexParser.h:
-        (JSC::Yarr::Parser::parseTokens):
-        (JSC::Yarr::parse):
-
-2010-11-30  Steve Falkenburg  <sfalken@apple.com>
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
 
-        Reviewed by Darin Adler.
+2011-03-22  Eric Seidel  <eric@webkit.org>
 
-        WTF project missing build-stopping code from its pre-build event
-        https://bugs.webkit.org/show_bug.cgi?id=50281
+        Reviewed by Adam Barth.
 
-        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd:
+        Add support to build-webkit for building with gyp-generated project files
+        https://bugs.webkit.org/show_bug.cgi?id=56877
 
-2010-11-30  Patrick Gansterer  <paroga@webkit.org>
+        Found a couple missing Private headers while trying to make WebCore build.
 
-        Reviewed by Darin Adler.
+        * JavaScriptCore.gypi:
 
-        Cleanup UTF8.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=49581
+2011-03-22  Eric Seidel  <eric@webkit.org>
 
-        Use macros and functions instead of range values directly.
+        Reviewed by Adam Barth.
 
-        * wtf/unicode/UTF8.cpp:
-        (WTF::Unicode::inlineUTF8SequenceLength):
-        (WTF::Unicode::UTF8SequenceLength):
-        (WTF::Unicode::convertUTF16ToUTF8):
-        (WTF::Unicode::readUTF8Sequence):
-        (WTF::Unicode::convertUTF8ToUTF16):
-        * wtf/unicode/UnicodeMacrosFromICU.h: Added U_IS_SUPPLEMENTARY macro.
+        Make it possible to build JavaScriptCore and WebCore gyp builds outside of Source
+        https://bugs.webkit.org/show_bug.cgi?id=56867
 
-2010-11-30  Geoffrey Garen  <ggaren@apple.com>
+        This should make it possible to build the gyp-generated JavaScriptCore.xcodeproj
+        from a JavaScriptCore directory outside of Source.
 
-        Reviewed by Gavin Barraclough.
+        * gyp/JavaScriptCore.gyp:
+        * gyp/run-if-exists.sh: Added.
+        * gyp/update-info-plist.sh: Added.
 
-        Fixed a crash seen when using a PageAllocation to store itself.
+2011-03-22  Eric Seidel  <eric@webkit.org>
 
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::systemDeallocate): Zero out m_base before unmapping
-        it, in case unmapping m_base unmaps the PageAllocation.
+        Reviewed by Adam Barth.
 
-        * wtf/BumpPointerAllocator.h:
-        (WTF::BumpPointerPool::destroy): Now this work-around isn't needed!
+        Add Profiling Configuration to JavaScriptCore gyp build
+        https://bugs.webkit.org/show_bug.cgi?id=56862
 
-2010-11-30  Xan Lopez  <xlopez@igalia.com>
+        It appears this is identical to Release, but I suspect
+        there is someone/thing who uses the Profiling target
+        so we're adding it for completeness.
 
-        Reviewed by Darin Adler.
+        * gyp/JavaScriptCore.gyp:
 
-        m_hasNonEnumerableProperties is never initialized in Structure
-        https://bugs.webkit.org/show_bug.cgi?id=50266
+2011-03-22  Adam Barth  <abarth@webkit.org>
 
-        * runtime/Structure.cpp:
-        (JSC::Structure::Structure): initialize member variable.
+        Reviewed by Eric Seidel.
 
-2010-11-29  Steve Falkenburg  <sfalken@apple.com>
+        Remove os_win32_files variable from the GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56804
 
-        Windows build fix (part 1). Use correct environment variable syntax in cmd files.
+        Now that our understanding of GYP is sufficiently advanced, we don't
+        need os_win32_files any more.  (Turns out Eric was right, as he always
+        is.)
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreLink.cmd:
-        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd:
-        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd:
-        * JavaScriptCore.vcproj/jsc/jscPreBuild.cmd:
-        * JavaScriptCore.vcproj/jsc/jscPreLink.cmd:
-        * JavaScriptCore.vcproj/testapi/testapiPostBuild.cmd:
-        * JavaScriptCore.vcproj/testapi/testapiPreBuild.cmd:
-        * JavaScriptCore.vcproj/testapi/testapiPreLink.cmd:
+        * JavaScriptCore.gypi:
 
-2010-11-29  Dan Bernstein  <mitz@apple.com>
+2011-03-22  Adam Barth  <abarth@webkit.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Eric Seidel.
 
-        WTF support for <rdar://problem/8650085> adding word-prefix search options to the text search API.
-        https://bugs.webkit.org/show_bug.cgi?id=50038
+        GYP build of JavaScriptCore should be able to link from an empty WebKitBuild directory
+        https://bugs.webkit.org/show_bug.cgi?id=56803
 
-        * wtf/unicode/UnicodeMacrosFromICU.h: Copied additional macros from icu/unicode/utf16.h.
+        Previously, we thought we should generate the derived source files in
+        the shared intermediate build products directory, but there are
+        assumptions built into other parts of the Mac build system that the
+        derived source files will be generated in a particular subdirectory of
+        the build products directory.
 
-2010-11-29  Steve Falkenburg  <sfalken@apple.com>
+        This patch is a partial revert of the change that moved the derived
+        source files to the shared intermediate directory.  After this patch,
+        the GYP build can build JavaScriptCore without help from the main
+        normal build system.
 
-        Reviewed by Darin Adler.
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+        * gyp/generate-derived-sources.sh:
+        * gyp/generate-dtrace-header.sh:
 
-        JavaScriptCore projects on Windows should use cmd files for build events
-        https://bugs.webkit.org/show_bug.cgi?id=50193
+2011-03-22  Jay Civelli  <jcivelli@chromium.org>
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd: Added.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd: Added.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreLink.cmd: Added.
-        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd: Added property svn:eol-style.
-        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd: Added property svn:eol-style.
-        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
-        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd: Added.
-        * JavaScriptCore.vcproj/jsc/jscPreBuild.cmd: Added.
-        * JavaScriptCore.vcproj/jsc/jscPreLink.cmd: Added.
-        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
-        * JavaScriptCore.vcproj/testapi/testapiPostBuild.cmd: Added.
-        * JavaScriptCore.vcproj/testapi/testapiPreBuild.cmd: Added.
-        * JavaScriptCore.vcproj/testapi/testapiPreLink.cmd: Added.
+        Reviewed by David Levin.
 
-2010-11-29  Dai Mikurube  <dmikurube@google.com>
+        Adding a contains method to Vector.
+        https://bugs.webkit.org/show_bug.cgi?id=55859
 
-        Reviewed by Kent Tamura.
+        * wtf/Vector.h:
+        (WTF::Vector::contains):
 
-        when empty, clicking "down" on outer-spin-button returns "max value"
-        https://bugs.webkit.org/show_bug.cgi?id=45491
+2011-03-22  Gabor Loki  <loki@webkit.org>
 
-        It is required to calculate UTC/DST offsets to retrieve the current local milliseconds for
-        date/time type inputs. WTF::currentTimeMS() returns a UTC time, and WTF::getLocalTime()
-        returns a struct tm, not milliseconds.
+        Reviewed by Alexey Proskuryakov.
 
-        Calculating milliseconds from a struct tm is not simple since timegm() cannot be used in all
-        environments. This calculation is already done in calculateUTCOffset(), and complicated.
-        Duplicating this complicated calculation is unreasonable because of maintainability.
-        To achieve this without duplication, we must call calculate{UTC|DST}Offset in some way.
+        Fix a bunch of typos in DFG.
+        https://bugs.webkit.org/show_bug.cgi?id=56813
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::parse):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::setSpilled):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::setupStubArguments):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.h:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::allocate):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::~ScoreBoard):
+        (JSC::DFG::ScoreBoard::allocate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
 
-        * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * wtf/DateMath.cpp: Changed calculateUTCOffset() and calculateDSTOffset() to external functions.
-        (WTF::calculateUTCOffset):
-        (WTF::calculateDSTOffset):
-        * wtf/DateMath.h:
+        Reviewed by Eric Seidel.
 
-2010-11-29  Chris Rogers  <crogers@google.com>
+        Production configuration in GYP isn&apos;t set up correctly
+        https://bugs.webkit.org/show_bug.cgi?id=56786
 
-        Reviewed by Kenneth Russell.
+        Update JavaScriptCore.gyp with information mined from
+        JavaScriptCore.xcodeproj.
 
-        Switch web audio code to use FloatPoint3D instead of Vector3
-        https://bugs.webkit.org/show_bug.cgi?id=50186
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
 
-        * wtf/Vector3.h: Removed.
+2011-03-22  Kent Tamura  <tkent@chromium.org>
 
-2010-11-29  Steve Falkenburg  <sfalken@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Adam Roben.
+        REGRESSION(r80096): Number type input unexpectedly rounds fractional values
+        https://bugs.webkit.org/show_bug.cgi?id=56367
 
-        Add a mechanism for Windows pre-build/pre-link/post-build events to be separated into individual cmd files
-        https://bugs.webkit.org/show_bug.cgi?id=49858
+        Introduce clampToInteger(unsigned).
+        
+        * wtf/MathExtras.h:
+        (clampToInteger): Added.
 
-        We're migrating our prebuild/prelink/postbuild steps out of vcproj and vsprops files:
-        - To simplify editing (editing vsprops build steps is confusing).
-        - For more readable diffs.
+2011-03-21  Adam Barth  <abarth@webkit.org>
 
-        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
-        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd: Added.
-        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd: Added.
+        Reviewed by Eric Seidel.
 
-2010-11-29  Geoffrey Garen  <ggaren@apple.com>
+        GYP build should not have include paths that point within the source tree
+        https://bugs.webkit.org/show_bug.cgi?id=56788
 
-        Reviewed by Gavin Barraclough.
+        Turns out we don't need these include paths anymore now that we have
+        header maps working properly.
 
-        Improved accuracy of command-line SunSpider.
+        * gyp/JavaScriptCore.gyp:
+            - Also, remove jsc.cpp from the excluded list because it's not part
+              of the jsc_files variable instead of the javascriptcore_files
+              variable.
 
-        * jsc.cpp:
-        (functionRun): Changed the "run" function to run a given test in
-        its own global object. Previously, all tests ran in the same global
-        object, which created name conflicts, and made globals from previous
-        tests artificially survive into later tests.
-        
-        Also changed "run" to return the elapsed milliseconds when running a
-        given test, for slightly more accurate numbers.
+2011-03-21  Adam Barth  <abarth@webkit.org>
 
-        (functionCheckSyntax): Ditto on returning elapsed milliseconds.
+        Reviewed by Eric Seidel.
 
-2010-11-29  Darin Adler  <darin@apple.com>
+        Solve the Assertions.cpp / -Wno-missing-format-attribute mystery
+        https://bugs.webkit.org/show_bug.cgi?id=56780
 
-        Reviewed by Andreas Kling.
+        The reason we couldn't resolve this warning in the GYP build was that
+        the normal build disables this warning specifically for this file.
+        This patch takes the same approach as the previous patch to
+        WebCoreObjCExtras.mm in that it uses a pragma to suppress the warning
+        (rather than a build system configuration).
 
-        Remove a couple unneeded overflow checks
-        https://bugs.webkit.org/show_bug.cgi?id=49816
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Remove the special-case for this file.
+        * gyp/JavaScriptCore.gyp:
+            - Remove the work-around for this issue.
+        * wtf/Assertions.cpp:
+            - Add a pragma disabling this warning for this file.
 
-        * wtf/text/CString.cpp:
-        (WTF::CString::init): Use an ASSERT instead of
-        an overflow check with CRASH.
+2011-03-21  Adam Barth  <abarth@webkit.org>
 
-2010-11-29  Adam Roben  <aroben@apple.com>
+        Reviewed by Dimitri Glazkov.
 
-        Robustify react-to-vsprops-changes.py against changes to its location
-        or the location of the .vsprops files
+        WebCore GYP build shouldn't crash on startup
+        https://bugs.webkit.org/show_bug.cgi?id=56776
 
-        Suggested by John Sullivan.
+        Debug builds shouldn't define NDEBUG.  This same logic exists in the
+        project.pbxproj file.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
-        Removed file_modification_times.
-        (main): Use glob.glob to find the .vsprops files and assert that we found some.
+        * gyp/JavaScriptCore.gyp:
 
-2010-11-29  Adam Roben  <aroben@apple.com>
+2011-03-21  Robert Kroeger  <rjkroege@chromium.org>
 
-        Touch wtf/Platform.h whenever any .vsprops file changes
+        Reviewed by Antonio Gomes.
 
-        This will cause all files to be recompiled, which will make changes to
-        preprocessor macros (e.g., ENABLE_*) actually take effect.
+        Flag to enable/disable a GestureReocognizer framework
 
-        Fixes <http://webkit.org/b/50167> Windows build fails when ENABLE_*
-        macros are changed (because not enough files are rebuilt)
+        https://bugs.webkit.org/show_bug.cgi?id=49345
 
-        Reviewed by John Sullivan.
+        * wtf/Platform.h:
 
-        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
-        (main): Touch wtf/Platform.h if it's older than any .vsprops file. Also
-        added some comments and logging to make it clearer what the script is
-        doing and why.
+2011-03-21  Adam Barth  <abarth@webkit.org>
 
-2010-11-29  Adam Roben  <aroben@apple.com>
+        Reviewed by Dimitri Glazkov.
 
-        Update react-to-vsprops-changes.py after r72555
+        Add new files to JavaScriptCore.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=56766
 
-        .vsprops files are no longer accessed relative to $WebKitLibrariesDir.
+        * JavaScriptCore.gypi:
 
-        Fixes <http://webkit.org/b/50166> REGRESSION (r72555):
-        react-to-vsprops-changes.py no longer works for people with a
-        non-default $WebKitLibrariesDir
+2011-03-21  Sheriff Bot  <webkit.review.bot@gmail.com>
 
-        Reviewed by John Sullivan.
+        Unreviewed, rolling out r81377.
+        http://trac.webkit.org/changeset/81377
+        https://bugs.webkit.org/show_bug.cgi?id=56765
 
-        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
-        (main): Always look in WebKitLibraries/win for .vsprops files, not in
-        $WebKitLibrariesDir.
+        WebPageSerializerTest.MultipleFrames is broken (Requested by
+        simonjam on #webkit).
 
-2010-11-28  Gavin Barraclough  <barraclough@apple.com>
+        * wtf/Vector.h:
 
-        Reviewed by Sam Weinig.
+2011-03-21  Gabor Loki  <loki@webkit.org>
 
-        Bug 48100 - YARR allows what seems like a bogus character-class range
+        Reviewed by Csaba Osztrogonác.
 
-        Per ECMA-262 character classes containing character ranges containing
-        character classes are invalid, eg:
-            /[\d-x]/
-            /[x-\d]/
-            /[\d-\d]/
-        These should throw a syntax error.
+        Extend constant pool to be able to store 16 bit instructions with a constant
+        https://bugs.webkit.org/show_bug.cgi?id=46796
 
-        * yarr/RegexParser.h:
+        The putShortWithConstantInt function inserts a 16 bit instruction which
+        refers a 32 bits constant or literal. This is a vital function for those
+        target which loads a PC relative value with a 16 bit instruction (like
+        Thumb-2 instruction set and SH4 architecture).
 
-2010-11-27  Gavin Barraclough  <barraclough@apple.com>
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putIntegral):
+        (JSC::AssemblerBuffer::putIntegralUnchecked):
+        * assembler/AssemblerBufferWithConstantPool.h:
 
-        Reviewed by Sam Weinig.
+2011-03-21  Philippe Normand  <pnormand@igalia.com>
 
-        Bug 48101 - Yarr gives different results for /(?:a*?){2,}/
-
-        The test cases in the linked mozilla bug demonstrate a couple of
-        problems in subpattern matching. These bugs lie in the optimized
-        cases - for matching parentheses with a quantity count of 1, and
-        for matching greedy quantified parentheses at the end of a regex
-        (which do not backtrack).
-
-        In both of these cases we are failing to correctly handle empty
-        matches. In the case of parentheses-single matches (quantity count
-        one) we are failing to test for empty matches at all. In the case
-        of terminal subpattern matches we do currently check, however there
-        is a subtler bug here too. In the case of an empty match we will
-        presently immediately fall through to the next alternative (or
-        complete the regex match), whereas upon a failed match we should
-        be backtracking into the failing alternative, to give it a chance
-        to match further (e.g. consider /a??b?|a/.exec("ab") - upon first
-        attempting to match the first alternative this will match the empty
-        string - since a?? is non-greedy, however rather than moving on to
-        the second alternative we should be re-matching the first one, at
-        which point the non-greedy a?? will match, and as such the result
-        should be "ab", not "a").
-
-        Terminal subpattern matching contains a second bug, too. The frame
-        location values in the subpattern should be being allocated with
-        the outer disjunction's frame (as we do for the parentheses-single
-        optimization). Consider the following three regexes:
-            /a*(?:b*)*c*/
-            /a*(?:b*)c*/
-            /a*(?:b*)*/
-        Considering only the frame location required by the atoms a,b, and
-        c, (ignoring space associated with the nested subpattern) the first
-        regex (a normal subpattern match) requires a frame size of 2 for
-        the outer disjunction, (to backtrack terms a & c), with each
-        iteration of the subpattern requiring a frame of size 1 (in order
-        to backtrack b). In the case of the second regex (where the
-        parentheses-single optimization will kick in) the outer frame must
-        be set up with a frame size of 3, since the outer frame will also
-        be used when running the nested subpattern. We will currently only
-        allocate a farme of size 1 for the outer disjuntion (to contain a),
-        howver the frame size should be 2 (since the subpattern will be
-        evaluated in the outer frame). In addition to failing to allocate
-        frame space the frame offsets are also presently invalid - in the
-        case of the last regex b's frame location will be set assuming it
-        to be the first term in the frame, whereas in this case b lies
-        after the term a, and should be taking a separate frame location.
-
-        In order to correctly allocate the frame for terminal subpattern
-        matches we must move this optimization back up from the JIT into
-        the compiler (and thus interpreter too), since this is where the
-        frame allocation takes place.
-
-        * yarr/RegexCompiler.cpp:
-        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
-        (JSC::Yarr::RegexPatternConstructor::checkForTerminalParentheses):
-        (JSC::Yarr::compileRegex):
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
-        (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
-        (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
-        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
-        (JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
-        (JSC::Yarr::Interpreter::matchParenthesesTerminalEnd):
-        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
-        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalEnd):
-        (JSC::Yarr::Interpreter::matchDisjunction):
-        (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
-        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
-        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
-        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
-        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
-        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
-        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
-        (JSC::Yarr::ByteCompiler::emitDisjunction):
-        * yarr/RegexInterpreter.h:
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
-        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
-        (JSC::Yarr::RegexGenerator::generateTerm):
-        * yarr/RegexPattern.h:
-        (JSC::Yarr::PatternTerm::PatternTerm):
+        Unreviewed, GTK distcheck build fix.
 
-2010-11-24  Patrick Gansterer  <paroga@webkit.org>
+        * GNUmakefile.am:
 
-        Reviewed by Csaba Osztrogonác.
+2011-03-20  Bill Budge  <bbudge@chromium.org>
 
-        Remove Bakefile build system files
-        https://bugs.webkit.org/show_bug.cgi?id=49983
+        Reviewed by Adam Barth.
 
-        r53757 only removed the content, but not the files.
-        This patch removes that empty files.
+        Rename ThreadSafeShared to ThreadSafeRefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=56714
 
-        * JavaScriptCoreSources.bkl: Removed.
-        * jscore.bkl: Removed.
+        No new tests. Exposes no new functionality.
 
-2010-11-24  Gabor Loki  <loki@webkit.org>
+        * API/JSClassRef.h:
+        * API/OpaqueJSString.h:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Atomics.h:
+        * wtf/CMakeLists.txt:
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::::crossThreadCopy):
+        * wtf/ThreadSafeRefCounted.h: Copied from wtf/ThreadSafeShared.h.
+        (WTF::ThreadSafeRefCountedBase::ThreadSafeRefCountedBase):
+        (WTF::ThreadSafeRefCountedBase::ref):
+        (WTF::ThreadSafeRefCountedBase::refCount):
+        (WTF::ThreadSafeRefCountedBase::derefBase):
+        (WTF::ThreadSafeRefCounted::ThreadSafeRefCounted):
+        * wtf/ThreadSafeShared.h: Removed.
+        * wtf/Threading.h:
 
-        Reviewed by Csaba Osztrogonác.
+2011-03-19  Patrick Gansterer  <paroga@webkit.org>
 
-        Merge the usage of jumps and calls at ARM-JIT
-        https://bugs.webkit.org/show_bug.cgi?id=50008
+        Reviewed by Darin Adler.
 
-        Those JmpSrc objects which represent jumps (not calls) should point to
-        after the jump instruction.
+        Remove StringImpl::computeHash()
+        https://bugs.webkit.org/show_bug.cgi?id=49894
 
-        * assembler/ARMAssembler.h:
-        (JSC::ARMAssembler::blx):
-        (JSC::ARMAssembler::loadBranchTarget):
-        (JSC::ARMAssembler::getAbsoluteJumpAddress):
-        (JSC::ARMAssembler::linkJump):
-        (JSC::ARMAssembler::relinkJump):
-        (JSC::ARMAssembler::linkCall):
-        (JSC::ARMAssembler::relinkCall):
-        (JSC::ARMAssembler::getRelocatedAddress):
-        (JSC::ARMAssembler::getDifferenceBetweenLabels):
-        (JSC::ARMAssembler::getCallReturnOffset):
-        * assembler/MacroAssemblerARM.h:
-        (JSC::MacroAssemblerARM::call):
+        Replace remainig StringImpl::computeHash with StringImpl::computeHashStringHasher.
 
-2010-11-24  Carlos Garcia Campos  <cgarcia@igalia.com>
+        * wtf/text/AtomicString.cpp:
+        (WTF::CStringTranslator::hash):
+        (WTF::UCharBufferTranslator::hash):
+        (WTF::HashAndCharactersTranslator::hash):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::setHash):
+        (WTF::StringImpl::hash):
 
-        Reviewed by Xan Lopez.
+2011-03-19  Patrick Gansterer  <paroga@webkit.org>
 
-        [GTK] Optimize foldCase, toLower and toUpper methods in glib unicode backend
-        https://bugs.webkit.org/show_bug.cgi?id=48625
-
-        GLib methods use UTF-8 strings, so we have to convert from UTF-16 to
-        UTF-8 to perform the case operations and then convert back the result to
-        UTF-16. GLib conversion methods return a new allocated string, so we
-        have to memcpy the result into the destination buffer too. Using our
-        own methods to convert between UTF-8 and UTF-16 from wtf/unicode/UTF8.h
-        we don't need such memcpy, since they take an already allocated buffer
-        rather than returning a new one. There's another optimization for the
-        case when the destination buffer is not large enough. In that case,
-        methods should return the expected destination buffer size and are
-        called again with a new buffer. We can avoid the conversion to UTF-16 by
-        pre-calculating the required size for the destination buffer.
-
-        * wtf/unicode/glib/UnicodeGLib.cpp:
-        (WTF::Unicode::getUTF16LengthFromUTF8):
-        (WTF::Unicode::convertCase):
-        (WTF::Unicode::foldCase):
-        (WTF::Unicode::toLower):
-        (WTF::Unicode::toUpper):
-
-2010-11-23  Patrick Gansterer  <paroga@webkit.org>
+        Reviewed by Darin Adler.
 
-        Reviewed by Sam Weinig.
+        Rename WTF::StringHasher methods
+        https://bugs.webkit.org/show_bug.cgi?id=53532
 
-        Use WTF::StringHasher directly in JavaScriptCore
-        https://bugs.webkit.org/show_bug.cgi?id=49893
+        Rename createHash to computeHash and createBlobHash to hashMemory.
+        Also add a using WTF::StringHasher in the header file.
 
         * profiler/CallIdentifier.h:
         (JSC::CallIdentifier::Hash::hash):
         * runtime/Identifier.cpp:
         (JSC::IdentifierCStringTranslator::hash):
         (JSC::IdentifierUCharBufferTranslator::hash):
+        * wtf/StringHasher.h:
+        (WTF::StringHasher::computeHash):
+        (WTF::StringHasher::hashMemory):
+        * wtf/text/StringHash.h:
+        (WTF::CaseFoldingHash::hash):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::computeHash):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8Internal):
 
-2010-11-22  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        Add WTF::FixedArray::size()
-        https://bugs.webkit.org/show_bug.cgi?id=49891
-
-        Add a method to get the size of a FixedArray.
-
-        * wtf/FixedArray.h:
-        (WTF::FixedArray::size):
-
-2010-11-22  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        [WINCE] Set correct preprocessor definitions
-        https://bugs.webkit.org/show_bug.cgi?id=49887
+2011-03-18  Geoffrey Garen  <ggaren@apple.com>
 
-        * wtf/Platform.h:
+        Reviewed by Oliver Hunt.
 
-2010-11-22  Adam Roben  <aroben@apple.com>
-
-        Use paths relative to $WebKitVSPropsRedirectionDir to access shared .vsprops files
-
-        Apple's Windows build allows placing header files and import libraries for WebKit's
-        dependencies (CoreGraphics, CFNetwork, SQLite, etc.) outside the source tree via the
-        $WebKitLibrariesDir environment variable. This is both required for production builds and
-        convenient for Apple-internal developer builds. Apple's production builds also require that
-        WebKit's shared .vsprops files be accessed relative to $WebKitLibrariesDir. In production
-        builds, the files are copied into that directory tree by the
-        WebKitLibraries/win/tools/WinTools.make file. In Apple-internal developer builds, the
-        copying is done by
-        JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make.
-
-        This .vsprops copying is problematic in one very important case: when a developer updates
-        their source tree and then tries to build. Visual Studio only reads .vsprops files when a
-        project is first loaded. So, when Visual Studio is first opened after the .vsprops files are
-        updated, it reads in the old files that were already residing in $WebKitLibrariesDir. When a
-        build is started, JavaScriptCoreGenerated.make copies the new .vsprops files into
-        $WebKitLibrariesDir, but Visual Studio will not pick up the changes.  The rest of the build
-        will proceed with out-of-date .vsprops files, which will likely result in a build failure.
-
-        To fix this, we now use normal relative paths to access the .vsprops files in the source
-        tree rather than in $WebKitLibrariesDir, but prefix those paths with a new environment
-        variable, $WebKitVSPropsRedirectionDir. In developer builds, this environment variable is
-        unset, so the normal relative paths are used to read the .vsprops files out of the source
-        tree directly. In production builds, this environment variable is set to a fake directory
-        that will cause the .vsprops files in $WebKitLibrariesDir to be found when the relative path
-        is resolved.
+        [GTK] JSC crashes in 32bit Release bots after r80743
+        https://bugs.webkit.org/show_bug.cgi?id=56180
         
-        For example, JavaScriptCore.vcproj uses this path for FeatureDefines.vsprops:
-
-        $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops
-
-        In developer builds, where $WebKitVSPropsRedirectionDir is unset, this will point to the
-        files in WebKitLibraries\win\tools\vsprops in the source tree. In production builds,
-        JavaScriptCore.make sets $WebKitVSPropsRedirectionDir to
-        "$(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\1\2\3\", so the full path for
-        FeatureDefines.vsprops becomes:
-
-        $(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\1\2\3\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops
-
-        which resolves to:
-
-        $(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops
-
-        (We rely on the fact that Windows doesn't care whether the directories "1", "2", and "3"
-        actually exist since they are matched by an equal number of ".." path components.)
-
-        Note that Visual Studio still won't pick up changes made to .vsprops files while Visual
-        Studio is open, but that problem hasn't seemed to cause developers many headaches so far.
-
-        Fixes <http://webkit.org/b/49181> Windows build fails mysteriously when .vsprops files are
-        updated
-
-        Reviewed by Dave Hyatt.
+        The crash was caused by referencing GC memory from a GC destructor. This
+        is not safe because destruction time / order is not guaranteed.
 
-        * JavaScriptCore.vcproj/JavaScriptCore.make: Set $WebKitVSPropsRedirectionDir so that
-        production builds can find the .vsprops files.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Stopy copying the
-        .vsprops files. It isn't needed anymore.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
-        Changed to use paths relative to $WebKitVSPropsRedirectionDir to access shared .vsprops
-        files.
-
-2010-11-19  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Gavin Barraclough.
-
-        YARR JIT should fallback to YARR Interpreter instead of PCRE.
-        https://bugs.webkit.org/show_bug.cgi?id=46719
-
-        Remove the ENABLE_YARR macro and the option of matching regular
-        expressions with PCRE from JavaScriptCore.
-
-        * runtime/JSGlobalData.h:
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::compile):
-        (JSC::RegExp::match):
-        * tests/mozilla/expected.html:
-        * wtf/Platform.h:
-        * yarr/RegexCompiler.cpp:
-        * yarr/RegexCompiler.h:
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::byteCompileRegex):
-        * yarr/RegexInterpreter.h:
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::jitCompileRegex):
-        * yarr/RegexJIT.h:
-        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
-        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
-        (JSC::Yarr::RegexCodeBlock::getFallback):
-        (JSC::Yarr::RegexCodeBlock::isFallback):
-        (JSC::Yarr::RegexCodeBlock::setFallback):
-        (JSC::Yarr::executeRegex):
-        * yarr/RegexParser.h:
-        * yarr/RegexPattern.h:
-
-2010-11-20  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by David Kilzer.
-
-        [BREWMP] Replace DBGPRINTF and DBGPRINTF_FATAL with dbg_Message
-        https://bugs.webkit.org/show_bug.cgi?id=49520
-
-        DBGPRINTF and DBGPRINTF_FATAL macros are prohibited in Mod1. Use dbg_Message instead.
-
-        * wtf/Assertions.cpp:
-        * wtf/Assertions.h:
-
-2010-11-20  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        Support JIT_OPTIMIZE_MOD on Thumb-2
-        https://bugs.webkit.org/show_bug.cgi?id=49432
-
-        Rewrite the soft modulo operation into macroassembler form, and move it
-        to JSValue32_64 section.
-        Add support for soft modulo on Thumb-2 JIT also.
-
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::clz):
-        * assembler/MacroAssemblerARM.h:
-        (JSC::MacroAssemblerARM::countLeadingZeros32):
-        (JSC::MacroAssemblerARM::relativeTableJump):
-        * assembler/MacroAssemblerARMv7.h:
-        (JSC::MacroAssemblerARMv7::countLeadingZeros32):
-        (JSC::MacroAssemblerARMv7::relativeTableJump):
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::emit_op_mod):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::softModulo):
-        * jit/JITStubs.cpp:
-        (JSC::JITThunks::JITThunks):
-        * wtf/Platform.h:
-
-2010-11-20  David Kilzer  <ddkilzer@apple.com>
-
-        <http://webkit.org/b/49848> Make it possible to display the last character of a secure text field unobscured
-
-        Reviewed by Darin Adler.
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::create):
+        (JSC::ProfileGenerator::ProfileGenerator):
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        * profiler/ProfileGenerator.h:
+        (JSC::ProfileGenerator::origin): Made ExecState* the first argument,
+        to match the rest of this class and JSC.
+        
+        Use a JSGlobalObject* instead of an ExecState* with an indirect reference
+        to a JSGlobalObject* to track our origin. This is simpler and more
+        efficient, and it removes the destruction order dependency that was causing
+        our crash.
 
-        * JavaScriptCore.exp:
-        * wtf/text/StringImpl.cpp:
-        (WTF::StringImpl::secure): Added argument that controls whether
-        the last character is obscured or not.  Implemented behavior.
-        * wtf/text/StringImpl.h:
-        (WTF::StringImpl::LastCharacterBehavior): Added enum.
-        (WTF::StringImpl::secure): Updated method signature.
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::startProfiling): Updated for change to JSGlobalObject*.
+        (JSC::Profiler::stopProfiling): New function for stopping all profiles
+        for a given global object. This is more straight-forward than multiplexing
+        through the old function.
 
-2010-11-19  William Chan  <willchan@chromium.org>
+        (JSC::dispatchFunctionToProfiles): Updated for change to JSGlobalObject*.
+        * profiler/Profiler.h: Ditto.
 
-        Reviewed by David Levin.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject): Ditto.
 
-        Add USE(CHROMIUM_NET)
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
 
-        Indicates the use of Chromium's network stack.  Chromium's network
-        stack performs better when it has full view of all resource requests,
-        so USE(CHROMIUM_NET) can be used to bypass throttles.
+        Reviewed by Oliver Hunt.
 
-        https://bugs.webkit.org/show_bug.cgi?id=49778
+        1 Structure leaked beneath JSGlobalData::storeVPtrs()
+        https://bugs.webkit.org/show_bug.cgi?id=56595
 
-        * wtf/Platform.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::VPtrHackExecutable::VPtrHackExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable): Use a raw pointer instead of
+        PassRefPtr, like JSString does, since JSGlobalData owns the singleton
+        exectuable structure.
 
-2010-11-19  Steve Falkenburg  <sfalken@apple.com>
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Adam Roben.
+        Reviewed by Mark Rowe.
 
-        Add Debug_Cairo_CFLite and Release_Cairo_CFLite configurations for all vcproj files
-        https://bugs.webkit.org/show_bug.cgi?id=49819
+        Fixed some string leaks seen on the buildbot
+        https://bugs.webkit.org/show_bug.cgi?id=56619
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::~PropertyTable): DEref!
 
-2010-11-19  Oliver Hunt  <oliver@apple.com>
+2011-03-17  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Geoffrey Garen.
 
-        Don't check for constant registers when we can guarantee that the register won't be in the constant pool
-        https://bugs.webkit.org/show_bug.cgi?id=49814
+        Crash in  JSC::MarkStack::drain Under Stress
+        https://bugs.webkit.org/show_bug.cgi?id=56470
 
-        Add uncheckedR(int) to CallFrame, and replace all the uses of r() with uncheckedR()
-        when we can guarantee that the register is not referring to a constant.
-        This makes the interpreter about 0.5% faster, and makes the CallFrame initialisation
-        logic correct when we're using a faked callframe (as in the case of the globalExec).
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::createActivation):
-        * debugger/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::thisObject):
-        * interpreter/CallFrame.h:
-        (JSC::ExecState::uncheckedR):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::resolve):
-        (JSC::Interpreter::resolveSkip):
-        (JSC::Interpreter::resolveGlobal):
-        (JSC::Interpreter::resolveGlobalDynamic):
-        (JSC::Interpreter::resolveBase):
-        (JSC::Interpreter::resolveBaseAndProperty):
-        (JSC::Interpreter::callEval):
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::executeCall):
-        (JSC::Interpreter::executeConstruct):
-        (JSC::Interpreter::prepareForRepeatCall):
-        (JSC::Interpreter::createExceptionScope):
-        (JSC::Interpreter::privateExecute):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * runtime/JSActivation.cpp:
-        (JSC::JSActivation::argumentsGetter):
-
-2010-11-19  Steve Falkenburg  <sfalken@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Normalize Cairo/CFLite project/solution configuration names
-        https://bugs.webkit.org/show_bug.cgi?id=49818
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
-
-2010-11-18  Steve Falkenburg  <sfalken@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Windows vcproj configuration names should be normalized across projects
-        https://bugs.webkit.org/show_bug.cgi?id=49776
-
-        * JavaScriptCore.vcproj/JavaScriptCore.sln:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops: Added.
-        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
-
-2010-11-19  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed, build fix after r72360.
-
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::bytecodeOffset):
-
-2010-11-18  Gavin Barraclough  <barraclough@apple.com>
-
-        Rubber stamped by Geoff Garen.
-
-        Bug 49577 - Function.prototype should be non-configurable
-
-        Ooops, Function.prototype should not be enumerable!
-
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::getOwnPropertySlot):
-
-2010-11-18  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
+        We perform a number of gc allocations while when
+        we are setting up new globals in a piece of global
+        code.  We do this by adding new properties to the
+        symbol table, and then expanding the storage to fit
+        at the end.
 
-        Bug 49708 - Stop recompiling functions to regenerate exception info.
+        If a GC happens during this time we will report an
+        incorrect size for the global object's symbol table
+        storage.
 
-        Instead only hold info as necessary – keep divot info is the inspector
-        is enabled, line number info is debugging or profiling, and handler
-        info for functions with try/catch.
+        This patch corrects this by growing the storage size
+        before we starting adding entries to the symbol table.
 
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dumpStatistics):
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::CodeBlock::lineNumberForBytecodeOffset):
-        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
-        (JSC::CodeBlock::shrinkToFit):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::bytecodeOffset):
-        (JSC::CodeBlock::addExpressionInfo):
-        (JSC::CodeBlock::addLineInfo):
-        (JSC::CodeBlock::hasExpressionInfo):
-        (JSC::CodeBlock::hasLineInfo):
-        (JSC::CodeBlock::needsCallReturnIndices):
-        (JSC::CodeBlock::callReturnIndexVector):
-        * bytecode/SamplingTool.cpp:
-        (JSC::SamplingTool::dump):
         * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::generate):
         (JSC::BytecodeGenerator::BytecodeGenerator):
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::emitNode):
-        (JSC::BytecodeGenerator::emitNodeInConditionContext):
-        (JSC::BytecodeGenerator::emitExpressionInfo):
-        (JSC::BytecodeGenerator::addLineInfo):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::appendSourceToError):
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::retrieveLastCaller):
-        * interpreter/Interpreter.h:
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile):
-        * jit/JITStubs.cpp:
-        (JSC::jitThrow):
-        (JSC::DEFINE_STUB_FUNCTION):
-        * runtime/Collector.cpp:
-        (JSC::Heap::markRoots):
-        * runtime/Executable.cpp:
-        (JSC::EvalExecutable::compileInternal):
-        (JSC::ProgramExecutable::compileInternal):
-        (JSC::FunctionExecutable::compileForCallInternal):
-        (JSC::FunctionExecutable::compileForConstructInternal):
-        * runtime/Executable.h:
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * runtime/JSGlobalData.h:
-        (JSC::JSGlobalData::usingAPI):
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::supportsRichSourceInfo):
-        (JSC::JSGlobalObject::globalData):
-
-2010-11-18  Adam Roben  <aroben@apple.com>
-
-        Add a script to delete manifest-related files when they are older than
-        any .vsprops file
-
-        Changes to .vsprops files can cause the manifest files to become
-        invalid, and Visual Studio doesn't always figure out that it needs to
-        rebuild them.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::resizeRegisters):
 
-        Reviewed by Sam Weinig.
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
-        Call the new script.
+        Reviewed by Oliver Hunt.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
-        Added the new script.
+        1 Structure leaked beneath JSGlobalData::storeVPtrs()
+        https://bugs.webkit.org/show_bug.cgi?id=56595
 
-        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py: Added.
-        (file_modification_times): Generator to return the modification time of
-        each file in a directory hierarchy.
-        (main): Get the modification time of the newest vsprops file, then find
-        all manifest-related files in the obj directory. Delete all
-        manifest-related files that are older than the newest vsprops file.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs): Take local ownership of the Structure
+        we're using, since the Executable is not designed to own the Structure.
 
-2010-11-18  Mark Rowe  <mrowe@apple.com>
+2011-03-17  Gavin Barraclough  <barraclough@apple.com>
 
-        Rubber-stamped by Adam Roben.
+        Rubber Stamped by Sam Weinig.
 
-        <rdar://problem/8602509&8602717&8602724> Enable compaction support.
+        Add missing register-register branchTest8 to MacroAssemblerX86Common/X86Assembler.
 
-        * Configurations/JavaScriptCore.xcconfig:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::testb_rr):
 
-2010-11-18  Gavin Barraclough  <barraclough@apple.com>
+2011-03-17  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Sam Weinig.
 
-        Bug 49635 - Profiler implementation is fragile
-
-        The profile presently requires the exception handling mechanism to explicitly
-        remove all stack frames that are exited during the exception unwind mechanism.
-        This is fragile in a number of ways:
-          * We have to change bytecode register allocation when compiling code to run
-            when profiling, to preserve the callee function (this is also required to
-            call did_call after the call has returned).
-          * In the JIT we have to maintain additional data structures
-            (CodeBlock::RareData::m_functionRegisterInfos) to map back to the register
-            containing the callee.
-          * In the interpreter we use 'magic values' to offset into the instruction
-            stream to rediscover the register containing the function.
-
-        Instead, move profiling into the head and tail of functions.
-          * This correctly accounts the cost of the call itself to the caller.
-          * This allows us to access the callee function object from the callframe.
-          * This means that at the point a call is made we can track the stack depth
-            on the ProfileNode.
-          * When unwinding we can simply report the depth at which the exception is
-            being handled - all call frames above this level are freed.
+        Bug 56603 - DFG JIT related cleanup
+        Move node generation out to separate function, move binarySearch algorithm out
+        to StdLibExtras, fix Graph::dump() to print comma between non-node children,
+        even if there are no node children.
 
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::shrinkToFit):
         * bytecode/CodeBlock.h:
+        (JSC::getCallReturnOffset):
+        (JSC::CodeBlock::getStubInfo):
+        (JSC::CodeBlock::getCallLinkInfo):
+        (JSC::CodeBlock::getMethodCallLinkInfo):
         (JSC::CodeBlock::bytecodeOffset):
-        (JSC::CodeBlock::methodCallLinkInfo):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitCall):
-        (JSC::BytecodeGenerator::emitCallVarargs):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::executeCall):
-        (JSC::Interpreter::executeConstruct):
-        (JSC::Interpreter::privateExecute):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * profiler/Profile.cpp:
-        (JSC::Profile::Profile):
-        * profiler/ProfileGenerator.cpp:
-        (JSC::ProfileGenerator::addParentForConsoleStart):
-        (JSC::ProfileGenerator::willExecute):
-        (JSC::ProfileGenerator::didExecute):
-        (JSC::ProfileGenerator::exceptionUnwind):
-        (JSC::ProfileGenerator::stopProfiling):
-        * profiler/ProfileGenerator.h:
-        * profiler/ProfileNode.cpp:
-        (JSC::ProfileNode::ProfileNode):
-        (JSC::ProfileNode::willExecute):
-        * profiler/ProfileNode.h:
-        (JSC::ProfileNode::create):
-        (JSC::ProfileNode::callerCallFrame):
-        * profiler/Profiler.cpp:
-        (JSC::dispatchFunctionToProfiles):
-        (JSC::Profiler::_willExecute):
-        (JSC::Profiler::_didExecute):
-        (JSC::Profiler::exceptionUnwind):
-        * profiler/Profiler.h:
-
-2010-11-18  Steve Falkenburg  <sfalken@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Remove leftover Windows Debug_Internal configurations
-        https://bugs.webkit.org/show_bug.cgi?id=49758
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
-
-2010-11-18  Chao-ying Fu  <fu@mips.com>
-
-        Reviewed by Csaba Osztrogonác.
-
-        Avoid increasing required alignment of target type warning
-        https://bugs.webkit.org/show_bug.cgi?id=43963
-
-        * runtime/UString.h:
-        (JSC::UStringHash::equal):
+            - Move binaryChop to binarySearch in StdLibExtras
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parse):
+        (JSC::DFG::parse):
+            - Make m_noArithmetic a member, initialize m_currentIndex in the constructor.
+        * dfg/DFGByteCodeParser.h:
+            - Change parse() to not take a start index (always 0).
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+            - Fix Graph::dump() to print comma between non-node children, even if there are no node children.
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::JITCodeGenerator):
+            - Initialize m_compileIndex in constructor.
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+            - Spilt out compilation of individual node.
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationConvertThis):
+        * dfg/DFGOperations.h:
+            - Cleanup parameter name.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+            - Spilt out compilation of individual node.
+        * runtime/Executable.cpp:
+        (JSC::tryDFGCompile):
+            - Change parse() to not take a start index (always 0).
         * wtf/StdLibExtras.h:
+        (WTF::binarySearch):
+            - Move binaryChop to binarySearch in StdLibExtras
 
-2010-11-17  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Anders Carlsson.
+2011-03-17  Anders Carlsson  <andersca@apple.com>
 
-        Add stubbed out ScrollAnimator for the Mac
-        https://bugs.webkit.org/show_bug.cgi?id=49678
+        Reviewed by Geoffrey Garen.
 
-        * wtf/Platform.h: Enable SMOOTH_SCROLLING on the Mac, this has no
-        change in behavior at the moment.
+        Fix clang build.
 
-2010-11-17  David Kilzer  <ddkilzer@apple.com>
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
 
-        <http://webkit.org/b/49634> Make overflow guards in WTF::String::utf8 explicit
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Darin Adler.
 
-        Add an explicit overflow check prior to allocating our buffer,
-        rather than implicitly relying on the guard in convertUTF16ToUTF8.
-
-        * wtf/text/WTFString.cpp:
-        (WTF::String::utf8):
-
-2010-11-17  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r72197.
-        http://trac.webkit.org/changeset/72197
-        https://bugs.webkit.org/show_bug.cgi?id=49661
+        1 Structure leaked beneath JSGlobalData::storeVPtrs()
+        https://bugs.webkit.org/show_bug.cgi?id=56595
 
-        broke fast/regex/test1.html (Requested by stampho on #webkit).
-
-        * runtime/JSGlobalData.h:
-        * runtime/RegExp.cpp:
-        (JSC::RegExpRepresentation::~RegExpRepresentation):
-        (JSC::RegExp::compile):
-        (JSC::RegExp::match):
-        * tests/mozilla/expected.html:
-        * wtf/Platform.h:
-        * yarr/RegexCompiler.cpp:
-        * yarr/RegexCompiler.h:
-        * yarr/RegexInterpreter.cpp:
-        * yarr/RegexInterpreter.h:
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::jitCompileRegex):
-        * yarr/RegexJIT.h:
-        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
-        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
-        (JSC::Yarr::RegexCodeBlock::getFallback):
-        (JSC::Yarr::RegexCodeBlock::setFallback):
-        (JSC::Yarr::executeRegex):
-        * yarr/RegexParser.h:
-        * yarr/RegexPattern.h:
-
-2010-11-17  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Gavin Barraclough.
-
-        YARR JIT should fallback to YARR Interpreter instead of PCRE.
-        https://bugs.webkit.org/show_bug.cgi?id=46719
-
-        Remove the ENABLE_YARR macro and the option of matching regular
-        expressions with PCRE from JavaScriptCore.
-
-        * runtime/JSGlobalData.h:
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::compile):
-        (JSC::RegExp::match):
-        * tests/mozilla/expected.html:
-        * wtf/Platform.h:
-        * yarr/RegexCompiler.cpp:
-        * yarr/RegexCompiler.h:
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::byteCompileRegex):
-        * yarr/RegexInterpreter.h:
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::jitCompileRegex):
-        * yarr/RegexJIT.h:
-        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
-        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
-        (JSC::Yarr::RegexCodeBlock::getFallback):
-        (JSC::Yarr::RegexCodeBlock::isFallback):
-        (JSC::Yarr::RegexCodeBlock::setFallback):
-        (JSC::Yarr::executeRegex):
-        * yarr/RegexParser.h:
-        * yarr/RegexPattern.h:
-
-2010-11-17  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Gavin Barraclough.
-
-        Extend YARR Interpreter with beginning character look-up optimization
-        https://bugs.webkit.org/show_bug.cgi?id=45751
-
-        Add beginning character look-up optimization which sets the start
-        index to the first possible successful pattern match.
-        Extend YARR Interpreter with lookupForBeginChars function which
-        implements the beginning character look-up optimization.
-
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::Interpreter::InputStream::readPair):
-        (JSC::Yarr::Interpreter::InputStream::isNotAvailableInput):
-        (JSC::Yarr::Interpreter::lookupForBeginChars):
-        (JSC::Yarr::Interpreter::matchDisjunction):
-        (JSC::Yarr::Interpreter::interpret):
-        * yarr/RegexInterpreter.h:
-        (JSC::Yarr::BytecodePattern::BytecodePattern):
-
-2010-11-17  Alexis Menard  <alexis.menard@nokia.com>, Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Kenneth Christiansen, Tor Arne Vestbø.
-
-        [Qt] Add support for use GStreamer with the Qt build
-
-        Enable the build/inclusion of the wtf/QObject convenience classes.
-
-        * JavaScriptCore.pri:
-        * wtf/wtf.pri:
-
-2010-11-17  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Gavin Barraclough.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs): Now that we have an executable, we need
+        to explicitly run its destructor.
 
-        Collect the beginning characters in a RegExp pattern for look-up
-        optimization
-        https://bugs.webkit.org/show_bug.cgi?id=45748
-
-        Extend the YARR's parser with an algorithm which collects the potential
-        beginning characters from a RegExp pattern for later look-up optimization.
-
-        * yarr/RegexCompiler.cpp:
-        (JSC::Yarr::BeginCharHelper::BeginCharHelper):
-        (JSC::Yarr::BeginCharHelper::addBeginChar):
-        (JSC::Yarr::BeginCharHelper::merge):
-        (JSC::Yarr::BeginCharHelper::addCharacter):
-        (JSC::Yarr::BeginCharHelper::linkHotTerms):
-        (JSC::Yarr::RegexPatternConstructor::RegexPatternConstructor):
-        (JSC::Yarr::RegexPatternConstructor::addBeginTerm):
-        (JSC::Yarr::RegexPatternConstructor::setupDisjunctionBeginTerms):
-        (JSC::Yarr::RegexPatternConstructor::setupAlternativeBeginTerms):
-        (JSC::Yarr::RegexPatternConstructor::setupBeginChars):
-        (JSC::Yarr::compileRegex):
-        * yarr/RegexPattern.h:
-        (JSC::Yarr::TermChain::TermChain):
-        (JSC::Yarr::BeginChar::BeginChar):
-        (JSC::Yarr::RegexPattern::RegexPattern):
-        (JSC::Yarr::RegexPattern::reset):
-
-2010-11-17  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r72160.
-        http://trac.webkit.org/changeset/72160
-        https://bugs.webkit.org/show_bug.cgi?id=49646
-
-        Broke lots of fast/profiler tests, among others (Requested by
-        aroben on #webkit).
+2011-03-17  Jeff Miller  <jeffm@apple.com>
 
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::functionRegisterForBytecodeOffset):
-        (JSC::CodeBlock::shrinkToFit):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::addFunctionRegisterInfo):
-        * bytecode/Opcode.h:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitCall):
-        (JSC::BytecodeGenerator::emitCallVarargs):
-        (JSC::BytecodeGenerator::emitReturn):
-        (JSC::BytecodeGenerator::emitConstruct):
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::CallArguments::profileHookRegister):
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::CallArguments::CallArguments):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::executeCall):
-        (JSC::Interpreter::executeConstruct):
-        (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JIT.h:
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_profile_will_call):
-        (JSC::JIT::emit_op_profile_did_call):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_profile_will_call):
-        (JSC::JIT::emit_op_profile_did_call):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jit/JITStubs.h:
-        * profiler/Profile.cpp:
-        (JSC::Profile::Profile):
-        * profiler/ProfileGenerator.cpp:
-        (JSC::ProfileGenerator::addParentForConsoleStart):
-        (JSC::ProfileGenerator::willExecute):
-        (JSC::ProfileGenerator::didExecute):
-        (JSC::ProfileGenerator::stopProfiling):
-        * profiler/ProfileGenerator.h:
-        * profiler/ProfileNode.cpp:
-        (JSC::ProfileNode::ProfileNode):
-        (JSC::ProfileNode::willExecute):
-        * profiler/ProfileNode.h:
-        (JSC::ProfileNode::create):
-        (JSC::ProfileNode::operator==):
-        * profiler/Profiler.cpp:
-        (JSC::dispatchFunctionToProfiles):
-        (JSC::Profiler::willExecute):
-        (JSC::Profiler::didExecute):
-        * profiler/Profiler.h:
+        Use a consistent set of file patterns in the svn:ignore property for all .xcodeproj directories, specifically:
+        
+        *.mode*
+        *.pbxuser
+        *.perspective*
+        project.xcworkspace
+        xcuserdata
 
-2010-11-16  Gavin Barraclough  <barraclough@apple.com>
+        * JavaScriptCore.xcodeproj: Modified property svn:ignore.
 
-        Reviewed by Sam Weinig.
+2011-03-17  Gavin Barraclough  <barraclough@apple.com>
 
-        Bug 49635 - Profiler implementation is fragile
-
-        The profile presently requires the exception handling mechanism to explicitly
-        remove all stack frames that are exited during the exception unwind mechanism.
-        This is fragile in a number of ways:
-          * We have to change bytecode register allocation when compiling code to run
-            when profiling, to preserve the callee function (this is also required to
-            call did_call after the call has returned).
-          * In the JIT we have to maintain additional data structures
-            (CodeBlock::RareData::m_functionRegisterInfos) to map back to the register
-            containing the callee.
-          * In the interpreter we use 'magic values' to offset into the instruction
-            stream to rediscover the register containing the function.
-
-        Instead, move profiling into the head and tail of functions.
-          * This correctly accounts the cost of the call itself to the caller.
-          * This allows us to access the callee function object from the callframe.
-          * This means that at the point a call is made we can track the stack depth
-            on the ProfileNode.
-          * When unwinding we can simply report the depth at which the exception is
-            being handled - all call frames above this level are freed.
+        Reverting r81197, breaks JIT + INTERPRETER build.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
         * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::shrinkToFit):
+        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
         * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::bytecodeOffset):
-        (JSC::CodeBlock::methodCallLinkInfo):
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::addStructureStubInfo):
         * bytecode/Opcode.h:
+        * bytecode/StructureStubInfo.h:
         * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
         (JSC::BytecodeGenerator::emitCall):
-        (JSC::BytecodeGenerator::emitCallVarargs):
-        (JSC::BytecodeGenerator::emitReturn):
         (JSC::BytecodeGenerator::emitConstruct):
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::CallArguments::count):
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::CallArguments::CallArguments):
-        * interpreter/Interpreter.cpp:
-        (JSC::ProfileHostCall::ProfileHostCall):
-        (JSC::ProfileHostCall::~ProfileHostCall):
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::executeCall):
-        (JSC::Interpreter::executeConstruct):
-        (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JIT.h:
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_profile_has_called):
-        (JSC::JIT::emit_op_profile_will_return):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_profile_has_called):
-        (JSC::JIT::emit_op_profile_will_return):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jit/JITStubs.h:
-        * profiler/Profile.cpp:
-        (JSC::Profile::Profile):
-        * profiler/ProfileGenerator.cpp:
-        (JSC::ProfileGenerator::addParentForConsoleStart):
-        (JSC::ProfileGenerator::willExecute):
-        (JSC::ProfileGenerator::didExecute):
-        (JSC::ProfileGenerator::exceptionUnwind):
-        (JSC::ProfileGenerator::stopProfiling):
-        * profiler/ProfileGenerator.h:
-        * profiler/ProfileNode.cpp:
-        (JSC::ProfileNode::ProfileNode):
-        (JSC::ProfileNode::willExecute):
-        * profiler/ProfileNode.h:
-        (JSC::ProfileNode::create):
-        (JSC::ProfileNode::operator==):
-        (JSC::ProfileNode::exec):
-        * profiler/Profiler.cpp:
-        (JSC::dispatchFunctionToProfiles):
-        (JSC::Profiler::hasCalled):
-        (JSC::Profiler::willEvaluate):
-        (JSC::Profiler::willReturn):
-        (JSC::Profiler::didEvaluate):
-        (JSC::Profiler::exceptionUnwind):
-        * profiler/Profiler.h:
+        (JSC::BytecodeGenerator::emitCatch):
 
-2010-11-16  Brian Weinstein  <bweinstein@apple.com>
+2011-03-17  Ben Taylor  <bentaylor.solx86@gmail.com>
 
-        Reviewed by Adam Roben and Steve Falkenburg.
+        Reviewed by Alexey Proskuryakov.
 
-        Touch Platform.h to force a rebuild for Windows.
+        Add a COMPILER(SUNCC) define for Sun Studio 12. 
+        https://bugs.webkit.org/show_bug.cgi?56444
+        derived from patch 1 of 16 originally from https://bugs.webkit.org/show_bug.cgi?id=24932
 
         * wtf/Platform.h:
 
-2010-11-16  Steve Falkenburg  <sfalken@apple.com>
+2011-03-17  Jay Civelli  <jcivelli@chromium.org>
 
-        Reviewed by Adam Roben.
-
-        Disable LTCG for Windows Release builds. Add new Release_LTCG configuration.
-        https://bugs.webkit.org/show_bug.cgi?id=49632
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
-
-2010-11-16  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Gavin Barraclough.
-
-        The number of recursive match calls isn't limited in YARR Interpreter
-        https://bugs.webkit.org/show_bug.cgi?id=47906
-
-        Check the number of the matchDisjunction recursive calls to avoid unbounded
-        recursion.
-        Now the matchDisjunction function returns JSRegExpResult instead of bool.
-        The JSRegExpResult enum contains the result of matching or the error code
-        of the failure (like HitLimit) which terminates the matching.
-        The error codes are based on pcre's jsRegExpExecute error codes.
-
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
-        (JSC::Yarr::Interpreter::matchParentheses):
-        (JSC::Yarr::Interpreter::backtrackParentheses):
-        (JSC::Yarr::Interpreter::matchDisjunction):
-        (JSC::Yarr::Interpreter::matchNonZeroDisjunction):
-        (JSC::Yarr::Interpreter::interpret):
-        (JSC::Yarr::Interpreter::Interpreter):
-        * yarr/RegexInterpreter.h:
-
-2010-11-16  Brian Weinstein  <bweinstein@apple.com>
-
-        Rest of the Windows build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-11-16  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix pt 1.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Reviewed by David Levin.
 
-2010-11-16  Gavin Barraclough  <barraclough@apple.com>
+        Adding a contains method to Vector.
+        https://bugs.webkit.org/show_bug.cgi?id=55859
 
-        Reviewed by Oliver Hunt.
+        * wtf/Vector.h:
+        (WTF::::operator):
+        (WTF::::contains):
 
-        https://bugs.webkit.org/show_bug.cgi?id=49606
+2011-03-17  Patrick Gansterer  <paroga@webkit.org>
 
-        The bug here is that we read the prototype from the RHS argument using a regular
-        op_get_by_id before op_instanceof has checked that this is an object implementing
-        HasInstance. This incorrect behaviour gives rise to further unnecessary complexity
-        in the code base, since we have additional logic (implemented using the
-        GetByIdExceptionInfo data structures on CodeBlock) to convert not an object errors
-        from the get_by_id into invalid parameter errors. Having fixed this bug this code
-        is all redundant, since in these cases the get_by_id will never have been reached.
+        Fix the interpreter build.
 
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::shrinkToFit):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::addExpressionInfo):
-        * bytecode/Opcode.h:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitCheckHasInstance):
-        * bytecompiler/BytecodeGenerator.h:
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::InstanceOfNode::emitBytecode):
         * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        * jit/JIT.h:
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_check_has_instance):
-        (JSC::JIT::emit_op_instanceof):
-        (JSC::JIT::emitSlow_op_check_has_instance):
-        (JSC::JIT::emitSlow_op_instanceof):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_check_has_instance):
-        (JSC::JIT::emit_op_instanceof):
-        (JSC::JIT::emitSlow_op_check_has_instance):
-        (JSC::JIT::emitSlow_op_instanceof):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jit/JITStubs.h:
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createInterruptedExecutionException):
-        (JSC::createTerminatedExecutionException):
-        (JSC::createUndefinedVariableError):
-        (JSC::createNotAFunctionError):
-        (JSC::createNotAnObjectError):
-        * runtime/ExceptionHelpers.h:
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * runtime/JSGlobalData.h:
-        * runtime/JSNotAnObject.cpp:
-        (JSC::JSNotAnObject::toPrimitive):
-        (JSC::JSNotAnObject::getPrimitiveNumber):
-        (JSC::JSNotAnObject::toBoolean):
-        (JSC::JSNotAnObject::toNumber):
-        (JSC::JSNotAnObject::toString):
-        (JSC::JSNotAnObject::toObject):
-        (JSC::JSNotAnObject::getOwnPropertySlot):
-        (JSC::JSNotAnObject::getOwnPropertyDescriptor):
-        (JSC::JSNotAnObject::put):
-        (JSC::JSNotAnObject::deleteProperty):
-        (JSC::JSNotAnObject::getOwnPropertyNames):
-        * runtime/JSNotAnObject.h:
-        (JSC::JSNotAnObject::JSNotAnObject):
-        * runtime/JSObject.h:
-        (JSC::JSObject::isActivationObject):
-        * runtime/JSValue.cpp:
-        (JSC::JSValue::toObjectSlowCase):
-        (JSC::JSValue::synthesizeObject):
-        (JSC::JSValue::synthesizePrototype):
-
-2010-11-15  Darin Adler  <darin@apple.com>
+        (JSC::Interpreter::privateExecute): Added globalData to inheritorID().
 
-        Reviewed by Sam Weinig.
-
-        Harden additional string functions against large lengths
-        https://bugs.webkit.org/show_bug.cgi?id=49574
-
-        * wtf/text/CString.cpp:
-        (WTF::CString::init): Check for length that is too large for CString.
-        (WTF::CString::newUninitialized): Ditto.
-        (WTF::CString::copyBufferIfNeeded): Fix types so the length stays
-        in a size_t.
-
-        * wtf/text/WTFString.cpp:
-        (WTF::String::append): Check for length that is too large.
+2011-03-16  Sam Weinig  <sam@webkit.org>
 
-2010-11-15  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 49577 - Function.prototype should be non-configurable
-
-        JSC lazily allocates the prototype property of Function objects.
-
-        We check the prototype exists on 'get', but not on 'put'.
-        If you 'put' without having first done a 'get' you can end up with a configurable
-        prototype (prototype should only ever be non-configurable).
-
-        This is visible in a couple of ways:
-          * 'delete' on the property may succeed. (the next access will result in a new,
-          reset prototype object).
-          * the prototype may be set to a getter.
-
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::getOwnPropertyNames):
-            Reify the prototype property before allowing an enumerate including don't enum properties.
-        (JSC::JSFunction::put):
-            Reify the prototype property before any put to it.
-
-2010-11-15  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 49488 - Only add source specific information to exceptions in Interpreter::throwException
-
-        Three types of source location information are added to errors.
-
-        (1) Divot information.
-
-        This was added with the intention of using it to provide better source highlighting in the inspector.
-        We may still want to do so, but we probably should not be exposing these values in a manner visible to
-        user scripts – only through an internal C++ interface. The code adding divot properties to objects has
-        been removed.
-
-        (2) Line number information.
-
-        Line number information is presently sometimes added at the point the exception is created, and sometimes
-        added at the point the exception passes through throwException. Change this so that throwException has
-        the sole responsibility for adding line number and source file information.
-
-        (3) Source snippets in the message of certain type errors (e.g. 'doc' in `Result of expression 'doc' [undefined] is not an object.`).
-
-        These messages are currently created at the point the exceptions is raised. Instead reformat the message
-        such that the source snippet is located at the end (`Result of expression 'b1' [undefined] is not an object.`
-        becomes `'undefined' is not an object (evaluating 'b1.property')`), and append these to the message at
-        the in throw Exception. This presents a number of advantages:
-          * we no longer need to have source location information to create these TypeErrors.
-          * we can chose to append source location information in other error messages, including those where
-            passing source location to the point of construction would be inconvenient.
-          * we can chose in future to omit to append source location information when running in a non-debug mode.
-
-        This also cleans up some error output, e.g. removing double brackets ('[[]]') around objects in output,
-        removing double periods (..) at end of lines, and adding slightly more context to some errors.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
-            - Separated called to access line and range information.
-
-        * bytecode/CodeBlock.h:
-            - Separated called to access line and range information.
+        Fix the interpreter build.
 
         * interpreter/Interpreter.cpp:
         (JSC::Interpreter::resolve):
@@ -9805,2340 +4500,1570 @@
         (JSC::Interpreter::resolveGlobal):
         (JSC::Interpreter::resolveGlobalDynamic):
         (JSC::Interpreter::resolveBaseAndProperty):
-        (JSC::isInvalidParamForIn):
-        (JSC::isInvalidParamForInstanceOf):
-            - Update parameters passed to error constructors.
-        (JSC::appendSourceToError):
-            - Update message property to add location information (previously added in createErrorMessage, in ExceptionHelpers)
-        (JSC::Interpreter::throwException):
-            - Updated to call appendSourceToError. 
         (JSC::Interpreter::privateExecute):
-            - Update parameters passed to error constructors.
-
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-            - Update parameters passed to error constructors.
-
-        * runtime/Error.cpp:
-        (JSC::addErrorInfo):
-        (JSC::hasErrorInfo):
-            - Removed divot properties.
+        Remove .get()s.
 
-        * runtime/Error.h:
-            - Removed divot properties.
+2011-03-16  Adam Barth  <abarth@webkit.org>
 
-        * runtime/ErrorInstance.cpp:
-        (JSC::ErrorInstance::ErrorInstance):
-            - Initialize new property.
-
-        * runtime/ErrorInstance.h:
-        (JSC::ErrorInstance::appendSourceToMessage):
-        (JSC::ErrorInstance::setAppendSourceToMessage):
-        (JSC::ErrorInstance::clearAppendSourceToMessage):
-            - Added flag to check for errors needing location information appending.
-        (JSC::ErrorInstance::isErrorInstance):
-            - Added virtual method to check for ErrorInstances.
-
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createUndefinedVariableError):
-        (JSC::createInvalidParamError):
-        (JSC::createNotAConstructorError):
-        (JSC::createNotAFunctionError):
-        (JSC::createNotAnObjectError):
-            - Update parameters passed to error constructors, stopped adding line number information early, changed TypeError messages.
-
-        * runtime/ExceptionHelpers.h:
-            - Updated function signatures.
-
-        * runtime/JSFunction.cpp:
-        (JSC::callHostFunctionAsConstructor):
-            - Update parameters passed to error constructors.
-
-        * runtime/JSObject.h:
-        (JSC::JSObject::isErrorInstance):
-            - Added virtual method to check for ErrorInstances.
-
-2010-11-12  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Adam Roben.
-
-        CString(const char*) crashes when passed a null pointer
-        https://bugs.webkit.org/show_bug.cgi?id=49450
-
-        * wtf/text/CString.cpp:
-        (WTF::CString::CString):
-        Return early if str is null.
-
-2010-11-11  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 49420 - Clean up syntax/reference error throw.
-
-        Some errors detected at compile time are thrown at runtime. We currently do so using a op_new_error/op_throw bytecode pair.
-        This is not ideal. op_throw is used for explicit user throw statements, and has different requirements in terms or meta data
-        attached to the exception (controlled by the explicitThrow parameter passed to Interpreter::throwException). To work around
-        this, op_new_error has to add the meta data at an early stage, which is unlike other VM exceptions being raised.
-
-        We can simplify this and bring into line with other exception behaviour by changing new_error from just allocating an
-        Exception instance to also throwing it – but as a regular VM throw, correctly passing explicitThrow as false.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
-        * bytecode/Opcode.h:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitThrowReferenceError):
-        (JSC::BytecodeGenerator::emitThrowSyntaxError):
-        (JSC::BytecodeGenerator::emitThrowExpressionTooDeepException):
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::emitNodeInConditionContext):
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::ThrowableExpressionData::emitThrowReferenceError):
-        (JSC::ThrowableExpressionData::emitThrowSyntaxError):
-        (JSC::RegExpNode::emitBytecode):
-        (JSC::PostfixErrorNode::emitBytecode):
-        (JSC::PrefixErrorNode::emitBytecode):
-        (JSC::AssignErrorNode::emitBytecode):
-        (JSC::ForInNode::emitBytecode):
-        (JSC::ContinueNode::emitBytecode):
-        (JSC::BreakNode::emitBytecode):
-        (JSC::ReturnNode::emitBytecode):
-        (JSC::LabelNode::emitBytecode):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JIT.h:
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_throw_reference_error):
-        (JSC::JIT::emit_op_throw_syntax_error):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_throw_reference_error):
-        (JSC::JIT::emit_op_throw_syntax_error):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jit/JITStubs.h:
-        * parser/Nodes.h:
-
-2010-11-11  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Harden some string functions against large lengths
-        https://bugs.webkit.org/show_bug.cgi?id=49293
-
-        * wtf/text/StringImpl.cpp:
-        (WTF::StringImpl::create): Fix incorrect use of PassRefPtr. Check for
-        strlen results that are too large for StringImpl.
-        (WTF::StringImpl::lower): Check for lengths that are too large for
-        int32_t.
-        (WTF::StringImpl::upper): Fix incorrect use of PassRefPtr. Check for
-        lengths that are too large for int32_t.
-        (WTF::StringImpl::secure): Fix incorect use of PassRefPtr. Use unsigned
-        rather than int and int32_t so we can handle any length.
-        (WTF::StringImpl::foldCase): Fix incorrect use of PassRefPtr. Check for
-        lengths that are too large for int32_t.
-        (WTF::StringImpl::find): Check for strlen results that are too large for
-        StringImpl.
-        (WTF::StringImpl::findIgnoringCase): Ditto.
-        (WTF::StringImpl::replace): Fix incorrect use of PassRefPtr.
-        (WTF::StringImpl::createWithTerminatingNullCharacter): Check before
-        incrementing length.
-
-2010-11-11  Dan Horák  <dan@danny.cz>
-
-        Reviewed by Andreas Kling.
+        Reviewed by James Robinson.
 
-        Add support for the s390/s390x architectures, it's big-endian
-        with s390 being 32-bit and s390x being 64-bit.
+        Remove USE(BUILTIN_UTF8_CODEC)
+        https://bugs.webkit.org/show_bug.cgi?id=56508
 
-        https://bugs.webkit.org/show_bug.cgi?id=34786
+        We added this recently when we were unsure about the stability of the
+        built-in UTF-8 codec.  However, the codec seems to be stable, so we
+        don't need the macro.
 
         * wtf/Platform.h:
 
-2010-11-10  Csaba Osztrogonác  <ossy@webkit.org>
+2011-03-16  Daniel Bates  <dbates@rim.com>
 
-        Reviewed by David Hyatt.
-
-        HTML5 Ruby support should be mandatory feature
-        https://bugs.webkit.org/show_bug.cgi?id=49272
-
-        Remove Ruby as optional feature.
-
-        * Configurations/FeatureDefines.xcconfig:
-        * JavaScriptCorePrefix.h:: Touch it to avoid incremental build failure on Windows.
-
-2010-11-10  Peter Rybin  <peter.rybin@gmail.com>
-
-        Reviewed by Adam Barth.
-
-        HTML parser should provide script column position within HTML document to JavaScript engine
-        https://bugs.webkit.org/show_bug.cgi?id=45271
-
-        Adds TextPosition* classes -- a structure that stores line/column/generation
-        level coordinates inside text document. Adds *BasedNumber classes -- typesafe int
-        wrappers that emphasize whether int number is used as zero-based or
-        one-based.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/text/TextPosition.h: Added.
-        (WTF::TextPosition::TextPosition):
-        (WTF::TextPosition::minimumPosition):
-        (WTF::TextPosition::belowRangePosition):
-        (WTF::ZeroBasedNumber::fromZeroBasedInt):
-        (WTF::ZeroBasedNumber::ZeroBasedNumber):
-        (WTF::ZeroBasedNumber::zeroBasedInt):
-        (WTF::ZeroBasedNumber::base):
-        (WTF::ZeroBasedNumber::belowBase):
-        (WTF::OneBasedNumber::fromOneBasedInt):
-        (WTF::OneBasedNumber::OneBasedNumber):
-        (WTF::OneBasedNumber::oneBasedInt):
-        (WTF::OneBasedNumber::convertAsZeroBasedInt):
-        (WTF::OneBasedNumber::convertToZeroBased):
-        (WTF::OneBasedNumber::base):
-        (WTF::OneBasedNumber::belowBase):
-        (WTF::toZeroBasedTextPosition):
-        (WTF::toOneBasedTextPosition):
-        (WTF::ZeroBasedNumber::convertToOneBased):
-
-2010-11-09  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        ARM JIT asserts when loading http://reader.google.com in debug mode
-        https://bugs.webkit.org/show_bug.cgi?id=48912
-
-        There are several cases when the uninterrupted sequence is larger than
-        maximum required offset for pathing the same sequence. Eg.: if in a
-        uninterrupted sequence the last macroassembler's instruction is a stub
-        call, it emits store instruction(s) which should not be included in the
-        calculation of length of uninterrupted sequence. So, the insnSpace and
-        constSpace should be upper limit instead of hard limit.
-
-        * jit/JIT.h:
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::endUninterruptedSequence):
-
-2010-11-09  David Kilzer  <ddkilzer@apple.com>
-
-        <http://webkit.org/b/49279> Fix include statements for local headers
-
-        Reviewed by Gavin Barraclough.
-
-        Use "Foo.h" instead of <Foo.h> for local headers.
-
-        * assembler/AbstractMacroAssembler.h: Also fixed sort order.
-        * assembler/CodeLocation.h:
-        * yarr/RegexJIT.h:
-        * yarr/RegexParser.h:
-
-2010-11-08  Adam Roben  <aroben@apple.com>
-
-        Roll out r71532
-
-        It broke the build for Cygwin 1.7 installs. Cygwin 1.7's default
-        .bashrc unsets %TEMP%, which broke copy-tools.cmd.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
-        * JavaScriptCore.vcproj/JavaScriptCore/copy-tools.cmd: Removed.
-        * JavaScriptCore.vcproj/JavaScriptCore/show-alert.js: Removed.
-
-2010-11-08  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Xan Lopez.
-
-        >=webkitgtk-1.2.5: parallel build fails with libtool: link: cannot find the library `libwebkit-1.0.la' or unhandled argument `libwebkit-1.0.la'
-        https://bugs.webkit.org/show_bug.cgi?id=49128
-
-        r59042 introduced a C++-style comment in Platform.h, which is often
-        included in C source files. Change it to a C-style comment.
-
-        * wtf/Platform.h: Fix the C++-style comment.
-
-2010-11-08  Adam Roben  <aroben@apple.com>
-
-        Show a message and cause the build to immediately fail when any
-        .vsprops files are copied
-
-        When $WebKitLibrariesDir is set to a non-standard location, the
-        .vsprops files have to be copied from WebKitLibraries/win to
-        $WebKitLibrariesDir. When this happens, Visual Studio doesn't pick up
-        changes to the .vsprops files until the next time it opens the solution
-        file. Before this patch, the build would soldier on with the old
-        .vsprops files, leading to strange build failures. Now we detect that
-        the .vsprops files have been updated, display a message to the user
-        telling them what to do, and make the build fail immediately.
-
-        Fixes <http://webkit.org/b/49181> Windows build fail mysteriously when
-        .vsprops files are updated
-
-        Reviewed by Steve Falkenburg.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
-        Moved code to copy the tools directory to the new copy-tools.cmd
-        script. Moved that after the command that writes the buildfailed file
-        so the build will be considered a failure if copy-tools.cmd fails.
-        Changed to write the project name into buildfailed like all our other
-        projects do, so those other projects will know that the failure was due
-        to this project.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
-        Added new scripts.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/copy-tools.cmd: Added. Copies
-        the tools directory to $WebKitLibrariesDir. If any files were copied,
-        we display a message to the user and exit with error code 1 to cause
-        the build to fail. In non-interactive builds, we just print the message
-        to the build log. In interactive builds, we show the message in an
-        alert.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/show-alert.js: Added. Uses
-        Windows Scripting Host to display a message in an alert.
-
-2010-11-07  Sam Magnuson  <smagnuson@netflix.com>
-
-        Reviewed by Andreas Kling.
-
-        [Qt] make install does not cause JavaScriptCore to be built
-        https://bugs.webkit.org/show_bug.cgi?id=49114
-
-        * JavaScriptCore.pro:
-
-2010-11-05  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Gavin Barraclough.
+        Make JIT build for ARM Thumb-2 with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=56440
 
-        Website consistently crashing TOT in JIT::execute() on news.com.au
-        https://bugs.webkit.org/show_bug.cgi?id=48954
+        Derived from a patch by Dave Tapuska.
 
-        The problem here was the strict pass of this conversion was loading the
-        this structure into one register but doing the flags check off a different
-        register.  This is clearly wrong.  I have been unable to trigger the crash
-        with a reduction, but I've added an assertion to the this conversion to
-        attempt to make it more readily catchable in future.
+        Also, modify the RVCT stub template to indicate that it preserves 8 byte stack alignment.
 
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_convert_this_strict):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_convert_this_strict):
         * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-
-2010-11-04  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Adam Barth.
-
-        Use leakRef instead of releaseRef
-        https://bugs.webkit.org/show_bug.cgi?id=48974
-
-        Use leakRef instead of the deprecated releaseRef. This was renamed
-        some time ago because 'releaseRef' is too close to 'release',
-        which does something completely different.
-
-2010-11-04  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        REGRESSION(49798): Crash in HTMLObjectElement::parseMappedAttribute
-        https://bugs.webkit.org/show_bug.cgi?id=48789
 
-        The contract for all String/AtomicString methods seems to be that it's
-        safe to call them, even when the String is null (impl() returns 0).
-        This contract was broken by r49798 (unintentionally) when optimizing
-        for dromeo.
-        This patch adds a null check to AtomicString::lower() fixing this
-        crash and preventing future confusion.
+2011-03-16  Chao-ying Fu  <fu@mips.com>
 
-        * wtf/text/AtomicString.cpp:
-        (WTF::AtomicString::lower):
-
-2010-11-04  Adam Barth  <abarth@webkit.org>
+        Reviewed by Darin Adler.
 
-        Enabled ICCJPEG on Chromium Mac
-        https://bugs.webkit.org/show_bug.cgi?id=48977
+        Fix MIPS build with const *void
+        https://bugs.webkit.org/show_bug.cgi?id=56513
 
-        * wtf/Platform.h:
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::load32):
+        (JSC::MacroAssemblerMIPS::store32):
 
-2010-11-03  Oliver Hunt  <oliver@apple.com>
+2011-03-16  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Gavin Barraclough.
+        Reviewed by Darin Adler.
 
-        Crash in Function.prototype.call.apply
-        https://bugs.webkit.org/show_bug.cgi?id=48485
+        Remove unnecessary caller tracking shenanigans from CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=56483
 
-        The problem here was op_load_varargs failing to ensure that
-        there was sufficient space for the entire callframe prior to
-        op_call_varargs.  This meant that when we then re-entered the
-        VM it was possible to stomp over an earlier portion of the
-        stack, so causing sub-optimal behaviour.
+        This removes some leftover cruft from when we made CodeBlock
+        mark its callees.  Removing it gives us a 0.7% progression,
+        reducing the overall regression to ~1.3%.
 
-        * bytecode/Opcode.h:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitLoadVarargs):
-        * bytecompiler/BytecodeGenerator.h:
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
         * jit/JIT.cpp:
-        (JSC::JIT::privateCompile):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_load_varargs):
-
-2010-11-03  Kenneth Russell  <kbr@google.com>
-
-        Reviewed by Chris Marrin.
-
-        Redesign extension mechanism in GraphicsContext3D
-        https://bugs.webkit.org/show_bug.cgi?id=46894
-
-        * JavaScriptCore.exp:
-         - Exposed String::split(const String&, Vector<String>).
-
-2010-11-03  Adam Roben  <aroben@apple.com>
-
-        Bring WTF.vcproj up to date
-
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added filters for the text and
-        unicode directories, added new files, removed old files.
-
-2010-11-03  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Andreas Kling.
-
-        Remove unused initializeWeakRandomNumberGenerator
-        https://bugs.webkit.org/show_bug.cgi?id=48899
-
-        WeakRandom class is used instead of weakRandomNumber and its initializer.
-
-        * wtf/RandomNumberSeed.h:
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
 
-2010-11-03  Gabor Loki  <loki@webkit.org>
+2011-03-15  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Geoffrey Garen.
 
-        Unused class: JSFastMath with JSValue64
-        https://bugs.webkit.org/show_bug.cgi?id=48835
-
-        Remove unused JSFastMath class.
-
-        * runtime/JSImmediate.h:
-
-2010-11-02  Adam Roben  <aroben@apple.com>
-
-        Windows build fix after r71127
-
-        MSVC isn't smart enough to figure out that the definition of the global
-        nullptr variable isn't needed, so we provide one for it.
-
-        Fixes <http://webkit.org/b/48862> Windows build is broken due to
-        undefined symbol nullptr
-
-        Reviewed by Anders Carlsson.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export nullptr.
-
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added NullPtr.cpp and let VS
-        resort the files.
-
-        * wtf/NullPtr.cpp: Added.
-
-2010-11-02  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Xan Lopez.
-
-        Remove special handling of HashTableDeletedValue in PlatformRefPtr and manually manage memory that cannot be controlled by HashTraits
-        https://bugs.webkit.org/show_bug.cgi?id=48841
+        Make Structure creation require a JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=56438
 
-        Remove special handling of HashTableDeletedValue in PlatformRefPtr.
-        This is better handled on a case-by-case basis, when HashTraits
-        cannot account for it.
+        Mechanical change to make Structure::create require JSGlobalData&, and
+        require all users to provide the globalData.
 
-        * wtf/PlatformRefPtr.h:
-        (WTF::PlatformRefPtr::~PlatformRefPtr):
-        (WTF::PlatformRefPtr::clear):
-        (WTF::::operator):
-
-2010-10-29  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        REGRESSION: r69429-r69611: Crash in JSC::Interpreter::privateExecute
-        https://bugs.webkit.org/show_bug.cgi?id=47573
-
-        I think the interpreter portion of this was introduced by
-        an incorrect but silent merge when I updated prior to committing.
-        The JIT change is basically just a correctness fix, but it is
-        needed to prevent the testcase from asserting in debug builds.
-
-        The basic problem is incorrectly setting the activation object
-        on an arguments object.  The crash was due to us setting a null
-        activation in the interpreter, in the jit we were setting the
-        activation of a strict mode arguments object.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
         * jit/JITStubs.cpp:
         (JSC::DEFINE_STUB_FUNCTION):
-        * wtf/Platform.h:
-
-2010-10-29  Csaba Osztrogonác  <ossy@webkit.org>
-
-        Reviewed by Adam Roben and David Kilzer.
-
-        Fix and cleanup of build systems
-        https://bugs.webkit.org/show_bug.cgi?id=48342
-
-        * Configurations/FeatureDefines.xcconfig: Add missing ENABLE_FULLSCREEN_API
-
-2010-10-28  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Darin Adler.
-
-        Include stddef.h unconditionally in Assertions.h
-        https://bugs.webkit.org/show_bug.cgi?id=48573
-
-        There is no reason to have stddef.h include be MSVC-only.
-
-        * wtf/Assertions.h:
-
-2010-10-28  Herczeg Zoltan  <zherczeg@webkit.org>
-
-        Rubber stamped by Csaba Osztrogonác.
-
-        Try to fix interpreter build.
-
-        Needed parentheses around assignment to avoid GCC warning after
-        http://trac.webkit.org/changeset/70703
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-
-2010-10-28  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Csaba Osztrogonác.
-
-        resetAssertionMatches() is an unused function in YARR Interpreter
-        https://bugs.webkit.org/show_bug.cgi?id=48503
-
-        The resetAssertionMatches() function is removed from YARR Interpreter
-        because it's never called.
-
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::Interpreter::resetMatches):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionRun):
+        (jscmain):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::createStructure):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::createStructure):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::createDummyStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::createInheritorID):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSNonFinalObject::createStructure):
+        (JSC::JSFinalObject::createStructure):
+        (JSC::createEmptyObjectStructure):
+        (JSC::JSObject::inheritorID):
+        * runtime/JSObjectWithGlobalObject.h:
+        (JSC::JSObjectWithGlobalObject::createStructure):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::createStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
 
-2010-10-28  Zoltan Herczeg  <zherczeg@webkit.org>
+2011-03-16  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Andreas Kling.
+        Reviewed by Oliver Hunt.
 
-        Wrong instruction form for BKPT
-        https://bugs.webkit.org/show_bug.cgi?id=48427
+        Some conservative root gathering cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=56447
+        
+        SunSpider says 0.5% - 1.8% faster.
 
-        One '0' is missing from BKPT instruction.
-        Thanks for Jacob Bramley for reporting this error.
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::gatherConservativeRoots):
+        * interpreter/RegisterFile.h: New helper function for doing the
+        conservative gathering of the register file. It's still conservative,
+        since the register file may contain uninitialized values, but it's
+        moving-safe, because it only visits values tagged as pointers, so there's
+        no risk of mistaking an integer for a pointer and accidentally changing it.
 
-        * assembler/ARMAssembler.h:
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeRoots::add):
+        * runtime/ConservativeSet.h: Added a single-value add function, used above.
 
-2010-10-28  Xan Lopez  <xlopez@igalia.com>
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots): Separated machine stack conservative roots from
+        register file conservative roots because machine stack roots must be
+        pinned, but register file roots need not be pinned.
+        
+        Adopted new interface for passing the current stack extent to the machine
+        stack root gathering routine. This allows us to exclude marking-related
+        data structures on the stack, and thus avoid double-marking the set of
+        machine roots.
 
-        Try to fix Snow Leopard build.
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * runtime/MachineStackMarker.h: Added new interface, described above.
 
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::testPrototype):
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::firstAtom):
+        * wtf/StdLibExtras.h:
+        (WTF::roundUpToMultipleOf): Moved roundUpToMultipleOf so it could be used
+        by MachineStacks.
 
-2010-10-28  Xan Lopez  <xlopez@igalia.com>
+2011-03-16  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Do not have two different asCell APIs in JSValue
-        https://bugs.webkit.org/show_bug.cgi?id=47979
+        A little bit of MarkStack cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=56443
+        
+        Moved MarkStack functions into MarkStack.h/.cpp.
+        
+        SunSpider reports no change.
 
-        Remove JSCell* asCell(JSValue) in favor of only using
-        JSValue::asCell().
+        * runtime/JSArray.h:
+        * runtime/JSCell.h: Moved from here...
+        * runtime/MarkStack.cpp:
+        (JSC::MarkStack::markChildren):
+        (JSC::MarkStack::drain): ...to here. Also, no need to inline drain. It's
+        a huge function, and not called many times.
 
-        * API/APICast.h:
-        (toRef):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::testPrototype):
-        * jit/JITStubs.cpp:
-        (JSC::JITThunks::tryCachePutByID):
-        (JSC::JITThunks::tryCacheGetByID):
-        (JSC::DEFINE_STUB_FUNCTION):
-        * runtime/GetterSetter.h:
-        (JSC::asGetterSetter):
-        * runtime/JSByteArray.h:
-        (JSC::asByteArray):
-        * runtime/JSCell.h:
-        (JSC::JSCell::getCallData):
-        (JSC::JSCell::getConstructData):
-        * runtime/JSString.h:
-        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
-        (JSC::asString):
-        * runtime/JSValue.h:
-        * runtime/Operations.cpp:
-        (JSC::jsIsObjectType):
-        * runtime/Operations.h:
-        (JSC::normalizePrototypeChain):
-        * runtime/Protect.h:
-        (JSC::gcProtect):
-        (JSC::gcUnprotect):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::~MarkStack): Moved near constructor, per style guide.
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::deprecatedAppend):
+        (JSC::MarkStack::internalAppend): Moved to here.
 
-2010-10-27  Chao-ying Fu  <fu@mips.com>
+2011-03-15  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Support emit_op_mod() for MIPS on JSVALUE32_64
-        https://bugs.webkit.org/show_bug.cgi?id=46511
+        Removed another deprecatedAppend
+        https://bugs.webkit.org/show_bug.cgi?id=56429
 
-        This patch uses MIPS div instructions for op_mod to improve performance.
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::markStrongHandles):
+        * collector/handles/HandleHeap.h: Use HeapRootMarker, since handles are
+        marked directly by the Heap.
 
-        * jit/JITArithmetic32_64.cpp:
-        (JSC::JIT::emit_op_mod):
-
-2010-10-27  Brent Fulgham  <bfulgham@webkit.org>
-
-        Unreviewed build correction.
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots): Ditto.
 
-        * wtf/Platform.h: Make sure ACCELERATED_COMPOSITING is
-        turned off in the WinCairo port.  This isn't supported (yet.)
+2011-03-15  Geoffrey Garen  <ggaren@apple.com>
 
-2010-10-27  Chris Rogers  <crogers@google.com>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Chris Marrin.
+        Removed some more deprecated / unsafe append
+        https://bugs.webkit.org/show_bug.cgi?id=56428
 
-        Add ENABLE_WEB_AUDIO feature enable flag (initially disabled) to build-webkit
-        https://bugs.webkit.org/show_bug.cgi?id=48279
+        * collector/handles/HandleStack.cpp:
+        (JSC::HandleStack::mark):
+        * collector/handles/HandleStack.h: Mark the handle stack using a HeapRoot
+        marker, since it's a heap root.
+        
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h: Ditto.
 
-        * Configurations/FeatureDefines.xcconfig:
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots): Added a mark call for marking the handle stack.
+        It seems like Oliver forgot this in his last patch. (!)
 
-2010-10-27  Brian Weinstein  <bweinstein@apple.com>
+        * runtime/MarkStack.h: Removed appendSlots, since it would allow an
+        object to embed JSValues directly instead of using WriteBarrier.
 
-        Windows build fix.
+        (JSC::MarkStack::append): Added a private append for a list of values.
 
-        * jit/JITStubs.cpp:
-        (JSC::jitThrow):
+        (JSC::HeapRootMarker::mark): Access to the above.
 
-2010-10-27  Gavin Barraclough  <barraclough@apple.com>
+2011-03-15  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Bug 48365 - Remove output parameters from JITStackFrame
-
-        The JIT stub functions presently use the stackframe to provide a couple of additional return values.
-          * In the case of uncaught exceptions the exception value is returned on the stackframe.exception property.
-          * In the case of caught exceptions the updated value for the callFrame register is returned on the stackframe.callFrame property.
-
-        Change exception returns such that exceptions are always returned on JSGlobalData::exception.
-        Change op_catch such that the new CallFrame value is returned from op_throw / vm_throw in regT0.
+        Removed a few more deprecatedAppends, and removed HeapRoot<T>
+        https://bugs.webkit.org/show_bug.cgi?id=56422
+        
+        Added HeapRootMarker, a privileged class for marking direct heap roots
+        that are iterated during each garbage collection. This is easier to use
+        and more reliable than HeapRoot<T>, so I've removed HeapRoot<T>.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
         * debugger/Debugger.cpp:
         (JSC::evaluateInGlobalCallFrame):
         * debugger/DebuggerCallFrame.cpp:
         (JSC::DebuggerCallFrame::evaluate):
-        * interpreter/CachedCall.h:
-        (JSC::CachedCall::CachedCall):
-        (JSC::CachedCall::call):
         * interpreter/CallFrame.h:
         (JSC::ExecState::exception):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::callEval):
-        (JSC::Interpreter::Interpreter):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::executeCall):
-        (JSC::Interpreter::executeConstruct):
-        (JSC::Interpreter::prepareForRepeatCall):
-        (JSC::Interpreter::privateExecute):
-        * interpreter/Interpreter.h:
-        * jit/JITCode.h:
-        (JSC::JITCode::execute):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_catch):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_catch):
         * jit/JITStubs.cpp:
-        (JSC::ctiTrampoline):
-        (JSC::jitThrow):
         (JSC::DEFINE_STUB_FUNCTION):
-        * jit/JITStubs.h:
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncFilter):
-        (JSC::arrayProtoFuncMap):
-        (JSC::arrayProtoFuncEvery):
-        (JSC::arrayProtoFuncForEach):
-        (JSC::arrayProtoFuncSome):
-        (JSC::arrayProtoFuncReduce):
-        (JSC::arrayProtoFuncReduceRight):
-        * runtime/CallData.cpp:
-        (JSC::call):
         * runtime/Completion.cpp:
-        (JSC::evaluate):
-        * runtime/ConstructData.cpp:
-        (JSC::construct):
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createErrorForInvalidGlobalAssignment):
-        (JSC::throwOutOfMemoryError):
-        (JSC::throwStackOverflowError):
-        * runtime/ExceptionHelpers.h:
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::sort):
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncEval):
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncReplace):
+        (JSC::evaluate): exception is no longer a HeapRoot<T>, so no need to
+        call .get() on it.
 
-2010-10-27  Gabor Loki  <loki@webkit.org>
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h: Updated to use HeapRootMarker.
 
-        Reviewed by Oliver Hunt.
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::append): Added private functions for
+        HeapRootMarker to use.
 
-        https://bugs.webkit.org/show_bug.cgi?id=48060
-        Speed up op_jeq_null and op_jneq_null.
+        * runtime/JSGlobalData.h: exception is no longer a HeapRoot<T>.
 
-        For both opcodes the NullTag and UndefinedTag are checked to control the
-        jump. These values can be simply checked by AboveOrEqual or Below
-        condition if they are the two highest unsigned integers from JSValue's
-        Tag field.
+        * runtime/MarkStack.h:
+        (JSC::HeapRootMarker::HeapRootMarker):
+        (JSC::HeapRootMarker::mark): Added private functions for
+        HeapRootMarker to use.
 
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_jeq_null):
-        (JSC::JIT::emit_op_jneq_null):
-        * runtime/JSValue.h:
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::markChildren): Updated to use HeapRootMarker.
+
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings): Updated to use HeapRootMarker.
 
-2010-10-25  Geoffrey Garen  <ggaren@apple.com>
+        * runtime/WriteBarrier.h: Removed HeapRoot<T>.
+
+2011-03-14  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        https://bugs.webkit.org/show_bug.cgi?id=41948
-        REGRESSION(r60392): Registerfile can be unwound too far following an exception
+        Made the global object moving-GC-safe
+        https://bugs.webkit.org/show_bug.cgi?id=56348
         
         SunSpider reports no change.
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::throwException): Walk the stack to calculate the high
-        water mark currently in use. It's not safe to assume that the current
-        CallFrame's high water mark is the highest high water mark because
-        calls do not always set up at the end of a CallFrame. A large caller
-        CallFrame can encompass a small callee CallFrame.
-
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTINativeCall):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTINativeCall): Make sure to set a 0 CodeBlock
-        in the CallFrame of a host call, like the Interpreter does, instead of
-        leaving the CodeBlock field uninitialized. The backtracing code requires
-        a valid CodeBlock field in each CallFrame.
-
-2010-10-27  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Csaba Osztrogonác.
-
-        Add cmn to branch32(reg, imm) on ARM
-        https://bugs.webkit.org/show_bug.cgi?id=48062
-
-        The conditional comparison can be done with cmn if the imm value is
-        negative and can fit into the cmn instruction.
-
-        * assembler/MacroAssemblerARM.h:
-        (JSC::MacroAssemblerARM::branch32):
-
-2010-10-26  Oliver Hunt  <oliver@apple.com>
-
-        Interpreter build fix.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-
-2010-10-25  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Remove exec and globalData arguments from jsNumber
-        https://bugs.webkit.org/show_bug.cgi?id=48270
-
-        Remove the now unused exec and globalData arguments from jsNumber
-        and mechanically update all users of jsNumber.
-
-        * API/JSValueRef.cpp:
-        (JSValueMakeNumber):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitLoad):
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::ArrayNode::emitBytecode):
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::emit_op_mod):
-        * jit/JITArithmetic32_64.cpp:
-        (JSC::JIT::emit_op_mod):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_jfalse):
-        (JSC::JIT::emit_op_jtrue):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jsc.cpp:
-        (functionRun):
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::getOwnPropertyDescriptor):
-        * runtime/ArrayConstructor.cpp:
-        (JSC::ArrayConstructor::ArrayConstructor):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncPop):
-        (JSC::arrayProtoFuncPush):
-        (JSC::arrayProtoFuncShift):
-        (JSC::arrayProtoFuncSplice):
-        (JSC::arrayProtoFuncUnShift):
-        (JSC::arrayProtoFuncFilter):
-        (JSC::arrayProtoFuncMap):
-        (JSC::arrayProtoFuncEvery):
-        (JSC::arrayProtoFuncForEach):
-        (JSC::arrayProtoFuncSome):
-        (JSC::arrayProtoFuncReduce):
-        (JSC::arrayProtoFuncReduceRight):
-        (JSC::arrayProtoFuncIndexOf):
-        (JSC::arrayProtoFuncLastIndexOf):
-        * runtime/BooleanConstructor.cpp:
-        (JSC::BooleanConstructor::BooleanConstructor):
-        * runtime/CachedTranscendentalFunction.h:
-        (JSC::CachedTranscendentalFunction::operator()):
-        * runtime/DateConstructor.cpp:
-        (JSC::DateConstructor::DateConstructor):
-        (JSC::dateParse):
-        (JSC::dateNow):
-        (JSC::dateUTC):
-        * runtime/DateInstance.cpp:
-        (JSC::DateInstance::DateInstance):
-        * runtime/DatePrototype.cpp:
-        (JSC::dateProtoFuncGetFullYear):
-        (JSC::dateProtoFuncGetUTCFullYear):
-        (JSC::dateProtoFuncGetMonth):
-        (JSC::dateProtoFuncGetUTCMonth):
-        (JSC::dateProtoFuncGetDate):
-        (JSC::dateProtoFuncGetUTCDate):
-        (JSC::dateProtoFuncGetDay):
-        (JSC::dateProtoFuncGetUTCDay):
-        (JSC::dateProtoFuncGetHours):
-        (JSC::dateProtoFuncGetUTCHours):
-        (JSC::dateProtoFuncGetMinutes):
-        (JSC::dateProtoFuncGetUTCMinutes):
-        (JSC::dateProtoFuncGetSeconds):
-        (JSC::dateProtoFuncGetUTCSeconds):
-        (JSC::dateProtoFuncGetMilliSeconds):
-        (JSC::dateProtoFuncGetUTCMilliseconds):
-        (JSC::dateProtoFuncGetTimezoneOffset):
-        (JSC::dateProtoFuncSetTime):
-        (JSC::setNewValueFromTimeArgs):
-        (JSC::setNewValueFromDateArgs):
-        (JSC::dateProtoFuncSetYear):
-        (JSC::dateProtoFuncGetYear):
-        * runtime/Error.cpp:
-        (JSC::addErrorSourceInfo):
-        (JSC::addErrorDivotInfo):
-        * runtime/ErrorConstructor.cpp:
-        (JSC::ErrorConstructor::ErrorConstructor):
-        * runtime/FunctionConstructor.cpp:
-        (JSC::FunctionConstructor::FunctionConstructor):
-        * runtime/FunctionPrototype.cpp:
-        (JSC::FunctionPrototype::FunctionPrototype):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        * runtime/JSByteArray.cpp:
-        (JSC::JSByteArray::JSByteArray):
-        * runtime/JSByteArray.h:
-        (JSC::JSByteArray::getIndex):
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
-        (JSC::JSFunction::lengthGetter):
-        (JSC::JSFunction::getOwnPropertyDescriptor):
         * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncParseInt):
-        (JSC::globalFuncParseFloat):
-        * runtime/JSNumberCell.h:
-        (JSC::JSValue::JSValue):
-        (JSC::jsNaN):
-        (JSC::JSValue::toJSNumber):
-        * runtime/JSONObject.cpp:
-        (JSC::unwrapBoxedPrimitive):
-        (JSC::PropertyNameForFunctionCall::value):
-        (JSC::JSONStringify):
-        * runtime/JSString.cpp:
-        (JSC::JSString::getStringPropertyDescriptor):
-        * runtime/JSString.h:
-        (JSC::JSString::getStringPropertySlot):
-        * runtime/JSValue.h:
-        (JSC::jsDoubleNumber):
-        (JSC::jsNumber):
-        (JSC::jsNaN):
-        (JSC::JSValue::JSValue):
-        (JSC::JSValue::toJSNumber):
-        * runtime/LiteralParser.cpp:
-        (JSC::LiteralParser::parse):
-        * runtime/MathObject.cpp:
-        (JSC::MathObject::MathObject):
-        (JSC::mathProtoFuncAbs):
-        (JSC::mathProtoFuncACos):
-        (JSC::mathProtoFuncASin):
-        (JSC::mathProtoFuncATan):
-        (JSC::mathProtoFuncATan2):
-        (JSC::mathProtoFuncCeil):
-        (JSC::mathProtoFuncCos):
-        (JSC::mathProtoFuncExp):
-        (JSC::mathProtoFuncFloor):
-        (JSC::mathProtoFuncLog):
-        (JSC::mathProtoFuncMax):
-        (JSC::mathProtoFuncMin):
-        (JSC::mathProtoFuncPow):
-        (JSC::mathProtoFuncRandom):
-        (JSC::mathProtoFuncRound):
-        (JSC::mathProtoFuncSin):
-        (JSC::mathProtoFuncSqrt):
-        (JSC::mathProtoFuncTan):
-        * runtime/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::NativeErrorConstructor):
-        * runtime/NumberConstructor.cpp:
-        (JSC::NumberConstructor::NumberConstructor):
-        (JSC::numberConstructorNaNValue):
-        (JSC::numberConstructorNegInfinity):
-        (JSC::numberConstructorPosInfinity):
-        (JSC::numberConstructorMaxValue):
-        (JSC::numberConstructorMinValue):
-        (JSC::constructWithNumberConstructor):
-        (JSC::callNumberConstructor):
-        * runtime/NumberPrototype.cpp:
-        (JSC::NumberPrototype::NumberPrototype):
-        * runtime/ObjectConstructor.cpp:
-        (JSC::ObjectConstructor::ObjectConstructor):
-        * runtime/Operations.cpp:
-        (JSC::jsAddSlowCase):
-        * runtime/Operations.h:
-        (JSC::jsAdd):
-        * runtime/PrototypeFunction.cpp:
-        (JSC::PrototypeFunction::PrototypeFunction):
-        * runtime/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor):
-        (JSC::RegExpMatchesArray::fillArrayInstance):
-        * runtime/RegExpObject.cpp:
-        (JSC::regExpObjectLastIndex):
-        * runtime/StringConstructor.cpp:
-        (JSC::StringConstructor::StringConstructor):
-        * runtime/StringPrototype.cpp:
-        (JSC::StringPrototype::StringPrototype):
-        (JSC::stringProtoFuncReplace):
-        (JSC::stringProtoFuncCharCodeAt):
-        (JSC::stringProtoFuncIndexOf):
-        (JSC::stringProtoFuncLastIndexOf):
-        (JSC::stringProtoFuncSearch):
-        (JSC::stringProtoFuncLocaleCompare):
-
-2010-10-25  David Tapuska  <dtapuska@rim.com>
-
-        Reviewed by David Kilzer.
-
-        Enable VFP if our compiler settings indicated we had a hardware
-        VFP.
+        (JSC::JSGlobalObject::markChildren): Removed a dubious comment that
+        suggested we do not need to visit all our references during GC, since
+        that is not true in a moving GC.
 
-        https://bugs.webkit.org/show_bug.cgi?id=46096
+        Re-sorted data members by type, removed one duplicate, and added back
+        the one missing mark I found.
 
-        * assembler/MacroAssemblerARM.cpp:
-        (JSC::isVFPPresent):
+        * runtime/JSGlobalObject.h: Re-sorted data members by type.
 
-2010-10-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+2011-03-15  Oliver Hunt  <oliver@apple.com>
 
-        Unreviewed, rolling out r70451.
-        http://trac.webkit.org/changeset/70451
-        https://bugs.webkit.org/show_bug.cgi?id=48249
-
-        Broke set-unloaded-frame-location.html under Qt (Requested by
-        caseq on #webkit).
-
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/text/TextPosition.h: Removed.
-
-2010-10-25  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by David Kilzer.
-
-        Replace _countof with WTF_ARRAY_LENGTH
-        https://bugs.webkit.org/show_bug.cgi?id=48229
-
-        * wtf/Platform.h:
-
-2010-10-25  Peter Rybin  <peter.rybin@gmail.com>
+        Reviewed by Geoffrey Garen.
 
-        Reviewed by Adam Barth.
+        Introduce Local<T> to allow us to start moving to precise marking of locals
+        https://bugs.webkit.org/show_bug.cgi?id=56394
 
-        HTML parser should provide script column position within HTML document to JavaScript engine
-        https://bugs.webkit.org/show_bug.cgi?id=45271
+        Introduce a new handle type, Local<T> and a scoping mechanism
+        LocalScope to allow us to start moving towards precise marking
+        of temporaries and local variables.
 
-        Adds TextPosition* classes -- a structure that stores line/column/generation
-        level coordinates inside text document. Adds *BasedNumber classes -- typesafe int
-        wrappers that emphasize whether int number is used as zero-based or
-        one-based.
+        We also start to use the new Local<> type in the JSON stringifier
+        so that we can have some coverage of their behaviour in the initial
+        checkin.
 
         * GNUmakefile.am:
         * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
         * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/text/TextPosition.h: Added.
-        (WTF::TextPosition::TextPosition):
-        (WTF::TextPosition::minimumPosition):
-        (WTF::TextPosition::belowRangePosition):
-        (WTF::ZeroBasedNumber::fromZeroBasedInt):
-        (WTF::ZeroBasedNumber::ZeroBasedNumber):
-        (WTF::ZeroBasedNumber::zeroBasedInt):
-        (WTF::ZeroBasedNumber::base):
-        (WTF::ZeroBasedNumber::belowBase):
-        (WTF::OneBasedNumber::fromOneBasedInt):
-        (WTF::OneBasedNumber::OneBasedNumber):
-        (WTF::OneBasedNumber::oneBasedInt):
-        (WTF::OneBasedNumber::convertAsZeroBasedInt):
-        (WTF::OneBasedNumber::convertToZeroBased):
-        (WTF::OneBasedNumber::base):
-        (WTF::OneBasedNumber::belowBase):
-        (WTF::toZeroBasedTextPosition):
-        (WTF::toOneBasedTextPosition):
-        (WTF::ZeroBasedNumber::convertToOneBased):
-
-2010-10-24  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by David Kilzer.
-
-        Check endianness with __BIG_ENDIAN in RVCT.
-        https://bugs.webkit.org/show_bug.cgi?id=46122
-
-        RVCT defines __BIG_ENDIAN if compiling for a big-endian target.
-
-        * wtf/Platform.h:
-
-2010-10-24  Dan Bernstein  <mitz@apple.com>
-
-        Rubber-stamped by Dave Kilzer.
-
-        Removed empty directories.
-
-        * JavaScriptCore: Removed.
-        * JavaScriptCore/runtime: Removed.
-
-2010-10-24  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed, fix typo of last build fix.
-
-        * wtf/DateMath.cpp:
-
-2010-10-24  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed build fix for chromium.
-
-        * wtf/DateMath.cpp: Added missing include.
-
-2010-10-24  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by David Kilzer.
-
-        Add WTF_ARRAY_LENGTH macro to WTF
-        https://bugs.webkit.org/show_bug.cgi?id=32828
-
-        Unify the different implementations and usages.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        * runtime/DatePrototype.cpp:
-        (JSC::formatLocaleDate):
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
+        * collector/handles/Handle.h:
+        (JSC::::asObject):
+        * collector/handles/HandleStack.cpp: Added.
+        (JSC::HandleStack::HandleStack):
+        (JSC::HandleStack::mark):
+        (JSC::HandleStack::grow):
+        * collector/handles/HandleStack.h: Added.
+        (JSC::HandleStack::enterScope):
+        (JSC::HandleStack::zapTo):
+        (JSC::HandleStack::leaveScope):
+        (JSC::HandleStack::push):
+        * collector/handles/Local.h: Added.
+        (JSC::Local::internalSet):
+        (JSC::::Local):
+        (JSC::::operator):
+        (JSC::LocalStack::LocalStack):
+        (JSC::LocalStack::peek):
+        (JSC::LocalStack::pop):
+        (JSC::LocalStack::push):
+        (JSC::LocalStack::isEmpty):
+        (JSC::LocalStack::size):
+        * collector/handles/LocalScope.h: Added.
+        (JSC::LocalScope::LocalScope):
+        (JSC::LocalScope::~LocalScope):
+        (JSC::LocalScope::release):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        (JSC::Heap::allocateLocalHandle):
+        (JSC::Heap::handleStack):
+        * runtime/JSCell.h:
+        (JSC::JSCell::::getString):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::allocateLocalHandle):
         * runtime/JSONObject.cpp:
-        (JSC::Stringifier::appendQuotedString):
-        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::stringify):
         (JSC::Stringifier::appendStringifiedValue):
-        * runtime/UString.cpp:
-        (JSC::UString::number):
-        * wtf/DateMath.cpp:
-        (WTF::parseDateFromNullTerminatedCharacters):
-        * wtf/StdLibExtras.h:
-
-2010-10-24  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        Filter example Chiseled from SVG Wow! is slow
-        https://bugs.webkit.org/show_bug.cgi?id=48174
-
-        Added 'using WTF::ByteArray;' at the end of ByteArray.h
-
-        * wtf/ByteArray.h:
+        (JSC::Stringifier::Holder::Holder):
+        (JSC::Walker::Walker):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        (JSC::JSONStringify):
+        * runtime/JSONObject.h:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::appendValues):
+        (JSC::MarkStack::appendSlots):
 
-2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+2011-03-15  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by David Kilzer.
+        Rubber Stamped by Sam Weinig.
 
-        Inline WTF::bitwise_cast and fix style
-        https://bugs.webkit.org/show_bug.cgi?id=48208
+        Bug 56420 - Remove ENABLE(JIT) code from ByteCompiler
+        Some methods have unnecessary differences in name/arguments for interpreter/JIT.
 
-        * wtf/StdLibExtras.h:
-        (WTF::bitwise_cast):
-        (WTF::bitCount):
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        (JSC::HandlerInfo::HandlerInfo):
+        (JSC::CodeBlock::addPropertyAccessInfo):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        (JSC::CodeBlock::addCallLinkInfo):
+        (JSC::CodeBlock::globalResolveInfo):
+        * bytecode/Opcode.h:
+        * bytecode/StructureStubInfo.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitCatch):
 
-2010-10-23  Xan Lopez  <xlopez@igalia.com>
+2011-03-15  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Unify globalData APIs
-        https://bugs.webkit.org/show_bug.cgi?id=47969
+        Fix broken assert in new code.
 
-        Make JSGlobalObject::globalData return a reference and adapt
-        callers. This unifies the API with the existing
-        CallFrame::globalData, which also returns a reference.
+        * dfg/DFGAliasTracker.h:
+        (JSC::DFG::AliasTracker::recordPutByVal):
+            - recordPutByVal is called for both PutByVal & PutByValAlias.
 
-        * debugger/Debugger.cpp:
-        (JSC::evaluateInGlobalCallFrame):
-        * interpreter/CallFrame.h:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::dumpRegisters):
-        * jsc.cpp:
-        (runWithScripts):
-        * parser/JSParser.cpp:
-        (JSC::jsParse):
-        * parser/Parser.cpp:
-        (JSC::Parser::parse):
-        * parser/Parser.h:
-        (JSC::Parser::parse):
-        * runtime/Error.cpp:
-        (JSC::createError):
-        (JSC::createEvalError):
-        (JSC::createRangeError):
-        (JSC::createReferenceError):
-        (JSC::createSyntaxError):
-        (JSC::createTypeError):
-        (JSC::createURIError):
-        * runtime/FunctionConstructor.cpp:
-        (JSC::constructFunction):
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::~JSGlobalObject):
-        (JSC::JSGlobalObject::markChildren):
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::globalData):
-
-2010-10-23  Dimitri Glazkov  <dglazkov@chromium.org>
+2011-03-15  Gavin Barraclough  <barraclough@apple.com>
 
-        Unreviewed, rolling out r70369.
-        http://trac.webkit.org/changeset/70369
-        https://bugs.webkit.org/show_bug.cgi?id=47974
+        Rubber stamped by Sam Weinig.
 
-        Caused weird artifacts in expected results.
+        Removed redundant code from BytecodeGenerator.
 
-        * wtf/Platform.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+            - delete uncalled code missed when reparsing was removed.
 
-2010-10-23  Martin Robinson  <mrobinson@igalia.com>
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
 
-        Reviewed by Xan Lopez.
+        Reviewed by Darin Adler.
 
-        Crashes randomly in cairo_scaled_font_destroy
-        https://bugs.webkit.org/show_bug.cgi?id=46794
+        Introduce WTF_USE_EXPORT_MACROS, which will allow us to put shared library import/export
+        info into the headers rather than in export symbol definition files, but disable it on 
+        all platforms initially so we can deal with port build issues one port at a time.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
 
-        Make PlatformRefPtr aware of hashTableDeletedValue. When PlatformRefPtr
-        goes away this should probably be handled in the future via some special
-        hooks in RefCounted (or its contained type).
+        * API/JSBase.h:
+        * config.h:
+        * wtf/Assertions.h:
+        * wtf/ExportMacros.h: Added.
+        * wtf/Platform.h:
 
-        * wtf/PlatformRefPtr.h:
-        (WTF::PlatformRefPtr::~PlatformRefPtr):
-        (WTF::PlatformRefPtr::clear):
-        (WTF::::operator):
+2011-03-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-2010-10-22  Adam Roben  <aroben@apple.com>
+        Unreviewed build fix.
 
-        Remove the QuartzCorePresent.h mechanism
+        Buildfix when JIT is not enabled after r81079
+        https://bugs.webkit.org/show_bug.cgi?id=56361
 
-        This header was used to detect whether QuartzCore headers were present
-        on the system. Everyone should have these headers now so we no longer
-        need to detect.
+        * runtime/Executable.cpp:
 
-        Reviewed by Sam Weinig.
+2011-03-14  Geoffrey Garen  <ggaren@apple.com>
 
-        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Remove
-        code to generate QuartzCorePresent.h.
+        Reviewed by Oliver Hunt.
 
-        * wtf/Platform.h: Stop including QuartzCorePresent.h on Windows and
-        collapse all USE_ACCELERATED_COMPOSITING settings into one #ifdef.
+        Made the global object moving-GC-safe
+        https://bugs.webkit.org/show_bug.cgi?id=56348
+        
+        SunSpider reports no change.
 
-2010-10-22  Adam Barth  <abarth@webkit.org>
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren): Removed a dubious comment that
+        suggested we do not need to visit all our references during GC, since
+        that is not true in a moving GC.
 
-        Unreviewed, rolling out r70290.
-        http://trac.webkit.org/changeset/70290
-        https://bugs.webkit.org/show_bug.cgi?id=48111
+        Re-sorted data members by type, removed one duplicate, and added back
+        the one missing mark I found.
 
-        Undelete Android build files.
+        * runtime/JSGlobalObject.h: Re-sorted data members by type.
 
-        * Android.mk: Added.
+2011-03-14  Geoffrey Garen  <ggaren@apple.com>
 
-2010-10-22  Zoltan Herczeg  <zherczeg@webkit.org>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Csaba Osztrogonác.
+        Made JSWrapperObject and subclasses moving-GC-safe
+        https://bugs.webkit.org/show_bug.cgi?id=56346
+        
+        SunSpider reports no change.
 
-        JSC interpreter regressions after r69940
-        https://bugs.webkit.org/show_bug.cgi?id=47839
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance): No more need for JSGlobalData, since
+        we don't initialize the wrapped value in our constructor.
 
-        Wrong "if": It should test whether the result exists,
-        and not the opposite. It is an interpreter bug, hence
-        the bots does not capture it.
+        * runtime/DateInstance.h: Don't set the OverridesMarkChildren flag because
+        we do not in fact override markChildren.
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::resolveBase):
+        * runtime/DatePrototype.h: Declare an anonymous slot, since wrapper object
+        no longer does so for us. Also added an ASSERT to catch a latent bug,
+        where DatePrototype stomped on its base class's anonymous slot. Hard-coded
+        anonymous slots are a plague on our code. This doesn't cause any problems
+        in our existing code since the base class never reads the anonymous slot
+        it declares, but it caused crashes when I tried to start using the slot
+        in an initial version of this patch.
 
-2010-10-21  Adam Barth  <abarth@webkit.org>
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue): Resolved a problem where
+        our internal value was stored in two places: an anonymous slot, and a
+        data member which was not always visited during GC. Now, we only use the
+        data member, and we always visit it. (Instead of relying on certain
+        subclasses to set the OverridesMarkChildren bit, we set it ourselves.)
 
-        Reviewed by David Levin.
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject): No more need for JSGlobalData, since
+        we don't initialize the wrapped value in our constructor.
 
-        Remove Android build system
-        https://bugs.webkit.org/show_bug.cgi?id=48111
+        * runtime/NumberObject.h: Removed meaningless declaration.
 
-        * Android.mk: Removed.
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject): No more need for JSGlobalData, since
+        we don't initialize the wrapped value in our constructor.
 
-2010-10-21  Kwang Yul Seo  <skyul@company100.net>
+        * runtime/StringObject.h: Don't set the OverridesMarkChildren flag because
+        we do not in fact override markChildren.
 
-        Reviewed by Kent Tamura.
+        * runtime/StringPrototype.h: Declare an anonymous slot, since wrapper object
+        no longer does so for us. Also added an ASSERT to catch a latent bug,
+        where DatePrototype stomped on its base class's anonymous slot. Hard-coded
+        anonymous slots are a plague on our code.
 
-        [BREWMP] Add a String constructor which takes AECHAR*
-        https://bugs.webkit.org/show_bug.cgi?id=45043
+2011-03-14  Michael Saboff  <msaboff@apple.com>
 
-        Add String(const AECHAR*) constructor for convenience.
+        Reviewed by Gavin Barraclough.
 
-        * wtf/text/WTFString.h:
+        Look-ahead assertions with back references don’t work as expected
+        https://bugs.webkit.org/show_bug.cgi?id=56082
 
-2010-10-21  Carlos Garcia Campos  <cgarcia@igalia.com>
+        Changed parentheses assertion processing to temporarily back out the 
+        number of known characters after the assertion while processing the 
+        assertion.  This was done so that assertions don't fail due to 
+        checking the number of required characters as additional to the 
+        rest of the express since assertions don't "consume" input.
+        Added a byte code to uncheck characters to support the change.
 
-        Reviewed by Martin Robinson.
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::ByteCompiler::uncheckInput):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::ByteTerm::UncheckInput):
 
-        [GTK] Use GCharsetConverter instead of g_iconv in TextCodecGtk
-        https://bugs.webkit.org/show_bug.cgi?id=47896
+2011-03-14  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
 
-        * wtf/gobject/GTypedefs.h:
+        Reviewed by Laszlo Gombos.
 
-2010-10-21  Adam Barth  <abarth@webkit.org>
+        [Qt] Warning that round/roundf functions are already defined when compiled with RVCT 4 on symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=56133
 
-        Unreviewed, rolling out r70174.
-        http://trac.webkit.org/changeset/70174
-        https://bugs.webkit.org/show_bug.cgi?id=41948
+        Add condition to not compile webkit internal math round functions on RVCT compiler versions 
+        from 3.0.0 because they are already defined in compiler math library.
 
-        This patch reverts a change that causes
-        http/tests/xmlhttprequest/origin-whitelisting-removal.html to crash.
+        * wtf/MathExtras.h:
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::throwException):
+2011-03-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen & Oliver Hunt.
+
+        Bug 56284 - Add a dataflow intermediate representation for use in JIT generation.
+
+        The JSC JIT presently generates code directly from the bytecode used by the interpreter.
+        This is not an optimal intermediate representation for JIT code generation, since it does
+        not capture liveness information of values, and provides little opportunity to perform
+        any static analysis for even primitive types. The JIT currently generates two code paths,
+        a fast path handling common cases, and a slower path handling less common operand types.
+        However the slow path jumps back into the fast path, meaning that information arising
+        from the earlier type checks cannot be propagated to later operations.
+
+        This patch adds:
+            * a dataflow intermediate representation capable of describing a single basic block
+              of operations,
+            * a mechanism to convert a simple, single-block bytecode functions to the new IR,
+            * and a JIT code generator capable of generating code from this representation.
+
+        The JIT generates two code paths, with the slower path not reentering the fast path
+        mid-block, allowing speculative optimizations to be made on the hot path, with type
+        information arising from these speculative decisions able to be propagated through the
+        dataflow. Code generation of both speculative and non-speculative paths exploits the type
+        and liveness information represented in the dataflow graph to attempt to avoid redundant
+        boxing and type-checking of values, and to remove unnecessary spills of temporary values
+        to the RegisterFile.
+
+        The dataflow JIT currently can only support a subset of bytecode operations, limited to
+        arithmetic, bit-ops, and basic property access. Functions that cannot be compiled by the
+        dataflow JIT will be run using the existing JIT. The coverage of the dataflow JIT will be
+        expanded to include, control-flow, function calls, and then the long-tail of remaining
+        bytecode instructions. The JIT presently only support JSVALUE64, and as a consequence of
+        this only supports x86-64.
+
+        The status of the dataflow JIT is currently work-in-progress. Limitations of the present
+        JIT code generation may cause performance regressions, particularly:
+            * the policy to only generate arithmetic code on the speculative path using integer
+              instructions, never using floating point.
+            * the policy to only generate arithmetic code on the non-speculative path using
+              floating point instructions, never using integer.
+            * always generating JSValue adds on the non-speculative path as a call out to a
+              C-function, never handling this in JIT code.
+            * always assuming by-Value property accesses on the speculative path to be array
+              accesses.
+            * generating all by-Value property accesses from the non-speculative path as a call
+              out to a C-function.
+            * generating all by-Indentifer property accesses as a call out to a C-function.
+        Due to these regressions, the code is landed in a state where it is disabled in most
+        cases by the ENABLE_DFG_JIT_RESTRICTIONS guard in Platform.h. As these regressions are
+        addressed, the JIT will be allowed to trigger in more cases.
 
-2010-10-20  Simon Fraser  <simon.fraser@apple.com>
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Added new files to Xcode project.
+        * dfg: Added.
+            - Added directory for new code.
+        * dfg/DFGByteCodeParser.cpp: Added.
+        * dfg/DFGByteCodeParser.h: Added.
+            - Contruct a DFG::Graph representation from a bytecode CodeBlock.
+        * dfg/DFGGenerationInfo.h: Added.
+            - Track type & register information for VirtualRegisters during JIT code generation.
+        * dfg/DFGGraph.cpp: Added.
+        * dfg/DFGGraph.h: Added.
+            - Dataflow graph intermediate representation for code generation.
+        * dfg/DFGJITCodeGenerator.cpp: Added.
+        * dfg/DFGJITCodeGenerator.h: Added.
+            - Base class for SpeculativeJIT & NonSpeculativeJIT to share common functionality.
+        * dfg/DFGJITCompiler.cpp: Added.
+        * dfg/DFGJITCompiler.h: Added.
+            - Class responsible for driving code generation of speculativeJIT & non-speculative
+              code paths from the dataflow graph.
+        * dfg/DFGNonSpeculativeJIT.cpp: Added.
+        * dfg/DFGNonSpeculativeJIT.h: Added.
+            - Used to generate the non-speculative code path, this make no assumptions
+              about operand types.
+        * dfg/DFGOperations.cpp: Added.
+        * dfg/DFGOperations.h: Added.
+            - Helper functions called from the JIT generated code.
+        * dfg/DFGRegisterBank.h: Added.
+            - Used to track contents of physical registers during JIT code generation.
+        * dfg/DFGSpeculativeJIT.cpp: Added.
+        * dfg/DFGSpeculativeJIT.h: Added.
+            - Used to generate the speculative code path, this make assumptions about
+              operand types to enable optimization.
+        * runtime/Executable.cpp:
+            - Add code to attempt to use the DFG JIT to compile a function, with fallback
+              to the existing JIT.
+        * wtf/Platform.h:
+            - Added compile guards to enable the DFG JIT.
 
-        Fix the EFL build.
+2011-03-14  Geoffrey Garen  <ggaren@apple.com>
 
-        * wtf/CMakeLists.txt:
+        Reviewed by Oliver Hunt.
 
-2010-10-20  Simon Fraser  <simon.fraser@apple.com>
+        Removed more cases of DeprecatedPtr (exception, SmallStrings)
+        https://bugs.webkit.org/show_bug.cgi?id=56332
 
-        Fix Windows build: export needed symbols.
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::addSlowCase): Use a variable instead of a hard-coded
+        constant, to make this code less brittle.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSGlobalData.h: Use HeapRoot instead of DeprecatedPtr because
+        this reference is owned and managed directly by the heap.
 
-2010-10-19  Simon Fraser  <simon.fraser@apple.com>
+        * runtime/JSString.cpp:
+        (JSC::JSString::substringFromRope):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsString):
+        (JSC::jsStringWithFinalizer):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString): Use a variable instead of a hard-coded
+        constant, to make this code less brittle.
 
-        Reviewed by Gavin Barraclough.
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::rep):
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::markChildren):
+        (JSC::SmallStrings::clear):
+        (JSC::SmallStrings::count): Use a variable instead of a hard-coded
+        constant, to make this code less brittle.
 
-        https://bugs.webkit.org/show_bug.cgi?id=47851
-        
-        Add methods to DecimalNumber to return the buffer length
-        required for decimal and exponential output.
-        
-        Make some of the DecimalNumber code non-inline (no
-        effect on Sunspider), adding DecimalNumber.cpp to various
-        build systems.
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::singleCharacterString): Use HeapRoot instead of
+        DeprecatedPtr because these references are owned and managed directly by
+        the heap.
         
-        Make some DecimalNumber methods 'const'.
-
-        * Android.mk:
-        * Android.v8.wtf.mk:
-        * GNUmakefile.am:
-        * JavaScriptCore.exp:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/NumberPrototype.cpp:
-        (JSC::numberProtoFuncToExponential):
-        (JSC::numberProtoFuncToFixed):
-        (JSC::numberProtoFuncToPrecision):
-        * wtf/DecimalNumber.cpp: Added.
-        (WTF::DecimalNumber::bufferLengthForStringDecimal):
-        (WTF::DecimalNumber::bufferLengthForStringExponential):
-        (WTF::DecimalNumber::toStringDecimal):
-        (WTF::DecimalNumber::toStringExponential):
-        * wtf/DecimalNumber.h:
-        (WTF::DecimalNumber::sign):
-        (WTF::DecimalNumber::exponent):
-        (WTF::DecimalNumber::significand):
-        (WTF::DecimalNumber::precision):
-        * wtf/dtoa.cpp:
-        (WTF::dtoa):
-        * wtf/dtoa.h:
-        * wtf/wtf.pri:
-
-2010-10-20  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r70165.
-        http://trac.webkit.org/changeset/70165
-        https://bugs.webkit.org/show_bug.cgi?id=48007
-
-        It broke tests on Qt bot (Requested by Ossy on #webkit).
-
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/text/TextPosition.h: Removed.
-
-2010-10-20  Brian Weinstein  <bweinstein@apple.com>
+        Stop using FixedArray because we only want a very limited set
+        of classes to be able to use HeapRoot. (Replaced with manual ASSERTs.)
 
-        Reviewed by Adam Roben.
-
-        Fix the Windows build after r70165. Move the copying of JavaScript headers from JavaScriptCore's post-build
-        step to JavaScriptCoreGenerated, so the copying is done even when a cpp file in JavaScriptCore is changed.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * runtime/WriteBarrier.h:
+        (JSC::operator==):
+        (JSC::WriteBarrier::WriteBarrier):
+        (JSC::HeapRoot::HeapRoot):
+        (JSC::HeapRoot::operator=): Added HeapRoot, which is allowed to set
+        without write barrier because we assume all HeapRoots are scanned during
+        all GC passes.
 
-2010-10-20  Dumitru Daniliuc  <dumi@chromium.org>
+2011-03-14  Brian Weinstein  <bweinstein@apple.com>
 
-        Unreviewed, fixing the Win build.
+        Reviewed by Adam Roben and Gavin Barraclough.
 
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        FileSystemWin.cpp needs listDirectory() implementation
+        https://bugs.webkit.org/show_bug.cgi?id=56331
+        <rdar://problem/9126635>
+        
+        Give StringConcatenate the ability to deal with const UChar*'s as a String type to append.
 
-2010-10-20  Geoffrey Garen  <ggaren@apple.com>
+        * wtf/text/StringConcatenate.h:
 
-        Reviewed by Darin Adler.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=41948
-        REGRESSION(r60392): Registerfile can be unwound too far following an exception
+2011-03-14  Mark Rowe  <mrowe@apple.com>
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::throwException): Walk the stack to calculate the high
-        water mark currently in use. It's not safe to assume that the current
-        CallFrame's high water mark is the highest high water mark because
-        calls do not always set up at the end of a CallFrame. A large caller
-        CallFrame can encompass a small callee CallFrame.
+        Reviewed by Oliver Hunt.
 
-2010-10-20  Peter Rybin  <peter.rybin@gmail.com>
+        <http://webkit.org/b/56304> REGRESSION(r80892): 100,000+ leaks seen on the build bot
 
-        Reviewed by Adam Barth.
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass): Don't leak any existing entry for the given name if
+        the class definition contains duplicates. This also removes what look to be leaks
+        of the StringImpl instances that are used as keys: the HashMap key type is a RefPtr
+        which retains / releases the instances at the appropriate time, so explicitly calling
+        ref is not necessary.
 
-        HTML parser should provide script column position within HTML document to JavaScript engine
-        https://bugs.webkit.org/show_bug.cgi?id=45271
+2011-03-14  Oliver Hunt  <oliver@apple.com>
 
-        Adds TextPosition* classes -- a structure that stores line/column/generation
-        level coordinates inside text document. Adds *BasedNumber classes -- typesafe int
-        wrappers that emphasize whether int number is used as zero-based or
-        one-based.
+        Fix windows build
 
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/text/TextPosition.h: Added.
-        (WTF::TextPosition::TextPosition):
-        (WTF::TextPosition::minimumPosition):
-        (WTF::TextPosition::belowRangePosition):
-        (WTF::ZeroBasedNumber::fromZeroBasedInt):
-        (WTF::ZeroBasedNumber::ZeroBasedNumber):
-        (WTF::ZeroBasedNumber::zeroBasedInt):
-        (WTF::ZeroBasedNumber::base):
-        (WTF::ZeroBasedNumber::belowBase):
-        (WTF::OneBasedNumber::fromOneBasedInt):
-        (WTF::OneBasedNumber::OneBasedNumber):
-        (WTF::OneBasedNumber::oneBasedInt):
-        (WTF::OneBasedNumber::convertAsZeroBasedInt):
-        (WTF::OneBasedNumber::convertToZeroBased):
-        (WTF::OneBasedNumber::base):
-        (WTF::OneBasedNumber::belowBase):
-        (WTF::toZeroBasedTextPosition):
-        (WTF::toOneBasedTextPosition):
-        (WTF::ZeroBasedNumber::convertToOneBased):
-
-2010-10-19  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by David Kilzer.
-
-        [BREWMP] Turn off JIT for simulator build
-        https://bugs.webkit.org/show_bug.cgi?id=47937
-
-        We don't need to test x86 JIT.
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitLoadInt32):
+        (JSC::JSInterfaceJIT::tagFor):
+        (JSC::JSInterfaceJIT::payloadFor):
+        (JSC::JSInterfaceJIT::intPayloadFor):
+        (JSC::JSInterfaceJIT::intTagFor):
+        (JSC::JSInterfaceJIT::addressFor):
 
-        * wtf/Platform.h:
+2011-03-11  Oliver Hunt  <oliver@apple.com>
 
-2010-10-19  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Gavin Barraclough.
 
-        Reviewed by Geoffrey Garen.
+        Ensure all values are correctly tagged in the registerfile
+        https://bugs.webkit.org/show_bug.cgi?id=56214
 
-        Remove support for JSVALUE32 from JSC
-        https://bugs.webkit.org/show_bug.cgi?id=47948
+        This patch makes sure that all JSCell pointers written to
+        the registerfile are correctly tagged as JSCells, and replaces
+        raw int usage with the immediate representation.
 
-        Remove all the code for supporting JSVALUE32 from JSC.
+        For performance, register pressure, and general saneness reasons
+        I've added abstractions for reading and writing the tag
+        and payload of integer registers directly for the JSVALUE64
+        encoding.
 
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::withCallee):
+        (JSC::Register::operator=):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
         * jit/JIT.h:
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::emit_op_lshift):
-        (JSC::JIT::emitSlow_op_lshift):
-        (JSC::JIT::emit_op_rshift):
-        (JSC::JIT::emitSlow_op_rshift):
-        (JSC::JIT::emit_op_urshift):
-        (JSC::JIT::emitSlow_op_urshift):
-        (JSC::JIT::emit_op_jnless):
-        (JSC::JIT::emitSlow_op_jnless):
-        (JSC::JIT::emit_op_jless):
-        (JSC::JIT::emitSlow_op_jless):
-        (JSC::JIT::emit_op_jlesseq):
-        (JSC::JIT::emitSlow_op_jlesseq):
-        (JSC::JIT::emit_op_bitand):
-        (JSC::JIT::emit_op_post_inc):
-        (JSC::JIT::emit_op_post_dec):
-        (JSC::JIT::emit_op_pre_inc):
-        (JSC::JIT::emit_op_pre_dec):
-        (JSC::JIT::emit_op_mod):
-        (JSC::JIT::emitSlow_op_mod):
         * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
         * jit/JITInlineMethods.h:
-        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
-        (JSC::JIT::emitGetFromCallFrameHeader32):
+        (JSC::JIT::emitPutToCallFrameHeader):
+        (JSC::JIT::emitPutCellToCallFrameHeader):
+        (JSC::JIT::emitPutIntToCallFrameHeader):
         * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_loop_if_lesseq):
-        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emitSlow_op_load_varargs):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
         (JSC::JIT::emit_op_next_pname):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::emit_op_get_by_val):
-        (JSC::JIT::emit_op_put_by_val):
-        * jit/JITStubs.h:
         * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::intPayloadFor):
+        (JSC::JSInterfaceJIT::intTagFor):
         * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnJSValue):
         (JSC::SpecializedThunkJIT::returnDouble):
-        (JSC::SpecializedThunkJIT::tagReturnAsInt32):
-        * jit/ThunkGenerators.cpp:
-        (JSC::sqrtThunkGenerator):
-        (JSC::powThunkGenerator):
-        * runtime/Collector.cpp:
-        (JSC::isPossibleCell):
-        (JSC::typeName):
-        * runtime/JSCell.h:
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * runtime/JSGlobalData.h:
-        * runtime/JSGlobalObject.h:
-        (JSC::Structure::prototypeForLookup):
-        * runtime/JSImmediate.h:
-        (JSC::reinterpretIntptrToDouble):
-        (JSC::JSImmediate::isIntegerNumber):
-        (JSC::JSImmediate::isDouble):
-        (JSC::JSImmediate::areBothImmediateIntegerNumbers):
-        (JSC::JSImmediate::makeDouble):
-        (JSC::JSImmediate::doubleValue):
-        (JSC::JSImmediate::toBoolean):
-        (JSC::JSImmediate::fromNumberOutsideIntegerRange):
-        (JSC::JSImmediate::from):
-        (JSC::JSImmediate::toDouble):
-        (JSC::JSFastMath::rightShiftImmediateNumbers):
-        * runtime/JSNumberCell.cpp:
-        * runtime/JSNumberCell.h:
-        * runtime/JSObject.h:
-        (JSC::JSObject::JSObject):
-        * runtime/JSValue.h:
-        * runtime/NumberObject.h:
-        * wtf/Platform.h:
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::returnJSCell):
 
-2010-10-19  Csaba Osztrogonác  <ossy@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        BytecodeGenerator::m_lastOpcodePosition must be initialized in all constructors
-        https://bugs.webkit.org/show_bug.cgi?id=47920
-
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator): Add missing member initialization.
-
-2010-10-19  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by David Kilzer.
-
-        RVCT fails to compile DateMath.cpp due to overloaded function pow
-        https://bugs.webkit.org/show_bug.cgi?id=47844
-
-        Choose std::pow(double, double) among multiple overloaded pow functions
-        to fix build for RVCT.
-
-        * wtf/DateMath.cpp:
-        (WTF::parseES5DateFromNullTerminatedCharacters):
-
-2010-10-19  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by David Kilzer.
-
-        Use UChar instead of wchar_t in UnicodeWinCE
-        https://bugs.webkit.org/show_bug.cgi?id=47904
-
-        Make UnicodeWinCE more portable, so we can use it for other ports too.
-
-        * wtf/unicode/wince/UnicodeWinCE.cpp:
-        (WTF::Unicode::toLower):
-        (WTF::Unicode::toUpper):
-        (WTF::Unicode::foldCase):
-        (WTF::Unicode::isPrintableChar):
-        (WTF::Unicode::isSpace):
-        (WTF::Unicode::isLetter):
-        (WTF::Unicode::isUpper):
-        (WTF::Unicode::isLower):
-        (WTF::Unicode::isDigit):
-        (WTF::Unicode::isPunct):
-        (WTF::Unicode::isAlphanumeric):
-        (WTF::Unicode::toTitleCase):
-        (WTF::Unicode::mirroredChar):
-        (WTF::Unicode::digitValue):
-        * wtf/unicode/wince/UnicodeWinCE.h:
-        (WTF::Unicode::isSeparatorSpace):
-        (WTF::Unicode::isHighSurrogate):
-        (WTF::Unicode::isLowSurrogate):
-        (WTF::Unicode::umemcasecmp):
-        (WTF::Unicode::surrogateToUcs4):
-
-2010-10-19  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Andreas Kling.
-
-        Fix style of UnicodeWinCE
-        https://bugs.webkit.org/show_bug.cgi?id=47818
-
-        * wtf/unicode/wince/UnicodeWinCE.cpp:
-        (WTF::Unicode::toLower):
-        (WTF::Unicode::toUpper):
-        * wtf/unicode/wince/UnicodeWinCE.h:
-
-2010-10-18  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Martin Robinson.
-
-        * GNUmakefile.am: add missing file.
-
-2010-10-18  Oliver Hunt  <oliver@apple.com>
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Strict mode: Functions created with the function constructor don't implement strict mode semantics
-        https://bugs.webkit.org/show_bug.cgi?id=47860
-
-        When creating the FunctionExecutable for a new function the function constructor
-        was always passing false for whether or not a function was strict, rather than
-        using the information from the freshly parsed function itself.
-
-        * runtime/Executable.cpp:
-        (JSC::FunctionExecutable::fromGlobalCode):
-
-2010-10-18  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Strict mode: |this| should be undefined if it is not explicitly provided
-        https://bugs.webkit.org/show_bug.cgi?id=47833
-
-        To make strict mode behave correctly we want to pass undefined instead of null
-        as the default this value.  This has no impact on behaviour outside of strict
-        mode as both values are replaced with the global object if necessary.
-
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::FunctionCallValueNode::emitBytecode):
-        (JSC::FunctionCallResolveNode::emitBytecode):
-        (JSC::CallFunctionCallDotNode::emitBytecode):
-        (JSC::ApplyFunctionCallDotNode::emitBytecode):
-
-
-2010-10-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Anders Carlsson.
+        A few Heap-related renames (sans file moves, which should come next)
+        https://bugs.webkit.org/show_bug.cgi?id=56283
+        
+        ConservativeSet => ConservativeRoots. "Set" was misleading, since items
+        are not uniqued. Also, "Roots" is more specific about what's in the set.
+        
+        MachineStackMarker => MachineThreads. "Threads" is more descriptive of
+        the fact that this class maintains a set of all threads using JSC.
+        "Stack" was misleading, since this class traverses stacks and registers.
+        "Mark" was misleading, since this class doesn't mark anything anymore.
+        
+        registerThread => addCurrentThread. "Current" is more specific.
+        unregisterThread => removeCurrentThread. "Current" is more specific.
+        
+        "currentThreadRegistrar" => threadSpecific. The only point of this data
+        structure is to register a thread-specific destructor with a pointer to
+        this.
+        
+        "mark...Conservatively" => "gather". "Mark" is not true, since these
+        functions don't mark anything. "Conservatively" is redundant, since they
+        take "ConservativeRoots" as an argument.
 
-        Make a nullptr that works with OwnPtr and RefPtr
-        https://bugs.webkit.org/show_bug.cgi?id=47756
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        * JavaScriptCore.exp:
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeRoots::grow):
+        (JSC::ConservativeRoots::add):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeRoots::ConservativeRoots):
+        (JSC::ConservativeRoots::~ConservativeRoots):
+        (JSC::ConservativeRoots::size):
+        (JSC::ConservativeRoots::roots):
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        (JSC::Heap::machineThreads):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::makeUsableFromMultipleThreads):
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::makeUsableFromMultipleThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::removeThread):
+        (JSC::MachineThreads::removeCurrentThread):
+        (JSC::MachineThreads::gatherFromCurrentThreadInternal):
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::gatherFromOtherThread):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * runtime/MachineStackMarker.h:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append):
 
-        * JavaScriptCore.xcodeproj/project.pbxproj: Added NullPtr.h.
+2011-03-13  David Kilzer  <ddkilzer@apple.com>
 
-        * wtf/NullPtr.h: Added.
+        BUILD FIX for armv7 after r80969
 
-        * wtf/OwnArrayPtr.h: Add an overload of = taking nullptr.
-        * wtf/OwnPtr.h: Ditto.
-        * wtf/PassOwnArrayPtr.h: Ditto.
-        * wtf/PassOwnPtr.h: Ditto.
-        * wtf/PassRefPtr.h: Ditto.
-        * wtf/RefPtr.h: Ditto.
-        * wtf/RetainPtr.h: Ditto.
+        Bug 56270 - The JIT 'friend's many classes in JSC; start unwinding this.
+        <https://bugs.webkit.org/show_bug.cgi?id=56270>
 
-2010-10-18  Oliver Hunt  <oliver@apple.com>
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32): Made void* address argument
+        const.
+        (JSC::MacroAssemblerARMv7::store32): Ditto.
 
-        Reviewed by Sam Weinig.
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
 
-        Strict mode: JIT doesn't check for |this| being an immediate before dereferencing
-        https://bugs.webkit.org/show_bug.cgi?id=47826
+        Not reviewed.
 
-        There's no guarantee that |this| will be a cell in a strict mode function, so
-        don't claim that it is.
+        Try to fix the Mac build.
 
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::isKnownNotImmediate):
+        * JavaScriptCore.xcodeproj/project.pbxproj: Make sure to forward
+        ConervativeSet.h, since it's now visible when compiling other projects.
 
-2010-10-18  Zoltan Herczeg  <zherczeg@webkit.org>
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        if (0) throw "x" ; else { } throws parse error after r69906
-        https://bugs.webkit.org/show_bug.cgi?id=47807
-
-        r69906 introduced a bug: the semicolon is not parsed after a throw
-        expression anymore. Thus, the semicolon terminates the "if" parsing
-        in the example above, and the else token results a parse error.
-
-        * parser/JSParser.cpp:
-        (JSC::JSParser::parseThrowStatement):
-
-2010-10-18  Peter Varga  <pvarga@inf.u-szeged.hu>
+        Removed another case of DeprecatedPtr (ConservativeSet)
+        https://bugs.webkit.org/show_bug.cgi?id=56281
+        
+        The ConservativeSet is an internal data structure used during marking,
+        so direct pointers are fine.
 
-        Reviewed by Andreas Kling.
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h: Added some accessors, for use by MarkStack::append.
+        (JSC::ConservativeSet::~ConservativeSet): Fixed a typo where we calculated
+        the size of the set based on sizeof(DeprecatedPtr<T>*) instead of
+        sizeof(DeprecatedPtr<T>). I'm not sure if this had real-world implications or not.
+        (JSC::ConservativeSet::size):
+        (JSC::ConservativeSet::set): Use direct pointers, as stated above. 
 
-        Remove some unnecessary lines of code from Parser.cpp
-        https://bugs.webkit.org/show_bug.cgi?id=47816
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append): Created a special case of append for
+        ConservativeSet. I didn't want to add back a generic "append JSCell*"
+        function, since other class might start using that wrong. (In the end,
+        this function might go away, since the Heap will want to do something
+        slightly more interesting with the conservative set, but this is OK for
+        now.)
 
-        * parser/Parser.cpp:
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
 
-2010-10-18  Xan Lopez  <xlopez@igalia.com>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Csaba Osztrogonác.
+        Removed another case of DeprecatedPtr (PutPropertySlot)
+        https://bugs.webkit.org/show_bug.cgi?id=56278
 
-        Build broken with JIT disabled
-        https://bugs.webkit.org/show_bug.cgi?id=47801
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base): Direct pointer is fine for PutPropertySlot,
+        since it's a stack-allocated temporary.
 
-        This is a regression caused by r69940.
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::resolveBase):
+        Reviewed by Oliver Hunt.
 
-2010-10-18  Zoltan Horvath  <zoltan@webkit.org>
+        Removed one case of DeprecatedPtr (ScopeChainIterator)
+        https://bugs.webkit.org/show_bug.cgi?id=56277
 
-        Reviewed by Darin Adler.
+        * runtime/ScopeChain.h: Direct pointer is fine for ScopeChainIterator,
+        since it's a stack-allocated temporary.
 
-        Change FastAllocBase implementation into a macro
-        https://bugs.webkit.org/show_bug.cgi?id=42998
+2011-03-13  Gavin Barraclough  <barraclough@apple.com>
 
-        It was investigated in bug #33896 that inheriting classes from FastAllocBase 
-        can result in objects getting larger which leads to memory regressions. 
-        Using a macro instead of inheriting classes from FastAllocBase would solve the issue. 
+        Reviewed by Sam Weinig.
 
-        * wtf/FastAllocBase.h: Add a WTF_MAKE_FAST_ALLOCATED macro
+        Bug 56273 - Add three operand forms to MacroAssember operations.
 
-2010-10-17  Oliver Hunt  <oliver@apple.com>
+        Adding for X86(_64) for now, should be rolled out to other backends as necessary.
+        These may allow more efficient code generation in some cases, avoiding the need
+        for unnecessary register-register move instructions.
 
-        Reviewed by Sam Weinig.
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+            - marked these methods const.
+        (JSC::AbstractMacroAssembler::Jump::isSet):
+            - add a method to check whether a Jump object has been set to
+              reference an instruction, or is in a null, unset state. 
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+            - add non-explicit constructor, for FunctionPtr's to C/C++ functions.
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::lshift32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::rshift32):
+        (JSC::MacroAssemblerX86Common::urshift32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::moveDouble):
+        (JSC::MacroAssemblerX86Common::addDouble):
+        (JSC::MacroAssemblerX86Common::divDouble):
+        (JSC::MacroAssemblerX86Common::subDouble):
+        (JSC::MacroAssemblerX86Common::mulDouble):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+            - add three operand forms of these instructions.
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::addDouble):
+        (JSC::MacroAssemblerX86_64::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86_64::loadPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpSrc::isSet):
+            - add a method to check whether a JmpSrc object has been set to
+              reference an instruction, or is in a null, unset state. 
+        (JSC::X86Assembler::movsd_rr):
+            - added FP register-register move.
+        (JSC::X86Assembler::linkJump):
+            - Add an assert to check jumps aren't linked more than once.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadInt32ToDouble):
+            - load integers to the FPU via regsiters on x86-64.
 
-        Strict mode: arguments is not valid as the base expression for pre- or post-fix expressions
-        https://bugs.webkit.org/show_bug.cgi?id=47791
+2011-03-13  Gavin Barraclough  <barraclough@apple.com>
 
-        Simple fix, check for arguments in addition to eval.
+        ARM build fix.
 
-        * parser/JSParser.cpp:
-        (JSC::JSParser::parseUnaryExpression):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load32):
 
-2010-10-17  Oliver Hunt  <oliver@apple.com>
+2011-03-13  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Strict mode: Assignment that would create a global should be a late ReferenceError, not a syntax failure
-        https://bugs.webkit.org/show_bug.cgi?id=47788
-
-        Fixing this required a couple of changes:
-         * resolve_base now has a flag to indicate whether it is being used for a put in strict mode.
-           this allows us to throw an exception when we're doing a completely generic resolve for
-           assignment, and that assignment would create a new global.
-         * There is a new opcode 'op_ensure_property_exists' that is used to determine whether
-           the property being assigned to already exists on the global object.  This currently
-           has no caching, but such caching could be added relatively trivially.  It is only used
-           in the case where we know that a property will be placed on the global object, and
-           we cannot verify that the property already exists.
+        Bug 56270 - The JIT 'friend's many classes in JSC; start unwinding this.
 
-        In the jit we plant a call to cti_op_resolve_base_strict_put in the effected case rather
-        than making op_resolve_base have an additional runtime branch.
+        The JIT need to 'friend' other classes in order to be able to calculate offsets
+        of various properties, or the absolute addresses of members within specific objects,
+        in order to JIT generate code that will access members within the class when run.
 
-        There's also a new helper function to create the exception for the invalid assignment.
+        Instead of using friends in these cases, switch to providing specific accessor
+        methods to provide this information.  In the case of offsets, these can be static
+        functions, and in the case of pointers to members within a specific object these can
+        be const methods returning pointers to const values, to prevent clients from
+        modifying values otherwise encapsulated within classes.
 
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * bytecode/Opcode.h:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitResolveBase):
-        (JSC::BytecodeGenerator::emitResolveBaseForPut):
-        * bytecompiler/BytecodeGenerator.h:
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::AssignResolveNode::emitBytecode):
-        (JSC::ForInNode::emitBytecode):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::resolveBase):
-        (JSC::Interpreter::privateExecute):
+        * bytecode/SamplingTool.h:
+        * interpreter/Register.h:
+        * interpreter/RegisterFile.h:
+        * runtime/JSArray.h:
+        * runtime/JSCell.h:
+        * runtime/JSTypeInfo.h:
+        * runtime/JSVariableObject.h:
+        * runtime/Structure.h:
+        * wtf/RefCounted.h:
+            - Change these classes to no longer friend the JIT, add accessors for member offsets.
         * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JIT.h:
+        * jit/JITCall32_64.cpp:
+        * jit/JITInlineMethods.h:
         * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_resolve_base):
-        (JSC::JIT::emit_op_ensure_property_exists):
         * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_resolve_base):
-        (JSC::JIT::emit_op_ensure_property_exists):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jit/JITStubs.h:
-        * parser/JSParser.cpp:
-        (JSC::JSParser::parseProgram):
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createErrorForInvalidGlobalAssignment):
-        * runtime/ExceptionHelpers.h:
-        * runtime/Operations.h:
-        (JSC::resolveBase):
-
-2010-10-17  Simon Fraser  <simon.fraser@apple.com>
-
-        First part of fix for Windows build failure. Will wait for the
-        next set of link errors to determine the mangled forms for dtoaRoundSF
-        and dtoaRoundDP.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-10-17  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Nikolas Zimmermann.
-
-        Very large and small numbers fail to round-trip through CSS
-        https://bugs.webkit.org/show_bug.cgi?id=20674
-        
-        New exports required to use DecimalNumber in WebCore.
-
-        * JavaScriptCore.exp:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2010-10-16  Kyusun Kim  <maniagoon@company100.net>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Add using declarations for currentTimeMS() and parseDateFromNullTerminatedCharacters()
-        https://bugs.webkit.org/show_bug.cgi?id=47758
-
-        * wtf/CurrentTime.h:
-        * wtf/DateMath.h:
-
-2010-10-16  Patrick Gansterer  <paroga@webkit.org>
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+            - Change the JIT to use class accessors, rather than taking object ofsets directly.
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+            - Since the accessors for objects members return const pointers to retain encapsulation,
+              methods generating code with absolute addresses must be able to handle const pointers
+              (the JIT doesn't write to these values, do dies treat the pointer to value as const
+              from within the C++ code of the JIT, if not at runtime!).
 
-        Reviewed by Adam Barth.
+2011-03-12  Sheriff Bot  <webkit.review.bot@gmail.com>
 
-        Rename StringHasherFunctions.h to StringHasher.h
-        https://bugs.webkit.org/show_bug.cgi?id=47200
+        Unreviewed, rolling out r80919.
+        http://trac.webkit.org/changeset/80919
+        https://bugs.webkit.org/show_bug.cgi?id=56251
 
-        Now StringHasherFunctions.h only contains the StringHasher class, so rename it to the correct name.
+        all windows bots failed to compile this change (Requested by
+        loislo on #webkit).
 
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
         * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/StringHashFunctions.h: Removed.
-        * wtf/StringHasher.h: Copied from JavaScriptCore/wtf/StringHashFunctions.h.
-        * wtf/text/StringHash.h:
-        * wtf/text/StringImpl.h:
-
-2010-10-15  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Automatic Semicolon Insertion incorrectly inserts semicolon after break, continue, and return followed by a newline
-        https://bugs.webkit.org/show_bug.cgi?id=47762
-
-        The old YACC parser depended on the lexer for some classes of semicolon insertion.
-        The new parser handles ASI entirely on its own so when the lexer inserts a semicolon
-        on its own the net result is a spurious semicolon in the input stream.  This can result
-        in incorrect parsing in some cases:
-
-        if (0)
-            break
-        ;else {}
-
-        Would result in a parse failure as the output from the lexer is essentially
-
-        if (0)
-             break
-        ;;else
-
-        So the second semicolon is interpreted as a empty statement, which terminates the if,
-        making the else an error.
-
-
-        * parser/JSParser.cpp:
-        (JSC::JSParser::parseThrowStatement):
-          Parsing of throw statement was wrong, and only worked due to the weird behaviour
-          in the lexer
-        * parser/Lexer.cpp:
-        (JSC::Lexer::lex):
-          Remove bogus semicolon insertion from the newline handling
-
-2010-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
-
-        Reviewed by Dirk Schulze.
-
-        Replace some String::format() usages by StringConcatenate in WebKit
-        https://bugs.webkit.org/show_bug.cgi?id=47714
-
-        * wtf/text/StringConcatenate.h: Add UChar specific StringTypeAdapter, to accept single UChars in makeString().
-
-2010-10-15  Ilya Tikhonovsky  <loislo@chromium.org>
-
-        Unreviewed build fix for Debug Leopard which is failng to compile after r69842.
-
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::ByteCompiler::emitDisjunction):
-
-2010-10-15  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Gavin Barraclough.
-
-        The parenthetical assertion checking isn't working in some cases with YARR
-        Interpreter
-        https://bugs.webkit.org/show_bug.cgi?id=46893
-
-        Calculate the countToCheck value of a TypeParentheticalAssertion by
-        subtracting the number of characters which follows
-        a TypeParentheticalAssertion term with the number of characters which should
-        be matched by terms which are contained
-        in the TypeParentheticalAssertion term (minimumSize).
-
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::ByteCompiler::emitDisjunction):
-
-2010-10-14  Nathan Vander Wilt  <nate@andyet.net>
-
-        Reviewed by Darin Adler.
-
-        Added parser for ECMAScript 5 standard date format, so Date.parse can handle RFC 3339 timestamps: https://bugs.webkit.org/show_bug.cgi?id=44632
-
+        * bytecode/StructureStubInfo.cpp:
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::withCallee):
+        (JSC::Register::operator=):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutToCallFrameHeader):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emitSlow_op_load_varargs):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::payloadFor):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnJSValue):
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::returnJSCell):
+        * runtime/ArgList.cpp:
         * runtime/DateConversion.cpp:
-        (JSC::parseDate):
+        * runtime/GCActivityCallbackCF.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/JSActivation.h:
+        (JSC::asActivation):
+        * runtime/JSLock.cpp:
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSValue.h:
+        * runtime/JSZombie.cpp:
+        * runtime/MarkedBlock.cpp:
+        * runtime/MarkedSpace.cpp:
+        * runtime/PropertyNameArray.cpp:
+        * runtime/ScopeChain.h:
+        (JSC::ExecState::globalThisValue):
         * wtf/DateMath.cpp:
-        (WTF::ymdhmsToSeconds):
-        (WTF::parseES5DateFromNullTerminatedCharacters):
-        * wtf/DateMath.h:
 
-2010-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+2011-03-11  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Gavin Barraclough.
 
-        Replace lots of String::format() usages by StringConcatenate
-        https://bugs.webkit.org/show_bug.cgi?id=47664
-
-        Add StringTypeAdapter<char> to accept single characters for makeString().
-
-        * wtf/text/StringConcatenate.h:
-        (WTF::makeString):
-
-2010-10-14  David Goodwin  <david_goodwin@apple.com>
-
-        Reviewed by Darin Adler.
+        Ensure all values are correctly tagged in the registerfile
+        https://bugs.webkit.org/show_bug.cgi?id=56214
 
-        need way to measure size of JITed ARM code
-        https://bugs.webkit.org/show_bug.cgi?id=47121
+        This patch makes sure that all JSCell pointers written to
+        the registerfile are correctly tagged as JSCells, and replaces
+        raw int usage with the immediate representation.
 
-        * assembler/LinkBuffer.h:
-        (JSC::LinkBuffer::linkCode):
-        (JSC::LinkBuffer::dumpLinkStats):
-        (JSC::LinkBuffer::dumpCode):
+        For performance, register pressure, and general saneness reasons
+        I've added abstractions for reading and writing the tag
+        and payload of integer registers directly for the JSVALUE64
+        encoding.
 
-2010-10-14  Peter Varga  <pvarga@inf.u-szeged.hu>
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::withCallee):
+        (JSC::Register::operator=):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutToCallFrameHeader):
+        (JSC::JIT::emitPutCellToCallFrameHeader):
+        (JSC::JIT::emitPutIntToCallFrameHeader):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emitSlow_op_load_varargs):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::intPayloadFor):
+        (JSC::JSInterfaceJIT::intTagFor):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnJSValue):
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::returnJSCell):
 
-        Reviewed by Gavin Barraclough.
+2011-03-11  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        The backreference checking isn't working in some cases with YARR Interpreter
-        https://bugs.webkit.org/show_bug.cgi?id=46904
+        Reviewed by Eric Seidel.
 
-        The Interpreter::matchBackReference() function returns true without matching
-        when a backreference points to the same parentheses where it is.
+        Introduce project_dir variable and make paths a whole lot saner. Ok, a little bit saner.
+        https://bugs.webkit.org/show_bug.cgi?id=56231
 
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::Interpreter::matchBackReference):
+        * JavaScriptCore.gypi: Added project_dir variable.
+        * gyp/JavaScriptCore.gyp: Changed to use project_dir, rather than DEPTH/JavaScriptCore.
+        * gyp/generate-dtrace-header.sh: Changed to use project_dir.
 
-2010-10-14  No'am Rosenthal  <noam.rosenthal@nokia.com>
+2011-03-11  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        Reviewed by Andreas Kling.
+        Reviewed by Adam Barth.
 
-        [Qt] Text breaking is slow: enable ICU as an opt-in
-        https://bugs.webkit.org/show_bug.cgi?id=40332
+        Start using derived sources correctly and link minidom with JavaScriptCore gyp project.
+        https://bugs.webkit.org/show_bug.cgi?id=56217
 
-        Added a config flag that enables ICU as an opt-in instead of the Qt specific code.
-        Because of the inclusion of ICU headers, some explicit casting was necessary in UnicodeQt4.h
+        * gyp/JavaScriptCore.gyp: Added derived source files and passing of shared directory
+            to the scripts.
+        * gyp/generate-derived-sources.sh: Changed to use passed directory.
+        * gyp/generate-dtrace-header.sh: Ditto.
 
-        * JavaScriptCore.pri:
-        * wtf/unicode/qt4/UnicodeQt4.h:
-        (WTF::Unicode::toLower):
-        (WTF::Unicode::toUpper):
-        (WTF::Unicode::toTitleCase):
-        (WTF::Unicode::foldCase):
-        (WTF::Unicode::isPrintableChar):
-        (WTF::Unicode::isSeparatorSpace):
-        (WTF::Unicode::isPunct):
-        (WTF::Unicode::isLower):
-        (WTF::Unicode::mirroredChar):
-        (WTF::Unicode::combiningClass):
-        (WTF::Unicode::direction):
-        (WTF::Unicode::category):
-
-2010-10-14  Anton Faern  <anton@bladehawke.com>
+2011-03-11  Eric Carlson  <eric.carlson@apple.com>
 
-        Reviewed by Csaba Osztrogonác.
+        Reviewed by Sam Weinig.
 
-        https://bugs.webkit.org/show_bug.cgi?id=47658
-        NetBSD was not included in the WTF_PLATFORM_FOO to WTF_OS_FOO
-        change.  This means that OS(NETBSD) is also undefined.
+        <rdar://problem/8955589> Adopt AVFoundation media back end on Lion.
 
-        * wtf/Platform.h: s/_PLATFORM_/_OS_/ for NetBSD
+        No new tests, existing media tests cover this.
 
-2010-10-13  David Goodwin  <david_goodwin@apple.com>
+        * JavaScriptCore.exp: Export cancelCallOnMainThread
+        * wtf/Platform.h: Define WTF_USE_AVFOUNDATION.
 
-        Reviewed by Oliver Hunt.
+2011-03-11  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        ARMv7 JIT should generated conditional branches when possible
-        https://bugs.webkit.org/show_bug.cgi?id=47384
+        Reviewed by Adam Barth.
 
-        Use different jump padding sizes for conditional and unconditional
-        jumps (12 bytes and 10 bytes respectively). This allows the JIT to
-        include the IT instruction as part of the conditional jump sequence
-        which in turn allows it to optimize away the IT using an ARMv7 
-        conditional branch instruction. Use 2-byte B(T1) and 4-byte B(T3) for
-        conditional branches when displacement is in range. Also use IT/B(T4)
-        for conditional branch when displacement does not fit in B(T3).
+        Tweak dylib paths and add dtrace header generation action to JavaScriptCore gyp project.
+        https://bugs.webkit.org/show_bug.cgi?id=56207
 
-        For unconditional jump, instruction selection options are:
-        B(T2), B(T4), MOVW/MOVT/BX. For conditional jump, instruction selection
-        options are: B(T1), B(T3), IT/B(T4), ITTT/MOVW/MOVT/BX.
+        * JavaScriptCore.gypi: Added Tracing.d to the sources.
+        * gyp/generate-dtrace-header.sh: Added.
+        * gyp/JavaScriptCore.gyp: Updated dylib paths (now the project can see them),
+            and added DTrace header generating step.
 
-        * assembler/ARMv7Assembler.cpp:
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::JmpSrc::JmpSrc):
-        (JSC::ARMv7Assembler::ifThenElse):
-        (JSC::ARMv7Assembler::jumpSizeDelta):
-        (JSC::ARMv7Assembler::canCompact):
-        (JSC::ARMv7Assembler::computeJumpType):
-        (JSC::ARMv7Assembler::link):
-        (JSC::ARMv7Assembler::canBeJumpT1):
-        (JSC::ARMv7Assembler::canBeJumpT3):
-        (JSC::ARMv7Assembler::canBeJumpT4):
-        (JSC::ARMv7Assembler::linkJumpT1):
-        (JSC::ARMv7Assembler::linkJumpT3):
-        (JSC::ARMv7Assembler::linkJumpT4):
-        (JSC::ARMv7Assembler::linkConditionalJumpT4):
-        (JSC::ARMv7Assembler::linkBX):
-        (JSC::ARMv7Assembler::linkConditionalBX):
-        (JSC::ARMv7Assembler::linkJumpAbsolute):
-        * assembler/LinkBuffer.h:
-        (JSC::LinkBuffer::linkCode):
-        * assembler/MacroAssemblerARMv7.h:
-        (JSC::MacroAssemblerARMv7::canCompact):
-        (JSC::MacroAssemblerARMv7::computeJumpType):
-        (JSC::MacroAssemblerARMv7::jumpSizeDelta):
-        (JSC::MacroAssemblerARMv7::jump):
-        (JSC::MacroAssemblerARMv7::nearCall):
-        (JSC::MacroAssemblerARMv7::call):
-        (JSC::MacroAssemblerARMv7::ret):
-        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
-        (JSC::MacroAssemblerARMv7::makeJump):
-        (JSC::MacroAssemblerARMv7::makeBranch):
+2011-03-10  Oliver Hunt  <oliver@apple.com>
 
-2010-10-13  Fridrich Strba  <fridrich.strba@bluewin.ch>
+        Reviewed by Gavin Barraclough.
 
-        Reviewed by Darin Adler.
+        Fix allocation of native function with a cached thunk
+        https://bugs.webkit.org/show_bug.cgi?id=56127
 
-        Don't depend on Windows on sched_yield and sched.h
-        https://bugs.webkit.org/show_bug.cgi?id=45543
+        Fix this race condition found while fixing zombies.
 
-        sched.h is part of pthreads and sched_yield is implemented
-        in pthreads-win32 as Sleep(0). This patch avoids a gratuitous
-        dependency on pthreads-win32 in this file.
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::clearWeakPointers):
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::markChildren):
+        * runtime/JSValue.h:
+        (JSC::JSValue::decode):
+        * runtime/JSZombie.cpp:
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::createStructure):
+        * runtime/MarkedBlock.cpp:
 
-        * wtf/TCSpinLock.h:
-        (TCMalloc_SlowLock):
+2011-03-10  Luiz Agostini  <luiz.agostini@openbossa.org>
 
-2010-10-13  Kwang Yul Seo  <skyul@company100.net>
+        Reviewed by Andreas Kling.
 
-        Reviewed by Kent Tamura.
+        [Qt] fast/workers/stress-js-execution.html is crashing on Qt bot (intermittently)
+        https://bugs.webkit.org/show_bug.cgi?id=33008
 
-        [BREWMP] Port unicode
-        https://bugs.webkit.org/show_bug.cgi?id=45716
+        Defining WTF_USE_PTHREAD_BASED_QT=1 for platforms where QThread uses pthread internally.
+        Symbian is excluded because pthread_kill does not work on it. Mac is excluded because
+        it has its own ways to do JSC threading.
 
-        Brew MP port uses only the subset of ICU library to reduce the binary size.
-        Follow the WinCE's implementation.
+        Defining WTF_USE_PTHREADS inside MachineStackMarker.cpp if USE(PTHREAD_BASED_QT) is true.
 
+        * runtime/MachineStackMarker.cpp:
         * wtf/Platform.h:
-        * wtf/unicode/Unicode.h:
-        * wtf/unicode/brew/UnicodeBrew.cpp: Added.
-        (WTF::Unicode::toLower):
-        (WTF::Unicode::toUpper):
-        (WTF::Unicode::foldCase):
-        (WTF::Unicode::isPrintableChar):
-        (WTF::Unicode::isUpper):
-        (WTF::Unicode::isLower):
-        (WTF::Unicode::isDigit):
-        (WTF::Unicode::isPunct):
-        (WTF::Unicode::isAlphanumeric):
-        (WTF::Unicode::toTitleCase):
-        (WTF::Unicode::direction):
-        (WTF::Unicode::category):
-        (WTF::Unicode::decompositionType):
-        (WTF::Unicode::combiningClass):
-        (WTF::Unicode::mirroredChar):
-        (WTF::Unicode::digitValue):
-        (WTF::Unicode::isSpace):
-        (WTF::Unicode::isLetter):
-        * wtf/unicode/brew/UnicodeBrew.h: Added.
-        (WTF::Unicode::isArabicChar):
-        (WTF::Unicode::isSeparatorSpace):
-        (WTF::Unicode::hasLineBreakingPropertyComplexContext):
-        (WTF::Unicode::hasLineBreakingPropertyComplexContextOrIdeographic):
-        (WTF::Unicode::umemcasecmp):
-
-2010-10-13  Gavin Barraclough  <barraclough@apple.com>
 
-        Windows build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+2011-03-10  Gavin Barraclough  <barraclough@apple.com>
 
-2010-10-13  Adam Barth  <abarth@webkit.org>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Maciej Stachowiak.
+        Bug 56077 - ES5 conformance issues with RegExp.prototype
 
-        [WTFURL] Add URLQueryCanonicalizer
-        https://bugs.webkit.org/show_bug.cgi?id=45088
+        There are three issues causing test failures in sputnik.
 
-        This class canonicalizes the query component of URLs.  The main tricky
-        bit there is the convertCharset function, which I've moved to a
-        templated dependency.  There'll likely be more about that in future
-        patches.
+        (1) lastIndex should be converted at the point it is used, not the point it is set (this is visible if valueOf is overridden).
+        (2) The 'length' property of the test/exec functions should be 1.
+        (3) If no input is specified, the input to test()/exec() is "undefined" (i.e. ToString(undefined)) - not RegExp.input.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/url/src/URLEscape.cpp: Added.
-        * wtf/url/src/URLEscape.h: Added.
-        (WTF::appendEscapedCharacter):
-        * wtf/url/src/URLQueryCanonicalizer.h: Added.
-        (WTF::URLQueryCanonicalizer::canonicalize):
-        (WTF::URLQueryCanonicalizer::isAllASCII):
-        (WTF::URLQueryCanonicalizer::appendRaw8BitQueryString):
-        (WTF::URLQueryCanonicalizer::convertToQueryEncoding):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::markChildren):
+            - Added to mark lastIndex
+        (JSC::regExpObjectLastIndex):
+        (JSC::setRegExpObjectLastIndex):
+            - lastIndex is now stored as a JSValue.
+        (JSC::RegExpObject::match):
+            - Use accessor methods to get/set lastIndex, add fast case for isUInt32 (don't convert to double).
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+        (JSC::RegExpObject::setLastIndex):
+            - Set lastIndex, either from a size_t or a JSValue.
+        (JSC::RegExpObject::getLastIndex):
+            - Get lastIndex.
+        (JSC::RegExpObject::RegExpObjectData::RegExpObjectData):
+            - Initialize as a JSValue.
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+            - Add test/exec properties with length 1.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+            - Do not read RegExp.input if none is provided.
+        * tests/mozilla/js1_2/regexp/RegExp_input.js:
+        * tests/mozilla/js1_2/regexp/RegExp_input_as_array.js:
+            - Update these tests (they relied on non-ES5 behaviour).
 
-2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+2011-03-10  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Bug 43987 - Downloading using XHR is much slower than before
-        Change StringBuilder to use overcapacity in a StringImpl, rather than a Vector.
-        Fundamentally this should be the same (copies current contents to expand capacity,
-        rather than using a rope), but this approach allows the intermadiate state of the
-        String to be inspected in the buffer without copying to resolve.
+        Rolled back in 80277 and 80280 with event handler layout test failures fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=55653        
 
-        * runtime/JSONObject.cpp:
-        (JSC::Stringifier::appendQuotedString):
-        (JSC::Stringifier::Holder::appendNextProperty):
-            Renamed StringBuilder::size() -> length() (to match other String types).
-
-        * runtime/UStringBuilder.h:
-        (JSC::UStringBuilder::append):
-        (JSC::UStringBuilder::toUString):
-            Update for changes in parent class, can just 'using' the append methods.
-
-        * wtf/text/StringBuilder.cpp: Added.
-        (WTF::StringBuilder::reifyString):
-        (WTF::StringBuilder::resize):
-        (WTF::StringBuilder::reserveCapacity):
-        (WTF::StringBuilder::allocateBuffer):
-        (WTF::StringBuilder::appendUninitialized):
-        (WTF::StringBuilder::append):
-        (WTF::StringBuilder::shrinkToFit):
-        * wtf/text/StringBuilder.h:
-        (WTF::StringBuilder::StringBuilder):
-        (WTF::StringBuilder::append):
-        (WTF::StringBuilder::toString):
-        (WTF::StringBuilder::toStringPreserveCapacity):
-        (WTF::StringBuilder::length):
-        (WTF::StringBuilder::isEmpty):
-        (WTF::StringBuilder::operator[]):
-        (WTF::StringBuilder::clear):
-            Class updated to use overcapacity in a StringImpl, rather than a Vector.
+        The failures were caused by a last minute typo: assigning to currentEvent
+        instead of m_currentEvent.
 
-        * Android.mk:
-        * Android.v8.wtf.mk:
-        * GNUmakefile.am:
         * JavaScriptCore.exp:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
         * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/CMakeLists.txt:
-        * wtf/wtf.pri:
-
-2010-10-13  Adam Roben  <aroben@apple.com>
-
-        Export tryFastRealloc for WebKit2's benefit
-
-        Rubber-stamped by Anders Carlsson.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added
-        tryFastRealloc. Removed RegExpObject::info, which is now exported via
-        JS_EXPORTDATA.
-
-2010-10-13  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        [WTFURL] Add a mechanism for classifying types of characters
-        https://bugs.webkit.org/show_bug.cgi?id=45085
-
-        Various characters have different escaping rules depending on where
-        they are in URLs.  This patch adds a table containing that information.
+        * bytecompiler/BytecodeGenerator.cpp:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * runtime/Arguments.h:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSVariableObject.h:
+        * runtime/MarkedSpace.cpp:
+        * runtime/MarkedSpace.h:
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/url/src/URLCharacterTypes.cpp: Added.
-        * wtf/url/src/URLCharacterTypes.h: Added.
-        (WTF::URLCharacterTypes::isQueryChar):
-        (WTF::URLCharacterTypes::isIPv4Char):
-        (WTF::URLCharacterTypes::isHexChar):
-        (WTF::URLCharacterTypes::isCharOfType):
+2011-03-09  Oliver Hunt  <oliver@apple.com>
 
-2010-10-13  Xan Lopez  <xlopez@igalia.com>
+        Reviewed by Gavin Barraclough.
 
-        Reviewed by Csaba Osztrogonác.
+        jquery/manipulation.html fails after r80598
+        https://bugs.webkit.org/show_bug.cgi?id=56019
 
-        Missing parameters for bytecode dump of next_pname
-        https://bugs.webkit.org/show_bug.cgi?id=47590
+        When linking a call, codeblock now takes ownership of the linked function
+        This removes the need for unlinking, and thus the incorrectness that was
+        showing up in these tests.
 
         * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump): add missing parameters to the dump.
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::setUnlinked):
+        (JSC::CodeBlock::addCaller):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
+        * jit/JIT.h:
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
 
-2010-10-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+2011-03-09  Daniel Bates  <dbates@rim.com>
 
-        Reviewed by Dirk Schulze.
+        Attempt to fix the WinCE build after changeset 80684 <http://trac.webkit.org/changeset/80684>
+        (Bug #56041<https://bugs.webkit.org/show_bug.cgi?id=56041>).
 
-        Add wtf/text/StringConcatenate
-        https://bugs.webkit.org/show_bug.cgi?id=47584
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Substitute variable callFrame for exec in call to createSyntaxError().
 
-        Move runtime/StringConcatenate.h to wtf/text, make it work for Strings too.
-        Add a special runtime/UStringConcatenate.h class that inherits from StringConcatenate, and extends it for use with UString.
-        Exactly the same design that has been followed while refactoring StringBuilder.
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
 
-        The UString variants can all be removed as soon as WTF::String & JSC::UString converge.
+        Reviewed by Sam Weinig.
 
-        * GNUmakefile.am: Add wtf/text/StringConcatenate.h and runtime/UStringConcatenate.h.
-        * JavaScriptCore.gypi: Ditto.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
-        * bytecode/CodeBlock.cpp: s/makeString/makeUString/
-        (JSC::escapeQuotes):
-        (JSC::valueToSourceString):
-        (JSC::constantName):
-        (JSC::idName):
-        (JSC::CodeBlock::registerName):
-        (JSC::regexpToSourceString):
-        (JSC::regexpName):
-        * bytecompiler/NodesCodegen.cpp: Ditto.
-        (JSC::substitute):
-        * profiler/Profiler.cpp: Ditto.
-        (JSC::Profiler::createCallIdentifier):
-        * runtime/ExceptionHelpers.cpp: Ditto.
-        (JSC::createUndefinedVariableError):
-        (JSC::createErrorMessage):
-        (JSC::createInvalidParamError):
-        * runtime/FunctionConstructor.cpp: Ditto.
-        (JSC::constructFunction):
-        * runtime/FunctionPrototype.cpp: Ditto.
-        (JSC::insertSemicolonIfNeeded):
-        * runtime/JSONObject.cpp: Ditto.
-        (JSC::Stringifier::indent):
-        * runtime/JSStringBuilder.h:
-        (JSC::jsMakeNontrivialString):
-        * runtime/RegExpConstructor.cpp: Ditto.
-        (JSC::constructRegExp):
-        * runtime/RegExpObject.cpp: Ditto.
-        (JSC::RegExpObject::match):
-        * runtime/RegExpPrototype.cpp: Ditto.
-        (JSC::regExpProtoFuncCompile):
-        * runtime/StringConcatenate.h: Removed.
-        * runtime/UStringConcatenate.h: Added. Only contains the StringTypeAdapter<JSC::UString> code and the makeUString variants, the rest lives in wtf/text/StringConcatenate.h
-        (JSC::makeUString):
-        * wtf/text/StringConcatenate.h: Copied from runtime/StringConcatenate.h.
-        (WTF::makeString):
+        Bug 56041 - RexExp constructor should only accept flags "gim"
+        Fix for issues introduced in r80667.
 
-2010-10-12  Gavin Barraclough  <barraclough@apple.com>
+        Invalid flags to a RegExp literal are a late syntax error!
 
-        Windows build fix.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addRegExp):
+            - Pass a PassRefPtr<RegExp>
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addRegExp):
+        (JSC::BytecodeGenerator::emitNewRegExp):
+        * bytecompiler/BytecodeGenerator.h:
+            - Pass a PassRefPtr<RegExp>
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+            - Should not be ASSERTing that the flags are valid - this is a late(er) error.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+            - Need to check for error from RegExp constructor.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - Need to check for error from RegExp constructor.
+        * runtime/RegExp.h:
+        (JSC::RegExp::isValid):
+            - Make isValid check that the regexp was created with valid flags.
+        * runtime/RegExpKey.h:
+            - Since we'll not create RegExp objects with invalid flags, separate out the deleted value.
 
-        * wtf/text/StringBuilder.h:
-        (WTF::StringBuilder::length):
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
 
-2010-10-12  Nikolas Zimmermann  <nzimmermann@rim.com>
+        Windows build fix part 2.
 
-        Reviewed by Gavin Barraclough.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        Unify JSC::StringBuilder & WebCore::StringBuilder
-        https://bugs.webkit.org/show_bug.cgi?id=47538
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
 
-        Move runtime/StringBuilder.h to wtf/text/StringBuilder.h. Rename build() to toString() and return a WTF::String().
-        Move the append(const JSC::UString&) method into runtime/UStringBuilder.h.
-        UStringBuilder inherits from StringBuilder.h and adds append(const JSC::UString&) and UString toUString() functionality.
+        Windows build fix part 1.
 
-        No new code, just move code around.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        * GNUmakefile.am: Add wtf/text/StringBuilder.h / runtime/UStringBuilder.h. Remove runtime/StringBuilder.h.
-        * JavaScriptCore.gypi: Ditto.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
-        * runtime/Executable.cpp:
-        (JSC::FunctionExecutable::paramString): Use UStringBuilder, instead of StringBuilder. Rename build() -> toUString().
-        * runtime/FunctionConstructor.cpp:
-        (JSC::constructFunction): Ditto.
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncUnescape): Ditto.
-        * runtime/JSONObject.cpp:
-        (JSC::Stringifier::stringify): Ditto.
-        (JSC::Stringifier::appendQuotedString): Ditto.
-        (JSC::Stringifier::appendStringifiedValue): Ditto.
-        (JSC::Stringifier::startNewLine): Ditto.
-        (JSC::Stringifier::Holder::appendNextProperty): Ditto.
-        * runtime/LiteralParser.cpp:
-        (JSC::LiteralParser::Lexer::lexString): Ditto.
-        * runtime/NumberPrototype.cpp: Remove unneeded JSStringBuilder.h / StringBuilder.h include.
-        * runtime/StringBuilder.h: Removed.
-        * runtime/UStringBuilder.h: Added. Inherits from WTF::StringBuilder, extending it by two methods.
-        (JSC::UStringBuilder::append): append(const JSC::UString&)
-        (JSC::UStringBuilder::toUString):
-        * wtf/text/StringBuilder.h: Copied from runtime/StringBuilder.h. Move JSC::UString parts into runtime/UStringBuilder.h
-        (WTF::StringBuilder::append): Renamed m_buffer to buffer everywhere.
-        (WTF::StringBuilder::isEmpty): Ditto (+ constify method). 
-        (WTF::StringBuilder::reserveCapacity): Ditto.
-        (WTF::StringBuilder::resize): Ditto.
-        (WTF::StringBuilder::size): Ditto.
-        (WTF::StringBuilder::operator[]): Ditto.
-        (WTF::StringBuilder::toString): Ditto (+ renamed from build()). Returns a String, not an UString. The old build() method is now named toUString() and lives in UStringBuilder.
-
-2010-10-12  Michael Saboff  <msaboff@apple.com>
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Darin Adler.
 
-        Cleaned up the processing of replacements after regular expression
-        processing, especially the case where there wasn't a match.
-        Changed to use empty strings instead of computing a zero length sub
-        string.
-        https://bugs.webkit.org/show_bug.cgi?id=47506
+        Bug 56041 - RexExp constructor should only accept flags "gim"
+        We also should be passing the flags around as a bitfield rather than a string,
+        and should not have redundant, incompatible code for converting the string to a bitfield!
 
+        * JavaScriptCore.exp:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+            - Need to parse flags string to enum.
+        * runtime/RegExp.cpp:
+        (JSC::regExpFlags):
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+            - Add method to parse flags string to enum, change constructor/create args to take enum.
+        * runtime/RegExp.h:
+        (JSC::RegExp::global):
+        (JSC::RegExp::ignoreCase):
+        (JSC::RegExp::multiline):
+            - Change to use new enum values.
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+            - Changed to use regExpFlags enum instead of int/const UString&.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+            - Add use new enum parsing, check for error.
+        * runtime/RegExpKey.h:
+        (JSC::RegExpKey::RegExpKey):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+            - Pass NoFlags value instead of empty string.
+        (JSC::regExpProtoFuncCompile):
+            - Add use new enum parsing, check for error.
         * runtime/StringPrototype.cpp:
-        (JSC::jsSpliceSubstringsWithSeparators):
-        (JSC::stringProtoFuncReplace):
-
-2010-10-11  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed.
-
-        Clang build fix after r69472.
-        https://bugs.webkit.org/show_bug.cgi?id=46523
-
-        * wtf/text/StringHash.h:
-
-2010-10-11  Oliver Hunt  <oliver@apple.com>
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+            - Pass NoFlags value instead of empty string.
 
-        Undo last minute change to 32bit build.
+2011-03-08  Gavin Barraclough  <barraclough@apple.com>
 
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_convert_this_strict):
+        Reviewed by Sam Weinig
 
-2010-10-11  Brian Weinstein  <bweinstein@apple.com>
+        Bug 55994 - Functions on Array.prototype should check length first.
+        These methods are designed to work on generic objects too, and if 'length'
+        is a getter that throws an exception, ensure this is correctly thrown
+        (even if other exceptions would be thrown, too).
 
-        Build fix for Windows. Add a necessary export from r69516.
+        Make the length check the first thing we do.
+        This change shows a progression on SunSpider on my machine, but this is likely bogus.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
 
-2010-10-11  Oliver Hunt  <oliver@apple.com>
+2011-03-07  Oliver Hunt  <oliver@apple.com>
 
-        Fix interpreter build -- was broken by incorrect merge.
+        Reviewed by Gavin Barraclough.
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
+        Make CodeBlock GC write barrier safe
+        https://bugs.webkit.org/show_bug.cgi?id=55910
 
-2010-10-01  Oliver Hunt  <oliver@apple.com>
+        In order to make CodeBlock WriteBarrier safe it was necessary
+        to make it have a single GC owner, and for that reason I have
+        made ExecutableBase a GC allocated object.  This required
+        updating their creation routines as well as all sites that hold
+        a reference to them.  GC objects that held Executable's have been
+        converted to WriteBarriers, and all other sites now use Global<>.
 
-        Reviewed by Gavin Barraclough.
+        As an added benefit this gets rid of JSGlobalData's list of
+        GlobalCodeBlocks.
 
-        [ES5] Implement strict mode
-        https://bugs.webkit.org/show_bug.cgi?id=10701
-
-        Initial strict mode implementation.  This is the simplest
-        implementation that could possibly work and adds (hopefully)
-        all of the restrictions required by strict mode.  There are
-        a number of inefficiencies, especially in the handling of
-        arguments and eval as smart implementations would make this
-        patch more complicated.  
-
-        The SyntaxChecker AST builder has become somewhat more complex
-        as strict mode does require more parse tree information to
-        validate the syntax.
-
-        Summary of major changes to the parser:
-            * We track when we enter strict mode (this may come as a surprise)
-            * Strict mode actually requires a degree of AST knowledge to validate
-              so the SyntaxChecker now produces values that can be used to distinguish
-              "node" types.
-            * We now track variables that are written to.  We do this to
-              statically identify writes to global properties that don't exist
-              and abort at that point.  This should actually make it possible
-              to optimise some other cases in the future but for now it's
-              purely for validity checking.  Currently writes are only tracked
-              in strict mode code.
-            * Labels are now tracked as it is now a syntax error to jump to a label
-              that does not exist (or to use break, continue, or return in a context
-              where they would be invalid).
-
-        Runtime changes:
-            * In order to get correct hanlding of the Arguments object all
-              strict mode functions that reference arguments create and tearoff
-              the arguments object on entry.  This is not strictly necessary
-              but was the least work necessary to get the correct behaviour.
-            * PutPropertySlot now tracks whether it is being used for a strict
-              mode write, and if so Object::put will throw when a write can't be
-              completed.
-            * StrictEvalActivation was added as an "activation" object for strict
-              mode eval (so that strict eval does not introduce new variables into
-              the containing scope).
+        Perf testing shows a 0.5% progression on v8, vs. a 0.3% regression
+        on SunSpider.  Given none of the tests that show regressions
+        demonstrate a regression on their own, and sampling shows up nothing.
+        I suspect we're just getting one or two additional gc passes at
+        the end of the run.
 
-        * CMakeLists.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.exp:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
         * bytecode/CodeBlock.cpp:
         (JSC::CodeBlock::dump):
         (JSC::CodeBlock::CodeBlock):
-        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::EvalCodeCache::markAggregate):
+        (JSC::CodeBlock::markAggregate):
         * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::isStrictMode):
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::CodeBlock::addConstant):
+        (JSC::CodeBlock::constantRegister):
+        (JSC::CodeBlock::getConstant):
+        (JSC::CodeBlock::addFunctionDecl):
+        (JSC::CodeBlock::addFunctionExpr):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ExecState::r):
         * bytecode/EvalCodeCache.h:
         (JSC::EvalCodeCache::get):
-        * bytecode/Opcode.h:
+        * bytecode/SamplingTool.h:
+        (JSC::ScriptSampleRecord::ScriptSampleRecord):
         * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
-        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitEqualityOp):
         * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::isStrictMode):
         (JSC::BytecodeGenerator::makeFunction):
         * debugger/Debugger.cpp:
         (JSC::evaluateInGlobalCallFrame):
@@ -12146,12005 +6071,2922 @@
         (JSC::DebuggerCallFrame::evaluate):
         * interpreter/Interpreter.cpp:
         (JSC::Interpreter::callEval):
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        * jit/JIT.h:
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_get_pnames):
-        (JSC::JIT::emit_op_convert_this_strict):
-        (JSC::JIT::emitSlow_op_convert_this_strict):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_get_pnames):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
         * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::hostFunctionStub):
+        (JSC::JITThunks::clearHostFunctionStubs):
         * jit/JITStubs.h:
-        * parser/ASTBuilder.h:
-        (JSC::ASTBuilder::createFunctionBody):
-        (JSC::ASTBuilder::isResolve):
-        * parser/JSParser.cpp:
-        (JSC::JSParser::next):
-        (JSC::JSParser::startLoop):
-        (JSC::JSParser::endLoop):
-        (JSC::JSParser::startSwitch):
-        (JSC::JSParser::endSwitch):
-        (JSC::JSParser::setStrictMode):
-        (JSC::JSParser::strictMode):
-        (JSC::JSParser::isValidStrictMode):
-        (JSC::JSParser::declareParameter):
-        (JSC::JSParser::breakIsValid):
-        (JSC::JSParser::pushLabel):
-        (JSC::JSParser::popLabel):
-        (JSC::JSParser::hasLabel):
-        (JSC::JSParser::DepthManager::DepthManager):
-        (JSC::JSParser::DepthManager::~DepthManager):
-        (JSC::JSParser::Scope::Scope):
-        (JSC::JSParser::Scope::startSwitch):
-        (JSC::JSParser::Scope::endSwitch):
-        (JSC::JSParser::Scope::startLoop):
-        (JSC::JSParser::Scope::endLoop):
-        (JSC::JSParser::Scope::inLoop):
-        (JSC::JSParser::Scope::breakIsValid):
-        (JSC::JSParser::Scope::pushLabel):
-        (JSC::JSParser::Scope::popLabel):
-        (JSC::JSParser::Scope::hasLabel):
-        (JSC::JSParser::Scope::isFunction):
-        (JSC::JSParser::Scope::declareVariable):
-        (JSC::JSParser::Scope::declareWrite):
-        (JSC::JSParser::Scope::deleteProperty):
-        (JSC::JSParser::Scope::declareParameter):
-        (JSC::JSParser::Scope::setNeedsFullActivation):
-        (JSC::JSParser::Scope::collectFreeVariables):
-        (JSC::JSParser::Scope::getUncapturedWrittenVariables):
-        (JSC::JSParser::Scope::getDeletedVariables):
-        (JSC::JSParser::Scope::setStrictMode):
-        (JSC::JSParser::Scope::strictMode):
-        (JSC::JSParser::Scope::isValidStrictMode):
-        (JSC::JSParser::pushScope):
-        (JSC::JSParser::popScope):
-        (JSC::JSParser::declareVariable):
-        (JSC::JSParser::declareWrite):
-        (JSC::JSParser::deleteProperty):
-        (JSC::jsParse):
-        (JSC::JSParser::JSParser):
-        (JSC::JSParser::parseProgram):
-        (JSC::JSParser::parseSourceElements):
-        (JSC::JSParser::parseDoWhileStatement):
-        (JSC::JSParser::parseWhileStatement):
-        (JSC::JSParser::parseVarDeclarationList):
-        (JSC::JSParser::parseConstDeclarationList):
-        (JSC::JSParser::parseForStatement):
-        (JSC::JSParser::parseBreakStatement):
-        (JSC::JSParser::parseContinueStatement):
-        (JSC::JSParser::parseReturnStatement):
-        (JSC::JSParser::parseWithStatement):
-        (JSC::JSParser::parseSwitchStatement):
-        (JSC::JSParser::parseSwitchClauses):
-        (JSC::JSParser::parseSwitchDefaultClause):
-        (JSC::JSParser::parseTryStatement):
-        (JSC::JSParser::parseBlockStatement):
-        (JSC::JSParser::parseStatement):
-        (JSC::JSParser::parseFormalParameters):
-        (JSC::JSParser::parseFunctionBody):
-        (JSC::JSParser::parseFunctionInfo):
-        (JSC::JSParser::parseFunctionDeclaration):
-        (JSC::JSParser::parseExpressionOrLabelStatement):
-        (JSC::JSParser::parseIfStatement):
-        (JSC::JSParser::parseExpression):
-        (JSC::JSParser::parseAssignmentExpression):
-        (JSC::JSParser::parseConditionalExpression):
-        (JSC::JSParser::parseBinaryExpression):
-        (JSC::JSParser::parseStrictObjectLiteral):
-        (JSC::JSParser::parsePrimaryExpression):
-        (JSC::JSParser::parseMemberExpression):
-        (JSC::JSParser::parseUnaryExpression):
-        * parser/JSParser.h:
-        * parser/Lexer.cpp:
-        (JSC::Lexer::parseString):
-        (JSC::Lexer::lex):
-        * parser/Lexer.h:
-        (JSC::Lexer::isReparsing):
-        * parser/Nodes.cpp:
-        (JSC::ScopeNode::ScopeNode):
-        (JSC::FunctionBodyNode::FunctionBodyNode):
-        (JSC::FunctionBodyNode::create):
-        * parser/Nodes.h:
-        (JSC::ScopeNode::isStrictMode):
-        * parser/Parser.cpp:
-        (JSC::Parser::parse):
-        * parser/Parser.h:
-        (JSC::Parser::parse):
-        * parser/SyntaxChecker.h:
-        (JSC::SyntaxChecker::SyntaxChecker):
-        (JSC::SyntaxChecker::makeFunctionCallNode):
-        (JSC::SyntaxChecker::appendToComma):
-        (JSC::SyntaxChecker::createCommaExpr):
-        (JSC::SyntaxChecker::makeAssignNode):
-        (JSC::SyntaxChecker::makePrefixNode):
-        (JSC::SyntaxChecker::makePostfixNode):
-        (JSC::SyntaxChecker::makeTypeOfNode):
-        (JSC::SyntaxChecker::makeDeleteNode):
-        (JSC::SyntaxChecker::makeNegateNode):
-        (JSC::SyntaxChecker::makeBitwiseNotNode):
-        (JSC::SyntaxChecker::createLogicalNot):
-        (JSC::SyntaxChecker::createUnaryPlus):
-        (JSC::SyntaxChecker::createVoid):
-        (JSC::SyntaxChecker::thisExpr):
-        (JSC::SyntaxChecker::createResolve):
-        (JSC::SyntaxChecker::createObjectLiteral):
-        (JSC::SyntaxChecker::createArray):
-        (JSC::SyntaxChecker::createNumberExpr):
-        (JSC::SyntaxChecker::createString):
-        (JSC::SyntaxChecker::createBoolean):
-        (JSC::SyntaxChecker::createNull):
-        (JSC::SyntaxChecker::createBracketAccess):
-        (JSC::SyntaxChecker::createDotAccess):
-        (JSC::SyntaxChecker::createRegex):
-        (JSC::SyntaxChecker::createNewExpr):
-        (JSC::SyntaxChecker::createConditionalExpr):
-        (JSC::SyntaxChecker::createAssignResolve):
-        (JSC::SyntaxChecker::createFunctionExpr):
-        (JSC::SyntaxChecker::createFunctionBody):
-        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
-        (JSC::SyntaxChecker::operatorStackPop):
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::createStrictModeCallerIfNecessary):
-        (JSC::Arguments::createStrictModeCalleeIfNecessary):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::getOwnPropertyDescriptor):
-        (JSC::Arguments::put):
-        (JSC::Arguments::deleteProperty):
-        * runtime/Arguments.h:
-        (JSC::Arguments::Arguments):
-        * runtime/CommonIdentifiers.cpp:
-        (JSC::CommonIdentifiers::CommonIdentifiers):
-        * runtime/CommonIdentifiers.h:
-        * runtime/Error.cpp:
-        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
-        (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
-        (JSC::StrictModeTypeErrorFunction::getConstructData):
-        (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
-        (JSC::StrictModeTypeErrorFunction::getCallData):
-        (JSC::createTypeErrorFunction):
-        * runtime/Error.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
         * runtime/Executable.cpp:
         (JSC::EvalExecutable::EvalExecutable):
         (JSC::ProgramExecutable::ProgramExecutable):
         (JSC::FunctionExecutable::FunctionExecutable):
-        (JSC::EvalExecutable::compileInternal):
-        (JSC::ProgramExecutable::checkSyntax):
-        (JSC::ProgramExecutable::compileInternal):
-        (JSC::FunctionExecutable::compileForCallInternal):
-        (JSC::FunctionExecutable::compileForConstructInternal):
-        (JSC::FunctionExecutable::reparseExceptionInfo):
-        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::~FunctionExecutable):
+        (JSC::EvalExecutable::markChildren):
+        (JSC::ProgramExecutable::markChildren):
+        (JSC::FunctionExecutable::markChildren):
         (JSC::FunctionExecutable::fromGlobalCode):
-        (JSC::ProgramExecutable::reparseExceptionInfo):
         * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::VPtrHackExecutable::VPtrHackExecutable):
         (JSC::ScriptExecutable::ScriptExecutable):
-        (JSC::ScriptExecutable::isStrictMode):
         (JSC::EvalExecutable::create):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::create):
+        (JSC::ProgramExecutable::createStructure):
         (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/Heap.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
         * runtime/JSActivation.cpp:
-        (JSC::JSActivation::toStrictThisObject):
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::markChildren):
         * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSCell.h:
         * runtime/JSFunction.cpp:
-        (JSC::createDescriptorForThrowingProperty):
-        (JSC::JSFunction::getOwnPropertySlot):
-        (JSC::JSFunction::getOwnPropertyDescriptor):
-        (JSC::JSFunction::put):
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::markChildren):
+        * runtime/JSFunction.h:
         * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
         (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::getHostFunction):
         * runtime/JSGlobalData.h:
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::internalFunctionStructure):
         * runtime/JSGlobalObjectFunctions.cpp:
         (JSC::globalFuncEval):
         * runtime/JSObject.cpp:
-        (JSC::JSObject::put):
-        (JSC::JSObject::toStrictThisObject):
-        (JSC::throwTypeError):
-        * runtime/JSObject.h:
-        (JSC::JSObject::isStrictModeFunction):
-        (JSC::JSObject::putDirectInternal):
-        (JSC::JSObject::putDirect):
-        (JSC::JSValue::putDirect):
-        (JSC::JSValue::toStrictThisObject):
         * runtime/JSStaticScopeObject.cpp:
-        (JSC::JSStaticScopeObject::toStrictThisObject):
+        (JSC::JSStaticScopeObject::markChildren):
         * runtime/JSStaticScopeObject.h:
-        * runtime/JSValue.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObjectData::JSStaticScopeObjectData):
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        * runtime/JSZombie.cpp:
+        (JSC::JSZombie::leakedZombieStructure):
         * runtime/JSZombie.h:
-        (JSC::JSZombie::toStrictThisObject):
-        * runtime/PutPropertySlot.h:
-        (JSC::PutPropertySlot::PutPropertySlot):
-        (JSC::PutPropertySlot::isStrictMode):
-        * runtime/StrictEvalActivation.cpp: Added.
-        (JSC::StrictEvalActivation::StrictEvalActivation):
-        (JSC::StrictEvalActivation::deleteProperty):
-        (JSC::StrictEvalActivation::toThisObject):
-        (JSC::StrictEvalActivation::toStrictThisObject):
-        * runtime/StrictEvalActivation.h: Added.
-
-2010-10-10  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed.
-
-        Windows build fix after r69472.
-
-        * wtf/text/StringHash.h:
-        (WTF::CaseFoldingHash::hash):
-
-2010-10-10  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Use WTF::StringHasher in WTF::CaseFoldingHash
-        https://bugs.webkit.org/show_bug.cgi?id=46523
-
-        * wtf/text/StringHash.h:
-        (WTF::CaseFoldingHash::foldCase):
-        (WTF::CaseFoldingHash::hash):
-
-2010-10-09  Pratik Solanki  <psolanki@apple.com>
-
-        Reviewed by Xan Lopez.
-
-        https://bugs.webkit.org/show_bug.cgi?id=47445
-        Remove unused function WTFThreadData::initializeIdentifierTable()
-
-        * wtf/WTFThreadData.h:
-
-2010-10-08  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Added check to start of subexpression being positive before using
-        subexpression in replacement.
-        https://bugs.webkit.org/show_bug.cgi?id=47324
-
-        * runtime/StringPrototype.cpp:
-        (JSC::substituteBackreferencesSlow):
-
-2010-10-08  Chris Evans  <cevans@google.com>
-
-        Reviewed by David Levin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=47393
-
-        Use unsigned consistently to check for max StringImpl length.
-        Add a few integer overflow checks.
-        Uses the existing paradigm of CRASH() when we can't reasonably handle a crazily large request.
+        (JSC::JSZombie::createStructure):
+        * runtime/MarkedSpace.h:
 
-        * wtf/text/WTFString.cpp:
-        * wtf/text/StringImpl.h:
-        * wtf/text/StringImpl.cpp:
-        Better use of size_t vs. unsigned; check for integer overflows.
+2011-03-07  Andy Estes  <aestes@apple.com>
 
-2010-10-07  David Goodwin  <david_goodwin@apple.com>
+        Reviewed by Dan Bernstein.
 
-        Reviewed by Oliver Hunt.
+        REGRESSION (r79060): Timestamp is missing from tweets in twitter.
+        https://bugs.webkit.org/show_bug.cgi?id=55228
 
-        ARM JIT generates undefined operations due to partially uninitialized ShiftTypeAndAmount
-        https://bugs.webkit.org/show_bug.cgi?id=47356
+        A change to the date parser to handle the case where the year is
+        specified before the time zone inadvertently started accepting strings
+        such as '+0000' as valid years. Those strings actually represent time
+        zones in an offset of hours and minutes from UTC, not years.
 
-        * assembler/ARMv7Assembler.h:
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters): If the current character
+        in dateString is '+' or '-', do not try to parse the next token as a
+        year.
 
-2010-10-06  Chris Evans  <cevans@google.com>
+2011-03-06  Yuta Kitamura  <yutak@chromium.org>
 
-        Reviewed by David Levin.
+        Reviewed by Kent Tamura.
 
-        https://bugs.webkit.org/show_bug.cgi?id=47248
+        Add SHA-1 for new WebSocket protocol
+        https://bugs.webkit.org/show_bug.cgi?id=55039
 
-        Use size_t consistently in CString, to prevent theoretical trouble
-        with > 4GB strings on 64-bit platforms.
+        The code is based on Chromium's portable SHA-1 implementation
+        (src/base/sha1_portable.cc). Modifications were made in order
+        to make the code comply with WebKit coding style.
 
-        * wtf/text/CString.h:
-        * wtf/text/CString.cpp:
-        Use size_t for string lengths.
-        * wtf/MD5.cpp:
-        (WTF::expectMD5): use suitable format string + cast for size_t.
+        * GNUmakefile.am:
         * JavaScriptCore.exp:
-        Update symbol name.
-
-2010-10-06  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Start cleaning up Arguments.h
-        https://bugs.webkit.org/show_bug.cgi?id=47304
-
-        * wtf/TypeTraits.h:
-        * wtf/TypeTraits.cpp:
-        Add RemoveReference type trait.
-
-2010-10-06  Rafael Antognolli  <antognolli@profusion.mobi>
-
-        Unreviewed build fix.
-
-        [EFL] Build fix for glib support.
-        https://bugs.webkit.org/show_bug.cgi?id=47221
-
-        If compiling with GLib support enabled, we also need to link wtf against
-        glib library.
-
-        * wtf/CMakeListsEfl.txt:
-
-2010-10-05  Kwang Yul Seo  <skyul@company100.net>
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/MD5.cpp:
+        (WTF::MD5::MD5):
+        * wtf/SHA1.cpp: Added.
+        (WTF::testSHA1): This function will be run the first time SHA1
+        constructor is called. This function computes a few hash values
+        and checks the results in debug builds. However, constructor is
+        probably not a good place to run these tests, so we need to find
+        a good place for it (bug 55853).
+        (WTF::expectSHA1):
+        (WTF::f):
+        (WTF::k):
+        (WTF::rotateLeft):
+        (WTF::SHA1::SHA1):
+        (WTF::SHA1::addBytes):
+        (WTF::SHA1::computeHash):
+        (WTF::SHA1::finalize):
+        (WTF::SHA1::processBlock):
+        (WTF::SHA1::reset):
+        * wtf/SHA1.h: Added.
+        (WTF::SHA1::addBytes):
+        * wtf/wtf.pri:
 
-        Reviewed by Gavin Barraclough.
+2011-03-05  Adam Barth  <abarth@webkit.org>
 
-        [BREWMP] Port ExecutableAllocator::cacheFlush to enable ARM JIT
-        https://bugs.webkit.org/show_bug.cgi?id=47117
+        Reviewed by Dimitri Glazkov.
 
-        Use IMemCache1 to flush data cache and invalidate instruction cache.
+        Add Derived Sources to WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=55813
 
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutableAllocator::cacheFlush):
+        Rename the action to be friendlier.
 
-2010-10-05  Leandro Pereira  <leandro@profusion.mobi>
+        * gyp/JavaScriptCore.gyp:
 
-        Unreviewed. Build fix.
+2011-03-04  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
 
-        Moved "jsc" directory to "shell", so that the name does not clash with the
-        JavaScriptCore shell in some build systems.
-        http://webkit.org/b/47049
+        Reviewed by Laszlo Gombos.
 
-        * CMakeLists.txt: Changed reference from "jsc" to "shell".
-        * jsc: Removed.
-        * jsc/CMakeLists.txt: Removed.
-        * jsc/CMakeListsEfl.txt: Removed.
-        * shell: Copied from JavaScriptCore/jsc.
+        [Qt] Need symbian version of cryptographicallyRandomValuesFromOS
+        https://bugs.webkit.org/show_bug.cgi?id=55782
 
-2010-10-05  Kwang Yul Seo  <skyul@company100.net>
+        Implement Symbian version of cryptographicallyRandomValuesFromOS
 
-        Reviewed by Kent Tamura.
+        * wtf/OSRandomSource.cpp:
+        (WTF::cryptographicallyRandomValuesFromOS):
 
-        [BREWMP] Use PlatformRefPtr in randomNumber
-        https://bugs.webkit.org/show_bug.cgi?id=46989
+2011-03-04  Gavin Barraclough  <barraclough@apple.com>
 
-        Use PlatformRefPtr to free memory automatically.
+        Reviewed by Cameron Zwarich.
 
-        * wtf/RandomNumber.cpp:
-        (WTF::randomNumber):
+        Bug 55815 - Should throw an exception from JSObject::defineOwnProperty if !isExtensible().
 
-2010-10-05  Oliver Hunt  <oliver@apple.com>
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnProperty):
+            Add missing check.
 
-        Reviewed by Darin Adler.
+2011-03-04  Gavin Barraclough  <barraclough@apple.com>
 
-        REGRESSION(r68338): JavaScript error on PowerPC only (crashes on Interpreter built for x86_64)
-        https://bugs.webkit.org/show_bug.cgi?id=46690
+        Rubber stamped by olliej.
 
-        Use the correct register value when initialising the arguments
-        object in the interpreter.  This is covered by existing tests.
+        Bug 54945 - The web page hangs towards the end of page load in Interpreter enabled javascript code in the latest webkit trunk.
 
         * interpreter/Interpreter.cpp:
         (JSC::Interpreter::privateExecute):
+            (1) don't infinite loop.
+            (2) goto 1.
 
-2010-10-04  David Goodwin  <david_goodwin@apple.com>
+2011-03-04  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Oliver Hunt.
+        cmake build fix.
 
-        ARMv7 JIT should take advantage of 2-byte branches to reduce code size
-        https://bugs.webkit.org/show_bug.cgi?id=47007
+        * CMakeLists.txt:
 
-        * assembler/ARMv7Assembler.cpp:
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::computeJumpType):
-        (JSC::ARMv7Assembler::link):
-        (JSC::ARMv7Assembler::canBeJumpT2):
-        (JSC::ARMv7Assembler::canBeJumpT4):
-        (JSC::ARMv7Assembler::linkBX):
-        (JSC::ARMv7Assembler::linkJumpT4):
-        (JSC::ARMv7Assembler::linkJumpT2):
-        (JSC::ARMv7Assembler::linkJumpAbsolute):
+2011-03-04  Adam Barth  <abarth@webkit.org>
 
-2010-10-04  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+        Reviewed by Dimitri Glazkov.
 
-        Reviewed by Antonio Gomes.
+        Add Copy Files step to JavaScriptCore GYP build for apitest and minidom
+        https://bugs.webkit.org/show_bug.cgi?id=55798
 
-        [EFL] Use fast malloc for WebKit EFL
-        https://bugs.webkit.org/show_bug.cgi?id=46691
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
 
-        Use fast malloc for WebKit EFL because the fast malloc is to allocate
-        memory quickly.
+2011-03-04  Adam Barth  <abarth@webkit.org>
 
-        * wtf/CMakeListsEfl.txt:
+        Reviewed by Dimitri Glazkov.
 
-2010-10-04  Oliver Hunt  <oliver@apple.com>
+        Remove unneeded round-trips through ../Source in the Chromium GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=55795
 
-        Reviewed by Geoff Garen.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
 
-        Lazily create activation objects
-        https://bugs.webkit.org/show_bug.cgi?id=47107
+2011-03-04  Adam Barth  <abarth@webkit.org>
 
-        Make it possible to lazily create the activation object
-        for a function that needs one.  This allows us to reduce
-        the overhead of entering a function that may require
-        an activation in some cases, but not always.
+        Reviewed by Dimitri Glazkov.
 
-        This does make exception handling a little more complex as
-        it's now necessary to verify that a callframes activation
-        has been created, and create it if not, in all of the
-        paths used in exception handling.
+        Use target_defaults to reduce boilerplate in GYP build system
+        https://bugs.webkit.org/show_bug.cgi?id=55790
 
-        We also need to add logic to check for the existence of
-        the activation in the scoped_var opcodes, as well as
-        op_ret, op_ret_object_or_this and op_tearoff_activation
-        so that we can avoid creating an activation unnecesarily
-        on function exit. 
+        Instead of setting up the configuration in each target, just defer to
+        target_defaults.  Also, removed a define that was redundant with the
+        xcconfig.
 
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
-        (JSC::CodeBlock::createActivation):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::setActivationRegister):
-        (JSC::CodeBlock::activationRegister):
-        * bytecode/Opcode.h:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitNewFunctionInternal):
-        (JSC::BytecodeGenerator::emitNewFunctionExpression):
-        (JSC::BytecodeGenerator::createActivationIfNecessary):
-        * bytecompiler/BytecodeGenerator.h:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::resolveSkip):
-        (JSC::Interpreter::resolveGlobalDynamic):
-        (JSC::Interpreter::resolveBase):
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JIT.h:
-        * jit/JITCall32_64.cpp:
-        (JSC::JIT::emit_op_ret):
-        (JSC::JIT::emit_op_ret_object_or_this):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_end):
-        (JSC::JIT::emit_op_get_scoped_var):
-        (JSC::JIT::emit_op_put_scoped_var):
-        (JSC::JIT::emit_op_tear_off_activation):
-        (JSC::JIT::emit_op_ret):
-        (JSC::JIT::emit_op_ret_object_or_this):
-        (JSC::JIT::emit_op_create_activation):
-        (JSC::JIT::emit_op_resolve_global_dynamic):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_get_scoped_var):
-        (JSC::JIT::emit_op_put_scoped_var):
-        (JSC::JIT::emit_op_tear_off_activation):
-        (JSC::JIT::emit_op_create_activation):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
+        * gyp/JavaScriptCore.gyp:
 
-2010-10-04  Adam Barth  <abarth@webkit.org>
+2011-03-03  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Remove ENABLE_SANDBOX
-        https://bugs.webkit.org/show_bug.cgi?id=47032
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2010-10-01  Pratik Solanki  <psolanki@apple.com>
-
-        Reviewed by Geoffrey Garen.
-        Specify ALWAYS_INLINE at function declaration not function definition
-        https://bugs.webkit.org/show_bug.cgi?id=46960
-
-        For functions defined with ALWAYS_INLINE, add the attribute to the declaration as well.
-
-        * bytecompiler/BytecodeGenerator.h:
-        * wtf/FastMalloc.cpp:
-
-2010-10-01  Kwang Yul Seo  <skyul@company100.net>
-
-        Unreviewed.
-
-        [BREWMP] Change Collector BLOCK_SIZE to 64KB
-        https://bugs.webkit.org/show_bug.cgi?id=46436
+        Bug 55736 - Implement seal/freeze/preventExtensions for normal object types.
+        Provide basic functionallity from section 15.2.4 of ECMA-262.
+        This support will need expanding to cover arrays, too.
 
-        Lower BLOCK_SIZE to 64KB because Brew MP runs on low end devices.
+        Shows a 0.5% progression on SunSpidey, this seems to be due to changing
+        ObjectConstructor to use a static table.
 
-        * runtime/Collector.h:
+        * DerivedSources.make:
+        * JavaScriptCore.exp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::objectConstructorTable):
+            Add a static table for ObjectConstructor.
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+            Add a static table for ObjectConstructor.
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+            Add a static table for ObjectConstructor.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+            Transition the object's structure.
+        (JSC::JSObject::defineOwnProperty):
+            Check isExtensible.
+        * runtime/JSObject.h:
+        (JSC::JSObject::isSealed):
+        (JSC::JSObject::isFrozen):
+        (JSC::JSObject::isExtensible):
+            These wrap method on structure.
+        (JSC::JSObject::putDirectInternal):
+            Check isExtensible.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::ObjectConstructor::getOwnPropertySlot):
+        (JSC::ObjectConstructor::getOwnPropertyDescriptor):
+            Change ObjectConstructor to use a static table.
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorPreventExtensions):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::objectConstructorIsExtensible):
+            Add new methods on Object.
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+            init/propagate  m_preventExtensions
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+            transition the structure, materializing the property map, setting m_preventExtensions & changing attributes.
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+            check attributes to detect if object is sealed/frozen.
+        * runtime/Structure.h:
+        (JSC::Structure::isExtensible):
+            checks the m_preventExtensions flag.
 
-2010-10-01  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+2011-03-04  Steve Falkenburg  <sfalken@apple.com>
 
-        Reviewed by Andreas Kling.
+        Reviewed by Jon Honeycutt.
 
-        [Qt] Stack overflow on symbian platform.
-        https://bugs.webkit.org/show_bug.cgi?id=40598
+        Adopt VersionStamper tool for Windows WebKit DLLs
+        https://bugs.webkit.org/show_bug.cgi?id=55784
+        <rdar://problem/9021273>
         
-        Move big allocation in arrayProtoFuncToString from stack to heap.
-        JSC::arrayProtoFuncToString function can be called recursivly and
-        1K allocation on stack cahse stack overflow.
-        Can be useful for other platforms with limited stack size.
-
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncToString):
-
-2010-09-30  Kwang Yul Seo  <skyul@company100.net>
+        We now use a tool to stamp the version number onto the Apple WebKit DLLs
+        during the post-build step.
 
-        Reviewed by Kent Tamura.
-
-        [BREWMP] Add a factory function which returns an instance wrapped in PlatformRefPtr.
-        https://bugs.webkit.org/show_bug.cgi?id=46373
-
-        A Brew MP instance has reference count 1 when it is created, so call adoptPlatformRef
-        to wrap the instance in PlatformRefPtr.
-
-        * wtf/brew/ShellBrew.h:
-        (WTF::createRefPtrInstance):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd:
 
-2010-09-30  Kwang Yul Seo  <skyul@company100.net>
+2011-03-04  Adam Barth  <abarth@webkit.org>
 
-        Reviewed by Kent Tamura.
+        Reviewed by Dimitri Glazkov.
 
-        [BREWMP] Port PlatformRefPtr
-        https://bugs.webkit.org/show_bug.cgi?id=46370
+        JavaScriptCore GYP build should use a header map
+        https://bugs.webkit.org/show_bug.cgi?id=55712
 
-        Implement refPlatformPtr and derefPlatformPtr to use PlatformRefPtr in Brew MP.
+        This patch moves the os-win32 files into their own variable so that we
+        can use a header map in the Apple Mac Xcode build.  The problem is that
+        the header map searches the whole project rather than just the files
+        included in a given target.  Another solution to this problem is to
+        make GYP smarter about filtering out what files are added to the
+        project file.
 
-        * wtf/brew/RefPtrBrew.h: Added.
-        (WTF::refPlatformPtr):
-        (WTF::derefPlatformPtr):
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
 
-2010-09-29  Sam Weinig  <sam@webkit.org>
+2011-03-03  Ryosuke Niwa  <rniwa@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Add additional checks to StringBuffer.
-        <rdar://problem/7756381>
-
-        * wtf/text/StringBuffer.h:
-        (WTF::StringBuffer::StringBuffer):
-        (WTF::StringBuffer::resize):
-
-2010-09-30  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Simon Fraser.
-
-        Make 2D accelerated canvas rendering build on Mac
-        https://bugs.webkit.org/show_bug.cgi?id=46007
-        
-        Added ACCELERATED_2D_CANVAS to FeatureDefines
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2010-09-30  Kevin Ollivier  <kevino@theolliviers.com>
-
-        [wx] wxMSW build fix. Make sure we copy the compiler flags and remove exception handling from
-        the copy so as not to alter global settings.
-
-        * wscript:
-
-2010-09-30  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Gavin Barraclough.
-
-        The case-insensitivity backreference checking isn't working with YARR
-        Interpreter
-        https://bugs.webkit.org/show_bug.cgi?id=46882
-
-        Add ignorecase checking to the Interpreter::tryConsumeBackReference() function.
-
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::Interpreter::tryConsumeBackReference):
-
-2010-09-30  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Andreas Kling.
-
-        [BREWMP] Leave initializeRandomNumberGenerator empty.
-        https://bugs.webkit.org/show_bug.cgi?id=46851
-
-        On Brew MP, AEECLSID_RANDOM initializes itself.
-
-        * wtf/RandomNumberSeed.h:
-        (WTF::initializeRandomNumberGenerator):
-
-2010-09-30  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Csaba Osztrogonác.
-
-        Remove unnecessary cacheFlush calls from Thumb-2
-        https://bugs.webkit.org/show_bug.cgi?id=46702
-
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::relinkCall):
-        (JSC::ARMv7Assembler::repatchInt32):
-        (JSC::ARMv7Assembler::repatchPointer):
-
-2010-09-29  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed.
-
-        Next try to fix cygwin build.
-
-        * wtf/Assertions.cpp:
-
-2010-09-29  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed.
-
-        Build fix for cygwin #2. It's OS(WINDOWS), not OS(WIN).
-
-        * wtf/Assertions.cpp:
-
-2010-09-29  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed.
-
-        Build fix for cygwin.
-
-        * wtf/Assertions.cpp:
-
-2010-09-29  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Andreas Kling.
-
-        [WINCE] Buildfix for Assertions.cpp after r68511.
-        https://bugs.webkit.org/show_bug.cgi?id=46807
-
-        Some, but not all WinCE environments have support for IsDebuggerPresent().
-        Add HAVE(ISDEBUGGERPRESENT) to make this a build option.
-        HAVE(ISDEBUGGERPRESENT) will be 1 for all OS(WIN) by default.
-
-        * wtf/Assertions.cpp:
-        * wtf/Platform.h:
+        Remove LOOSE_PASS_OWN_ARRAY_PTR from PassOwnArrayPtr.h
+        https://bugs.webkit.org/show_bug.cgi?id=55554
 
-2010-09-29  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Csaba Osztrogonác.
-
-        JSC compile fails on 32bit platform when Regexp Tracing is enabled
-        https://bugs.webkit.org/show_bug.cgi?id=46713
-
-        Fix the cast of pointer in regexp tracing to avoid the warning.
-
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::match):
-
-2010-09-28  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Begin hooking up painting in the plug-in process
-        https://bugs.webkit.org/show_bug.cgi?id=46766
-
-        * JavaScriptCore.exp:
-        Add tryFastRealloc, used by WebKit2.
-
-2010-09-28  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Martin Robinson.
-
-        Guard GRefPtr/GOwnPtr files with ENABLE(GLIB_SUPPORT)
-        https://bugs.webkit.org/show_bug.cgi?id=46721
-
-        Enable GOwnPtr/GRefPtr build only if glib support has been
-        explicitly enabled using the WTF_ENABLE_GLIB_SUPPORT macro.
-
-        * wtf/gobject/GOwnPtr.cpp:
-        * wtf/gobject/GOwnPtr.h:
-        * wtf/gobject/GRefPtr.cpp:
-        * wtf/gobject/GRefPtr.h:
-
-2010-09-28  İsmail Dönmez  <ismail@namtrac.org>
-
-        Reviewed by Andreas Kling.
-
-        Test for WINCE instead of WINCEBASIC, compiler always defines WINCE.
-        Remove reference to unexisting path JavaScriptCore/os-wince.
-
-        * JavaScriptCore.pri:
-        * wtf/Assertions.cpp:
-
-2010-09-27  Michael Saboff  <msaboff@apple.com>
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::copyGlobalsTo): Pass nullptr instead of 0.
+        (JSC::JSGlobalObject::resizeRegisters): Ditto; also use OwnArrayPtr instead of a raw pointer.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::addStaticGlobals): Ditto.
+        * wtf/PassOwnArrayPtr.h: Removed #define LOOSE_PASS_OWN_ARRAY_PTR
+        (WTF::PassOwnArrayPtr::PassOwnArrayPtr): Added a constructor that takes nullptr_t.
 
-        Reviewed by Geoffrey Garen.
+2011-03-03  Adam Barth  <abarth@webkit.org>
 
-        Changed the initialization of JSArray objects to have space for 
-        3 elements for the constructor that takes a ArgList argument.
-        This improves v8-deltablue performance by about 2.8% by reducing 
-        the number of realloc() calls.
-        https://bugs.webkit.org/show_bug.cgi?id=46664
+        Reviewed by Dimitri Glazkov.
 
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::JSArray):
+        Add jsc to JavaScriptCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=55711
 
-2010-09-27  Gavin Barraclough  <barraclough@apple.com>
+        * JavaScriptCore.gypi:
+            - Move jsc.cpp into jsc_files because it's really part of the jsc
+              target.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Remove extraneous files from the normal jsc build.  I probably
+              added these by mistake at some point.
+        * gyp/JavaScriptCore.gyp:
+            - Add the jsc target to the GYP file.
 
-        Reviewed by Darin Adler.
+2011-03-03  Adam Barth  <abarth@webkit.org>
 
-        Bug 46680 - Inlining string concatenation can regress interpreter performance
-        <rdar://problem/8362752> REGRESSION: ~6.4% sunspider regression in interpreter
-        Do not inline calls to string concatenation in the interpret loop.
+        Reviewed by Dimitri Glazkov.
 
-        * interpreter/Interpreter.cpp:
-        (JSC::concatenateStrings):
-        (JSC::Interpreter::privateExecute):
+        Add testapi to JavaScriptCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=55707
 
-2010-09-27  Anders Carlsson  <andersca@apple.com>
+        The new testapi target is slightly incomplete.  There's a resource
+        copying step that we don't quite have yet.
 
-        Fix thinko.
+        This patch also cleans up some of the configuration issues in
+        JavaScriptCore.xcodeproj.  It seems kind of wordy to repeat these for
+        each target.  I suspect there's a more compact way of defining the
+        configurations, but this removes the "Default" configuration, which is
+        progress.
 
-        * runtime/JSCell.h:
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
 
-2010-09-27  Anders Carlsson  <andersca@apple.com>
+2011-03-03  Adam Barth  <abarth@webkit.org>
 
-        Reviewed by Adam Roben.
+        Reviewed by Eric Seidel.
 
-        Try to fix Windows build.
+        Teach JavaScriptCore GYP build about private headers
+        https://bugs.webkit.org/show_bug.cgi?id=55532
 
-        * runtime/JSCell.h:
-        (JSC::MSVCBugWorkaround::MSVCBugWorkaround):
-        (JSC::MSVCBugWorkaround::~MSVCBugWorkaround):
+        This patch distinguishes between public and private framework headers
+        so that public headers are copied into the Headers directory and
+        private headers are copied into the PrivateHeaders directory.
 
-2010-09-27  Erik Arvidsson  <arv@chromium.org>
+        * gyp/JavaScriptCore.gyp:
 
-        Reviewed by Darin Adler.
+2011-03-03  Geoffrey Garen  <ggaren@apple.com>
 
-        Add operator == for AtomicString and Vector<Uchar>
-        https://bugs.webkit.org/show_bug.cgi?id=46509
+        Rolled out 80277 and 80280 because they caused event handler layout test
+        failures.
 
         * JavaScriptCore.exp:
-        * wtf/text/AtomicString.cpp:
-        (WTF::operator==):
-        * wtf/text/AtomicString.h:
-        (WTF::operator==):
-        (WTF::operator!=):
-
-2010-09-27  Anders Carlsson  <andersca@apple.com>
-
-        Try to fix the Windows build.
-
-        * wtf/Noncopyable.h:
-
-2010-09-26  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Alexey Proskuryakov and Adam Barth.
-
-        Add WTF_MAKE_NONCOPYABLE macro
-        https://bugs.webkit.org/show_bug.cgi?id=46589
-
-        Going forward, we'd like to get rid of the Noncopyable and FastAllocBase classes. The
-        reason for this is that the Itanium C++ ABI states that no empty classes of the same type
-        can be laid out at the same offset in the class. This can result in objects getting larger
-        which leads to memory regressions. (One example of this is the String class which grew by
-        sizeof(void*) when both its base class and its first member variable inherited indirectly
-        from FastAllocBase).
-
-        * wtf/Noncopyable.h:
-        Add a WTF_MAKE_NONCOPYABLE macro and get rid of NoncopyableCustomAllocated.
-        
-        * runtime/JSCell.h:
-        * wtf/RefCounted.h:
-        Don't inherit from NoncopyableCustomAllocated. Instead, use WTF_MAKE_NONCOPYABLE.
-
-2010-09-27  Philippe Normand  <pnormand@igalia.com>
-
-        Reviewed by Martin Robinson.
-
-        [GTK] use ENABLE(GLIB_SUPPORT)
-        https://bugs.webkit.org/show_bug.cgi?id=46630
-
-        * wtf/Platform.h: Include GTypedefs.h only if glib support
-        is explicitly enabled.
-
-2010-09-25  Holger Hans Peter Freyther  <holger@moiji-mobile.com>
-
-        Reviewed by Adam Barth.
-
-        jsc: Document the strcat opcode.
-        https://bugs.webkit.org/show_bug.cgi?id=46571
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-
-2010-09-21  Holger Hans Peter Freyther  <holger@moiji-mobile.com>
-
-        Reviewed by Adam Barth.
-
-        make-bytecode-docs.pl: Add a comment to the generated HTML
-        https://bugs.webkit.org/show_bug.cgi?id=46570
-
-        Generate an HTML Comment that this file was generated from
-        Interpreter.cpp with the make-bytecode-docs.pl script.
-
-        * docs/make-bytecode-docs.pl:
-
-2010-09-27  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Remove WTF::stringHash functions
-        https://bugs.webkit.org/show_bug.cgi?id=46520
-
-        Since r68289 the stringHash functions are only wrappers around StringHasher::createHash.
-        So use StringHasher::createHash directly and remove stringHash.
-
-        * wtf/StringHashFunctions.h:
-        * wtf/text/StringImpl.h:
-        (WTF::StringImpl::computeHash): Use WTF::StringHasher::createHash directly.
-
-2010-09-26  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Add WTF::StringHasher::createBlobHash
-        https://bugs.webkit.org/show_bug.cgi?id=46514
-
-        Add this function for hashing FormElementKey and QualifiedNameComponents.
-
-        * wtf/StringHashFunctions.h:
-        (WTF::StringHasher::createBlobHash):
-
-2010-09-26  Patrick Gansterer  <paroga@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        REGRESSION (r68289): Assertion failure in StringHasher::addCharacter() (ch != invalidCharacterValue)
-        running websocket/tests/bad-sub-protocol-non-ascii.html
-        https://bugs.webkit.org/show_bug.cgi?id=46553
-
-        Because we use StringHasher for binary data too, so the check for invalid unicode input is wrong.
-        Add an additional member variable to indicate if we have an pending character
-        instead of only using an invalid character for this purpose.
-
-        * wtf/StringHashFunctions.h:
-        (WTF::StringHasher::StringHasher):
-        (WTF::StringHasher::addCharacters):
-        (WTF::StringHasher::addCharacter):
-        (WTF::StringHasher::hash):
-
-2010-09-26  Mark Hahnenberg  <mhahnenb@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        valueOf called in wrong order in atan2 and date constructors.
-        https://bugs.webkit.org/show_bug.cgi?id=26978
-
-        Fixed the bug where the arguments to atan2 were being evaluated 
-        out of order.
-
-        * runtime/MathObject.cpp:
-        (JSC::mathProtoFuncATan2):
-
-2010-09-26  Mark Hahnenberg  <mhahnenb@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        valueOf called in wrong order in atan2 and date constructors.
-        https://bugs.webkit.org/show_bug.cgi?id=26978
-
-        Fixed the issue where the parameters to the Date constructor
-        were being evaluated to numbers more than once.
-
-        * runtime/DateConstructor.cpp:
-        (JSC::constructDate):
-        (JSC::dateUTC):
-
-2010-09-25  Oliver Hunt  <oliver@apple.com>
-
-        Fix various builds
-
-        Relearning the lesson that last minute changes are bad.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitGetArgumentsLength):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emitSlow_op_get_argument_by_val):
-
-2010-09-25  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Avoid constructing arguments object when accessing length and index properties
-        https://bugs.webkit.org/show_bug.cgi?id=46572
-
-        Add opcodes to read argument length and properties, and then implement them.
-        Much like other lazy opcodes these opcodes take a fast path when the arguments
-        object has not been instantiated, and fall back on generic access mechanisms
-        if they are acting on an instantiated object.
-
-        3% win on v8-earleyboyer, no change elsewhere.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * bytecode/Opcode.h:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitGetArgumentsLength):
-        (JSC::BytecodeGenerator::emitGetArgumentByVal):
-        * bytecompiler/BytecodeGenerator.h:
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::BracketAccessorNode::emitBytecode):
-        (JSC::DotAccessorNode::emitBytecode):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        * jit/JIT.h:
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_get_arguments_length):
-        (JSC::JIT::emitSlow_op_get_arguments_length):
-        (JSC::JIT::emit_op_get_argument_by_val):
-        (JSC::JIT::emitSlow_op_get_argument_by_val):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_get_arguments_length):
-        (JSC::JIT::emitSlow_op_get_arguments_length):
-        (JSC::JIT::emit_op_get_argument_by_val):
-        (JSC::JIT::emitSlow_op_get_argument_by_val):
-
-2010-09-25  Patrick Gansterer  <paroga@webkit.org>
-
-        Unreviewed.
-
-        Fix typo in StringHasher class
-        https://bugs.webkit.org/show_bug.cgi?id=45970
-
-        * wtf/StringHashFunctions.h:
-        (WTF::StringHasher::createHash):
-
-2010-09-24  Patrick Gansterer  <paroga@paroga.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Add WTF::StringHasher
-        https://bugs.webkit.org/show_bug.cgi?id=45970
-
-        StringHasher is a class for calculation stringHash out of character string.
-        This class will unify the different usages of the same algorithm.
-
-        * wtf/StringHashFunctions.h:
-        (WTF::StringHasher::StringHasher):
-        (WTF::StringHasher::addCharacters):
-        (WTF::StringHasher::addCharacter):
-        (WTF::StringHasher::hash):
-        (WTF::StringHasher::createHash):
-        (WTF::StringHasher::defaultCoverter):
-        (WTF::StringHasher::addCharactersToHash):
-        (WTF::stringHash):
-
-2010-09-24  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Variable declarations inside a catch scope don't get propogated to the parent scope
-        https://bugs.webkit.org/show_bug.cgi?id=46501
-
-        Add logic to make variable declaration look for a scope for the
-        new variable.  This allows us to create a scope (eg. for catch)
-        and then seal it, so that additional variable declarations
-        contained are propogated to the correct target.  Strangely this
-        comes out as a performance win, but I think it's mostly cache
-        effects.
-
-        * parser/JSParser.cpp:
-        (JSC::JSParser::Scope::Scope):
-        (JSC::JSParser::Scope::preventNewDecls):
-        (JSC::JSParser::Scope::allowsNewDecls):
-        (JSC::JSParser::declareVariable):
-        (JSC::JSParser::parseVarDeclarationList):
-        (JSC::JSParser::parseConstDeclarationList):
-        (JSC::JSParser::parseTryStatement):
-        (JSC::JSParser::parseFormalParameters):
-        (JSC::JSParser::parseFunctionDeclaration):
-
-2010-09-24  İsmail Dönmez  <ismail@namtrac.org>
-
-       Reviewed by Csaba Osztrogonác.
-
-       Add a Windows compatible inttypes.h header to fix WinCE build.
-       https://bugs.webkit.org/show_bug.cgi?id=46463
-
-       * os-win32/inttypes.h: Added.
-
-2010-09-24  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        REGRESSION(r68223): It broke 2-3 tests on bots (Requested by Ossy on #webkit).
-        https://bugs.webkit.org/show_bug.cgi?id=46448
-
-        Roll this back in, with additional logic to prevent us from delaying construction
-        of functions named "arguments"
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * bytecode/Opcode.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
         * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitInitLazyRegister):
-        (JSC::BytecodeGenerator::registerFor):
-        (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
-        (JSC::BytecodeGenerator::constRegisterFor):
-        (JSC::BytecodeGenerator::emitNewFunction):
-        (JSC::BytecodeGenerator::emitLazyNewFunction):
-        (JSC::BytecodeGenerator::emitNewFunctionInternal):
-        * bytecompiler/BytecodeGenerator.h:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JIT.h:
         * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_init_lazy_reg):
-        (JSC::JIT::emit_op_new_func):
         * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_init_lazy_reg):
-        * parser/Nodes.h:
-        (JSC::ScopeNode::needsActivationForMoreThanVariables):
-
-2010-09-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+        * runtime/Arguments.h:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSVariableObject.h:
+        * runtime/MarkedSpace.cpp:
+        * runtime/MarkedSpace.h:
 
-        Unreviewed, rolling out r68223.
-        http://trac.webkit.org/changeset/68223
-        https://bugs.webkit.org/show_bug.cgi?id=46448
+2011-03-03  Kevin Ollivier  <kevino@theolliviers.com>
 
-        It broke 2-3 tests on bots (Requested by Ossy on #webkit).
+        [wx] Build fix. Alter order of headers included to make sure windows.h
+        is configured by wx, and skip Posix implementation file we don't use on Win.
 
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * bytecode/Opcode.h:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::registerFor):
-        (JSC::BytecodeGenerator::constRegisterFor):
-        (JSC::BytecodeGenerator::emitNewFunction):
-        * bytecompiler/BytecodeGenerator.h:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JIT.h:
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_new_func):
-        (JSC::JIT::emit_op_init_arguments):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_new_func):
-        (JSC::JIT::emit_op_init_arguments):
-        * parser/Nodes.h:
+        * wscript:
+        * wtf/wx/StringWx.cpp:
 
-2010-09-23  Oliver Hunt  <oliver@apple.com>
+2011-03-03  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Geoffrey Garen.
 
-        Delay construction of functions that aren't captured
-        https://bugs.webkit.org/show_bug.cgi?id=46433
+        JSVariableObject needs to use WriteBarrier for symboltable property storage
+        https://bugs.webkit.org/show_bug.cgi?id=55698
 
-        If a function isn't captured by an activation there's no
-        way it can be accessed indirectly, so we can delay the
-        construction until it's used (similar to what we do with
-        arguments).  We rename the existing op_init_arguments to
-        op_init_lazy_reg and removed its implicit handling of
-        the anonymous argument register, and make op_new_function
-        take a parameter to indicate whether it should null check
-        the target slot before creating the function object.
+        Replace the direct usage of Register in JSVariableObject (and descendents)
+        with WriteBarrier.  This requires updating the Arguments object to use
+        WriteBarrier as well.
 
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * bytecode/Opcode.h:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitInitLazyRegister):
-        (JSC::BytecodeGenerator::registerFor):
-        (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
-        (JSC::BytecodeGenerator::constRegisterFor):
-        (JSC::BytecodeGenerator::emitNewFunction):
-        (JSC::BytecodeGenerator::emitLazyNewFunction):
-        (JSC::BytecodeGenerator::emitNewFunctionInternal):
-        * bytecompiler/BytecodeGenerator.h:
         * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
         (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JIT.h:
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_init_lazy_reg):
-        (JSC::JIT::emit_op_new_func):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_init_lazy_reg):
-        * parser/Nodes.h:
-        (JSC::ScopeNode::needsActivationForMoreThanVariables):
-
-2010-09-23  David Kilzer  <ddkilzer@apple.com>
-
-        <rdar://problem/8460731> ~9.9% speedup when compiling interpreter with llvm-gcc-4.2
-        https://bugs.webkit.org/show_bug.cgi?id=46423
-
-        Reviewed by Oliver Hunt.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute): Disable the gcc computed
-        goto hacks added in r55564 when compiling with llvm-gcc-4.2.
-
-2010-09-23  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
-
-        Reviewed by Darin Adler.
-
-        Fix usage of enum as if it was a define
-        https://bugs.webkit.org/show_bug.cgi?id=46355
-
-        pthread.h defines PTHREAD_MUTEX_DEFAULT and PTHREAD_MUTEX_NORMAL as an
-        enum.  Hence, it cannot be used by the preprocessor which always
-        evaluates that condition as true. This was giving a warning when
-        compiling with gcc and "-Wundef" flag.
-
-        The second path, when PTHREAD_MUTEX_DEFAULT is not the same of
-        PTHREAD_MUTEX_NORMAL, is not slow. So, let's eliminate the first path
-        and get rid of that #if.
-
-        * wtf/ThreadingPthreads.cpp: Always call pthread_mutexattr_init() to
-        set mutex type to PTHREAD_MUTEX_NORMAL.
-        (WTF::Mutex::Mutex):
-
-2010-09-23  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Removed extraneous truncation of ovector on entry and error exit.
-        Changed the initialization to -1 of vector to only initialize
-        the start indecies, which is sufficient for the pattern/subpatterns.
-        Changed the JIT code to not clear the end index for subpatterns
-        as it isn't needed.  These changes are worth ~2.7% on v8-regexp.
-        https://bugs.webkit.org/show_bug.cgi?id=46404
-
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::match):
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
-
-2010-09-22  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Only copy captured variables into activation
-        https://bugs.webkit.org/show_bug.cgi?id=46330
-
-        We now track free variable information which means that
-        we no longer need to copy every variable defined in a
-        function.  With this patch activations only retain those
-        variables needed for correctness.  In order to interact
-        safely with the inspector this means that JSActivation
-        now provides its own lookup functions so it can avoid 
-        trying to read or write to variables that have been
-        optimised out.
-
-        * bytecode/CodeBlock.h:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        * parser/Nodes.h:
-        (JSC::ScopeNode::capturedVariableCount):
-        (JSC::ScopeNode::captures):
+        (JSC::Interpreter::retrieveArguments):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::initialize):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::copyToRegisters):
+        (JSC::Arguments::fillArgList):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
         * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::copyRegisters):
         (JSC::JSActivation::copyRegisters):
-        * runtime/Executable.cpp:
-        (JSC::FunctionExecutable::FunctionExecutable):
-        (JSC::FunctionExecutable::compileForCallInternal):
-        (JSC::FunctionExecutable::compileForConstructInternal):
-        * runtime/Executable.h:
-        (JSC::FunctionExecutable::capturedVariableCount):
         * runtime/JSActivation.cpp:
         (JSC::JSActivation::markChildren):
         (JSC::JSActivation::symbolTableGet):
         (JSC::JSActivation::symbolTablePut):
-        (JSC::JSActivation::getOwnPropertyNames):
         (JSC::JSActivation::symbolTablePutWithAttributes):
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        (JSC::JSActivation::argumentsGetter):
         * runtime/JSActivation.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::markChildren):
+        (JSC::JSGlobalObject::copyGlobalsFrom):
+        (JSC::JSGlobalObject::copyGlobalsTo):
+        (JSC::JSGlobalObject::resizeRegisters):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::setRegisters):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+        (JSC::JSStaticScopeObject::putWithAttributes):
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::symbolTableGet):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::registerAt):
+        (JSC::JSVariableObject::JSVariableObjectData::JSVariableObjectData):
+        (JSC::JSVariableObject::symbolTableGet):
+        (JSC::JSVariableObject::symbolTablePut):
+        (JSC::JSVariableObject::symbolTablePutWithAttributes):
+        (JSC::JSVariableObject::copyRegisterArray):
+        (JSC::JSVariableObject::setRegisters):
 
-2010-09-23  Ismail Donmez  <ismail@namtrac.org>
-
-        Reviewed by Andreas Kling.
-
-        Fix jsc.exe build for Windows CE
-
-        * jsc.pro: Add mmtimer.lib for Windows CE.
-
-2010-09-23  Ismail Donmez  <ismail@namtrac.org>
-
-        Unreviewed.
-
-        JIT should be disabled on Windows CE. Broken in r64176.
-
-        * wtf/Platform.h:
-
-2010-09-23  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Gavin Barraclough.
-
-        Reduce the number of BOL checks in YARR Interpreter
-        https://bugs.webkit.org/show_bug.cgi?id=46260
-
-        Extend the YARR Interpreter with an optimization which reduces the number of
-        BOL assertion checks. If a "TypeBodyAlternative" byteTerm is followed by a
-        "TypeAssertionBOL" byteTerm it will be checked just one time.
-
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::Interpreter::matchDisjunction):
-        (JSC::Yarr::ByteCompiler::compile):
-        (JSC::Yarr::ByteCompiler::regexBegin):
-        (JSC::Yarr::ByteCompiler::alternativeBodyDisjunction):
-        (JSC::Yarr::ByteCompiler::emitDisjunction):
-        * yarr/RegexInterpreter.h:
-        (JSC::Yarr::ByteTerm::BodyAlternativeBegin):
-        (JSC::Yarr::ByteTerm::BodyAlternativeDisjunction):
-        (JSC::Yarr::ByteTerm::BodyAlternativeEnd):
-        (JSC::Yarr::ByteTerm::AlternativeBegin):
-        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
-        (JSC::Yarr::ByteTerm::AlternativeEnd):
-
-2010-09-22  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Fixed the cross over from alternatives executed once and
-        those that loop.  This fixed the problem where the index
-        was getting messed up for looping alternatives causing an
-        infinite loop.
-        https://bugs.webkit.org/show_bug.cgi?id=46189
-
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::generateDisjunction):
-
-2010-09-22  Steve Falkenburg  <sfalken@apple.com>
-
-        Rubber stamped by Jon Honeycutt.
-
-        Allow jsc.exe to be run against unversioned ICU.
-
-        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
-
-2010-09-22  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Laszlo Gombos.
-
-        Use "typedef wchar_t JSChar" when compiled with RVCT
-        https://bugs.webkit.org/show_bug.cgi?id=40651
-
-        Use wchar_t for JSChar and UChar when compiled with RVCT.
-        Linux is the exception for this rule.
-
-        * API/JSStringRef.h:
-        * wtf/unicode/qt4/UnicodeQt4.h:
-
-2010-09-22  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        [INTERPRETER] Two tests fail with SputnikError: #1.1: if argArray is neither an array nor an arguments object (see 10.1.8), a TypeError exception is thrown
-        https://bugs.webkit.org/show_bug.cgi?id=44245
-
-        Remove incorrect code from op_load_varargs in the interpreter.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-
-2010-09-22  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
+2011-03-03  Geoffrey Garen  <ggaren@apple.com>
 
-        [JIT] fast/js/sputnik/Conformance/15_Native_Objects/15.3_Function/15.3.5/S15.3.5.3_A2_T6.html fails
-        https://bugs.webkit.org/show_bug.cgi?id=44246
+        Try to fix Windows build.
 
-        JIT code generated for instanceof was not checking to ensure that the prototype property was
-        an object, this patch ensures that it does.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed obsolete symbol.
 
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_instanceof):
-        (JSC::JIT::emitSlow_op_instanceof):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_instanceof):
-        (JSC::JIT::emitSlow_op_instanceof):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::getOwnPropertySlot): Don't mark this function
+        inline -- it's virtual.
 
-2010-09-22  Patrick Gansterer  <paroga@webkit.org>
+2011-03-02  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Darin Adler.
 
-        Inline UTF8SequenceLength
-        https://bugs.webkit.org/show_bug.cgi?id=45589
-
-        * wtf/unicode/UTF8.cpp:
-        (WTF::Unicode::convertUTF8ToUTF16): Use inline version of UTF8SequenceLength to improve performance.
-
-2010-09-21  Oliver Hunt  <oliver@apple.com>
-
-        RS=Gavin Barraclough.
+        Moved all variable object storage inline -- upping the object size limit to 1K
+        https://bugs.webkit.org/show_bug.cgi?id=55653
 
-        Fix codeblock dumping
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * runtime/Executable.h:
-        (JSC::ScriptExecutable::ScriptExecutable):
-
-2010-09-21  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Speed up function.apply(..., arguments)
-        https://bugs.webkit.org/show_bug.cgi?id=46207
-
-        Add code to do argument copying inline in the case
-        where we're using Function.apply to forward our arguments
-        directly.
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileSlowCases):
-           Splitted op_load_varargs into fast and slow paths, so add the call
-           to the slow path generator.
-        * jit/JIT.h:
-        * jit/JITCall32_64.cpp:
-          Remove 32bit specific emit_op_load_varargs as the logic is the
-          same for all value representations
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.cpp:
         * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_load_varargs):
-          Copy arguments inline
-        (JSC::JIT::emitSlow_op_load_varargs):
-
-2010-09-21  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/8363003> REGRESSION: ~1.4% sunspider regression in
-        interpreter due to 54724 and 54596
-        
-        Fixed a typo (using "UNLIKELY" instead of "LIKELY").
-        
-        * wtf/PassRefPtr.h:
-        (WTF::refIfNotNull):
-        (WTF::derefIfNotNull): It is likely that m_ptr != 0 because most RefPtrs
-        hold real data. Also, in cases where they do not hold real data, the
-        compiler usually sees a call to release() right before the call to the
-        destructor, so it can probably optimize out the test completely.
-
-2010-09-21  Fridrich Strba  <fridrich.strba@bluewin.ch>
-
-        Reviewed by Martin Robinson.
-
-        Build issues with Windows versions of the GTK+ port
-        https://bugs.webkit.org/show_bug.cgi?id=45844
-
-        Link with winmm.dll when necessary and specify the executable extension
-        explicitely so that the Programs/jsc-@WEBKITGTK_API_MAJOR_VERSION@
-        rule actually works.
-
-        Don't try to build the ThreadSpecificWin.cpp since GTK+ port uses
-        a section in ThreadSpecific.cpp
-
-        * GNUmakefile.am:
-
-2010-09-21  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] 'make dist' should be fixed in preparation for the next release
-        https://bugs.webkit.org/show_bug.cgi?id=46129
-
-        * GNUmakefile.am: Update the sources list to include missing headers.
-
-2010-09-21  Dave Tapuska  <dtapuska@rim.com>
-
-        Reviewed by Csaba Osztrogonác.
-
-        https://bugs.webkit.org/show_bug.cgi?id=45673
-
-        r65596 caused ENABLE_PROFILER_REFERENCE_OFFSET to not be
-        8 byte aligned. A non 8 byte divisible value for this will
-        cause the sp to become non 8 byte aligned.
-
-        Verify and correct offset values that r65596 effected that
-        weren't updated.
-
-        * jit/JITStubs.cpp:
-        * jit/JITStubs.h:
-
-2010-09-21  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Martin Robinson.
-
-        Fix Opcode stats compilation
-        https://bugs.webkit.org/show_bug.cgi?id=46079
-
-        The FixedArray API had changed, and <stdio.h> was not included for
-        printf.
-
-        * bytecode/Opcode.cpp:
-        (JSC::OpcodeStats::~OpcodeStats):
-
-2010-09-20  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Fixed detection of alternative smaller than the first alternative
-        to only check looping alternatives.
-        https://bugs.webkit.org/show_bug.cgi?id=46049
-
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::generateDisjunction):
-
-2010-09-20  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Geoffrey Garen.
-
-        REGRESSION(67790): jsc tests are failed with YARR interpreter
-        https://bugs.webkit.org/show_bug.cgi?id=46083
-
-        Fix the initializing of the lastSubpatternId member of
-        parentheses.
-
-        * yarr/RegexCompiler.cpp:
-        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
-
-2010-09-20  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 46077 - ASSERT failure in YARR JIT
-
-        We will currently attempt to loop if there are multiple alternatives, they are all
-        BOL predicated, and the last alternative is longer then the first - however if all
-        alternatives are BOL predicated the head of loop label will not have been set, and
-        we'll try to link a jump to an undefined label. Stop doing so.
-
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::generateDisjunction):
-
-2010-09-20  Adam Roben  <aroben@apple.com>
-
-        Export RegExpObject::info from JavaScriptCore
-
-        This allows obj->inherits(&RegExpObject::info) to work correctly from
-        outside JavaScriptCore.dll on Windows.
-
-        Fixes <http://webkit.org/b/46098>
-        fast/loader/stateobjects/pushstate-object-types.html fails on Windows
-
-        Reviewed by John Sullivan.
-
-        * runtime/RegExpObject.h: Added JS_EXPORTDATA to the info member, as
-        we already have for some other classes whose info members have to be
-        used from outside the DLL.
-
-2010-09-19  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix pt 2.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/Arguments.h:
+        * runtime/JSActivation.h: Removed out-of-line storage. Changed d-> to m_.
 
-2010-09-19  Gavin Barraclough  <barraclough@apple.com>
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedSpace::sizeClassFor): Added an imprecise size class
+        to accomodate objects up to 1K.
 
-        Windows build fix pt 1.
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h: Removed out-of-line storage. Changed d-> to m_.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSObject.cpp: Don't ASSERT that JSFinalObject fills the maximum
+        object size, since it doesn't anymore.
 
-2010-09-19  Gavin Barraclough  <barraclough@apple.com>
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSVariableObject.h: Removed out-of-line storage. Changed d-> to m_.
 
-        Build fix - implicit double-to-int conversion invalid on 32-bit.
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h: Added an imprecise size class to accomodate objects up to 1K.
 
-        * runtime/DatePrototype.cpp:
-        (JSC::fillStructuresUsingDateArgs):
-        (JSC::dateProtoFuncSetYear):
+2011-03-03  Timothy Hatcher  <timothy@apple.com>
 
-2010-09-19  Gavin Barraclough  <barraclough@apple.com>
+        Make APIShims usable from WebCore.
 
         Reviewed by Oliver Hunt.
 
-        Bug 46065 - Unify implementation of ToInt32 and ToUInt32, don't use fmod.
-
-        These methods implement the same conversion (see discussion in the notes
-        of sections of 9.5 and 9.6 of the spec), only differing in how the result
-        is interpretted.
-
-        Date prototype is incorrectly using toInt32, and this is causing us to
-        provide an output value indicating whether the input to ToInt32 was finite
-        (the corresponding methods on Date are actually spec'ed to use ToInteger,
-        not ToInt32).  This patch partially fixes this in order to remove this
-        bogus output value, hoewever more work will be require to bring Date
-        fully up to spec compliance (the constructor is still performing ToInt32
-        conversions).
-
-        * JavaScriptCore.exp:
-        * runtime/DatePrototype.cpp:
-        (JSC::fillStructuresUsingTimeArgs):
-        (JSC::fillStructuresUsingDateArgs):
-        (JSC::dateProtoFuncSetYear):
-        * runtime/JSValue.cpp:
-        (JSC::toInt32):
-        * runtime/JSValue.h:
-        (JSC::toUInt32):
-        (JSC::JSValue::toInt32):
-        (JSC::JSValue::toUInt32):
-
-2010-09-18  Darin Adler  <darin@apple.com>
-
-        First step in fixing Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        Removed incorrect symbol. The build will probably still fail,
-        but the failure will tell us what symbol to add.
-
-2010-09-18  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Added code to unroll regular expressions containing ^.
-        Alternatives that begin with ^ are tagged during parsing
-        and rolled up in containing sub expression structs.
-        After parsing, a regular expression flagged as containing
-        a ^ (a.k.a. BOL) is processed further in optimizeBOL().
-        A copy of the disjunction is made excluding alternatives that
-        are rooted with BOL.  The original alternatives are flagged
-        to only be executed once.  The copy of the other alternatives are
-        added to the original expression.
-        In the case that all original alternatives are flagged, there
-        won't be any looping alternatives.
-        The JIT generator will emit code accordingly, executing the
-        original alternatives once and then looping over the
-        alternatives that aren't anchored with a BOL (if any).
-        https://bugs.webkit.org/show_bug.cgi?id=45787
-
-        * yarr/RegexCompiler.cpp:
-        (JSC::Yarr::RegexPatternConstructor::assertionBOL):
-        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
-        (JSC::Yarr::RegexPatternConstructor::copyDisjunction):
-        (JSC::Yarr::RegexPatternConstructor::copyTerm):
-        (JSC::Yarr::RegexPatternConstructor::optimizeBOL):
-        (JSC::Yarr::compileRegex):
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::generateDisjunction):
-        * yarr/RegexPattern.h:
-        (JSC::Yarr::PatternAlternative::PatternAlternative):
-        (JSC::Yarr::PatternAlternative::setOnceThrough):
-        (JSC::Yarr::PatternAlternative::onceThrough):
-        (JSC::Yarr::PatternDisjunction::PatternDisjunction):
-        (JSC::Yarr::RegexPattern::RegexPattern):
-        (JSC::Yarr::RegexPattern::reset):
-
-2010-09-18  Patrick Gansterer  <paroga@paroga.com>
-
-        Reviewed by Darin Adler.
-
-        Rename Wince files to WinCE
-        https://bugs.webkit.org/show_bug.cgi?id=37287
-
-        * wtf/unicode/Unicode.h:
-        * wtf/unicode/wince/UnicodeWinCE.cpp: Copied from JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp.
-        * wtf/unicode/wince/UnicodeWinCE.h: Copied from JavaScriptCore/wtf/unicode/wince/UnicodeWince.h.
-        * wtf/unicode/wince/UnicodeWince.cpp: Removed.
-        * wtf/unicode/wince/UnicodeWince.h: Removed.
-        * wtf/wince/FastMallocWinCE.h: Copied from JavaScriptCore/wtf/wince/FastMallocWince.h.
-        * wtf/wince/FastMallocWince.h: Removed.
-
-2010-09-18  Ademar de Souza Reis Jr  <ademar.reis@openbossa.org>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        Enable Platform Strategies on Qt
-
-        [Qt] Turn on PLATFORM_STRATEGIES
-        https://bugs.webkit.org/show_bug.cgi?id=45831
-
-        * wtf/Platform.h: Enable Platform Strategies when building QtWebkit
-
-2010-09-17  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Imprecise tracking of variable capture leads to overly pessimistic creation of activations
-        https://bugs.webkit.org/show_bug.cgi?id=46020
-
-        The old logic for track free and captured variables would cause us
-        to decide we needed an activation in every function along the scope
-        chain between a variable capture and its declaration.  We now track
-        captured variables precisely which requires a bit of additional work
-
-        The most substantial change is that the parsing routine needs to
-        be passed the list of function parameters when reparsing a function
-        as when reparsing we don't parse the function declaration itself only
-        its body.
-
+        * ForwardingHeaders/JavaScriptCore/APIShims.h: Added.
+        * GNUmakefile.am:
         * JavaScriptCore.exp:
-        * parser/JSParser.cpp:
-        (JSC::JSParser::Scope::Scope):
-        (JSC::JSParser::Scope::needsFullActivation):
-           We need to distinguish between use of a feature that requires
-           an activation and eval so we now get this additional flag.
-        (JSC::JSParser::Scope::collectFreeVariables):
-        (JSC::JSParser::Scope::getCapturedVariables):
-           We can't simply return the list of "capturedVariables" now as
-           is insufficiently precise, so we compute them instead.
-        (JSC::JSParser::popScope):
-        (JSC::jsParse):
-        (JSC::JSParser::JSParser):
-        (JSC::JSParser::parseProgram):
-        (JSC::JSParser::parseWithStatement):
-        (JSC::JSParser::parseTryStatement):
-        (JSC::JSParser::parseFunctionInfo):
-        (JSC::JSParser::parseFunctionDeclaration):
-        (JSC::JSParser::parseProperty):
-        (JSC::JSParser::parseMemberExpression):
-        * parser/JSParser.h:
-        * parser/Parser.cpp:
-        (JSC::Parser::parse):
-        * parser/Parser.h:
-        (JSC::Parser::parse):
-        * runtime/Executable.cpp:
-        (JSC::EvalExecutable::compileInternal):
-        (JSC::ProgramExecutable::checkSyntax):
-        (JSC::ProgramExecutable::compileInternal):
-        (JSC::FunctionExecutable::compileForCallInternal):
-        (JSC::FunctionExecutable::compileForConstructInternal):
-        (JSC::FunctionExecutable::reparseExceptionInfo):
-        (JSC::EvalExecutable::reparseExceptionInfo):
-        (JSC::FunctionExecutable::fromGlobalCode):
-           Pass function parameters (if available) to the parser.
-
-2010-09-17  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Add IsFloatingPoint and IsArithmetic type traits
-        https://bugs.webkit.org/show_bug.cgi?id=46018
-
-        * wtf/TypeTraits.h:
-        * wtf/TypeTraits.cpp:
-
-2010-09-17  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Oliver Hunt.
-
-        [GTK] FontPlatformDataFreeType should use smart pointers to hold its members
-        https://bugs.webkit.org/show_bug.cgi?id=45917
-
-        Added support to PlatformRefPtr for handling HashTableDeletedValue.
-
-        * wtf/PlatformRefPtr.h:
-        (WTF::PlatformRefPtr::PlatformRefPtr): Added a constructor that takes HashTableDeletedValue.
-        (WTF::PlatformRefPtr::isHashTableDeletedValue): Added.
-
-2010-09-16  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Crash due to timer triggered GC on one heap while another heap is active
-        https://bugs.webkit.org/show_bug.cgi?id=45932
-        <rdar://problem/8318446>
-
-        The GC timer may trigger for one heap while another heap is active.  This
-        is safe, but requires us to ensure that we have temporarily associated the
-        thread's identifierTable with the heap we're collecting on.  Otherwise we
-        may end up with the identifier tables in an inconsistent state leading to
-        an eventual crash.
-
-        * runtime/Collector.cpp:
-        (JSC::Heap::allocate):
-        (JSC::Heap::reset):
-        (JSC::Heap::collectAllGarbage):
-           Add assertions to ensure we have the correct identifierTable active
-           while collecting.
-        * runtime/GCActivityCallbackCF.cpp:
-        (JSC::DefaultGCActivityCallbackPlatformData::trigger):
-           Temporarily make the expected IdentifierTable active
-        * wtf/WTFThreadData.h:
-        (JSC::IdentifierTable::remove):
-           Make it possible to see when IdentifierTable::remove has succeeded
-        * wtf/text/StringImpl.cpp:
-        (WTF::StringImpl::~StringImpl):
-           CRASH if an StringImpl is an Identifier but isn't present in the
-           active IdentifierTable.  If we get to this state something has
-           gone wrong and we should just crash immediately.
-
-2010-09-16  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] Implement dissolveDragImageToFraction
-        https://bugs.webkit.org/show_bug.cgi?id=45826
-
-        * wtf/gobject/GTypedefs.h: Added forward declarations for GtkWindow and GdkEventExpose.
-
-2010-09-16  Eric Uhrhane  <ericu@chromium.org>
-
-        Reviewed by Jian Li.
-
-        Unify FILE_SYSTEM and FILE_WRITER enables under the name FILE_SYSTEM.
-        https://bugs.webkit.org/show_bug.cgi?id=45798
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2010-09-15  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Use free variable analysis to improve activation performance
-        https://bugs.webkit.org/show_bug.cgi?id=45837
-
-        Adds free and captured variable tracking to the JS parser.  This
-        allows us to avoid construction of an activation object in some
-        cases.  Future patches will make more use of this information to
-        improve those cases where activations are still needed.
-
-        * parser/ASTBuilder.h:
-        * parser/JSParser.cpp:
-        (JSC::JSParser::Scope::Scope):
-        (JSC::JSParser::Scope::declareVariable):
-        (JSC::JSParser::Scope::useVariable):
-        (JSC::JSParser::Scope::collectFreeVariables):
-        (JSC::JSParser::Scope::capturedVariables):
-        (JSC::JSParser::ScopeRef::ScopeRef):
-        (JSC::JSParser::ScopeRef::operator->):
-        (JSC::JSParser::ScopeRef::index):
-        (JSC::JSParser::currentScope):
-        (JSC::JSParser::pushScope):
-        (JSC::JSParser::popScope):
-        (JSC::JSParser::parseProgram):
-        (JSC::JSParser::parseVarDeclarationList):
-        (JSC::JSParser::parseConstDeclarationList):
-        (JSC::JSParser::parseTryStatement):
-        (JSC::JSParser::parseFormalParameters):
-        (JSC::JSParser::parseFunctionInfo):
-        (JSC::JSParser::parseFunctionDeclaration):
-        (JSC::JSParser::parsePrimaryExpression):
-        * parser/Nodes.cpp:
-        (JSC::ScopeNodeData::ScopeNodeData):
-        (JSC::ScopeNode::ScopeNode):
-        (JSC::ProgramNode::ProgramNode):
-        (JSC::ProgramNode::create):
-        (JSC::EvalNode::EvalNode):
-        (JSC::EvalNode::create):
-        (JSC::FunctionBodyNode::FunctionBodyNode):
-        (JSC::FunctionBodyNode::create):
-        * parser/Nodes.h:
-        (JSC::ScopeNode::needsActivation):
-        (JSC::ScopeNode::hasCapturedVariables):
-        * parser/Parser.cpp:
-        (JSC::Parser::didFinishParsing):
-        * parser/Parser.h:
-        (JSC::Parser::parse):
-        * parser/SyntaxChecker.h:
-        * runtime/Executable.cpp:
-        (JSC::EvalExecutable::compileInternal):
-        (JSC::ProgramExecutable::compileInternal):
-        (JSC::FunctionExecutable::compileForCallInternal):
-        (JSC::FunctionExecutable::compileForConstructInternal):
-        * runtime/Executable.h:
-        (JSC::ScriptExecutable::needsActivation):
-        (JSC::ScriptExecutable::recordParse):
-
-2010-09-14  Hyung Song  <beergun@company100.net>
-
-        Reviewed by Kent Tamura.
-
-        [BREWMP] Add IMemGroup and IMemSpace to OwnPtr type.
-        https://bugs.webkit.org/show_bug.cgi?id=44764
-
-        * wtf/OwnPtrCommon.h:
-        * wtf/brew/OwnPtrBrew.cpp:
-        (WTF::deleteOwnedPtr):
-
-2010-09-14  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Sort with non-numeric custom sort function fails on array with length but no values
-        https://bugs.webkit.org/show_bug.cgi?id=45781
-
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::sort): Replaced early exit for an array of length zero to instead
-        exit for any array without values, even if it has a non-0 length.
-
-2010-09-14  Steve Falkenburg  <sfalken@apple.com>
-
-        Windows production build fix.
-        Roll out r65143.
-
+        * JavaScriptCore.gypi:
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
-
-2010-09-14  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Darin Adler.
-
-        Share UnicodeMacrosFromICU.h
-        https://bugs.webkit.org/show_bug.cgi?id=45710
-
-        glib, qt4 and wince use the same macros from ICU.
-        Remove the code duplication and use the same header file.
-
-        * wtf/unicode/UnicodeMacrosFromICU.h: Copied from JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h.
-        * wtf/unicode/glib/UnicodeMacrosFromICU.h: Removed.
-        * wtf/unicode/qt4/UnicodeQt4.h:
-        * wtf/unicode/wince/UnicodeWince.h:
-
-2010-09-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by Adam Barth.
-
-        Preparation for eliminating deprecatedParseURL
-        https://bugs.webkit.org/show_bug.cgi?id=45695
-
-        * wtf/text/WTFString.h: Added isAllSpecialCharacters, moved here from
-        the HTML tree builder.
-
-2010-09-13  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by David Levin.
-
-        Add option to conditionally compile smooth scrolling support.
-        https://bugs.webkit.org/show_bug.cgi?id=45689
-
-        ENABLE(SMOOTH_SCROLLING) is disabled by default for all platforms.
-
-        * wtf/Platform.h:
-
-2010-09-13  Adam Roben  <aroben@apple.com>
-
-        Copy JavaScriptCore's generated sources to the right directory
-
-        * JavaScriptCore.vcproj/JavaScriptCore.make: Fixed typo.
-
-2010-09-13  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Kent Tamura.
-
-        [BREWMP] Don't call _msize
-        https://bugs.webkit.org/show_bug.cgi?id=45556
-
-        Because Brew MP uses its own memory allocator, it is not correct to use
-        _msize in fastMallocSize. Add !PLATFORM(BREWMP) guard.
-
-        * wtf/FastMalloc.cpp:
-        (WTF::fastMallocSize):
-
-2010-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Andreas Kling.
-
-        [Qt] V8 port: webcore project files changes
-        https://bugs.webkit.org/show_bug.cgi?id=45141
-
-        * JavaScriptCore.pro: Moved wtf specific files to wtf.pri,
-        so that they can also be used from WebCore.pro for v8 builds.
-        * wtf/wtf.pri: Added.
-
-2010-09-10  Fridrich Strba  <fridrich.strba@bluewin.ch>
-
-        Reviewed by Andreas Kling.
-
-        Add a define missing when building with glib unicode backend
-        https://bugs.webkit.org/show_bug.cgi?id=45544
-
-        * wtf/unicode/glib/UnicodeMacrosFromICU.h:
-
-2010-09-10  Stephanie Lewis  <slewis@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-        
-        Refactor JavaScriptCore memory statistics so that WebKit doesn't need to know 
-        about the JIT and other implementation details of JavaScriptCore.  Necessary 
-        to fix PPC build.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=45528
-
-        * JavaScriptCore.exp:
         * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/MemoryStatistics.cpp: Added.
-        (JSC::memoryStatistics):
-        * runtime/MemoryStatistics.h: Added.
-
-2010-09-09  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Added a regular expression tracing facility.  This tracing is connected
-        to jsc.  Every compiled regular expression object is added to a list.
-        When the process exits, each regular expression dumps its pattern,
-        JIT address, number of times it was executed and the number of matches.
-        This tracing is controlled by the macro ENABLE_REGEXP_TRACING in
-        wtf/Platform.h.
-        https://bugs.webkit.org/show_bug.cgi?id=45401
-
-        * JavaScriptCore.exp:
-        * jsc.cpp:
-        (runWithScripts):
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        (JSC::JSGlobalData::~JSGlobalData):
-        (JSC::JSGlobalData::addRegExpToTrace):
-        (JSC::JSGlobalData::dumpRegExpTrace):
-        * runtime/JSGlobalData.h:
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::create):
-        (JSC::RegExp::match):
-        * runtime/RegExp.h:
-        * wtf/Platform.h:
-        * yarr/RegexJIT.h:
-        (JSC::Yarr::RegexCodeBlock::getAddr):
-
-2010-09-09  John Therrell  <jtherrell@apple.com>
-
-        32-bit build fix.
-
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutableAllocator::committedByteCount):
-
-2010-09-09  John Therrell  <jtherrell@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Added statistics sampling and reporting for JavaScriptCore's RegisterFile and ExecutableAllocator classes
-        https://bugs.webkit.org/show_bug.cgi?id=45134
-
-        Added thread-safe committed byte counting and reporting functionality to RegisterFile and 
-        ExecutableAllocator.
-
-        * JavaScriptCore.exp:
-        Exported new symbols to allow for WebKit to get statistics from JavaScriptCore classes.
-        
-        * interpreter/RegisterFile.cpp:
-        (JSC::registerFileStatisticsMutex):
-        Added function which returns a static Mutex used for locking during read/write access to
-        static committed byte count variable.
-        (JSC::RegisterFile::~RegisterFile):
-        Added call to addToStatistics since memory is decommitted here.
-        (JSC::RegisterFile::releaseExcessCapacity):
-        Added call to addToStatistics since memory is decommitted here.
-        (JSC::RegisterFile::initializeThreading):
-        Added function which calls registerFileStatisticsMutex().
-        (JSC::RegisterFile::committedByteCount):
-        Added function which returns the current committed byte count for RegisterFile.
-        (JSC::RegisterFile::addToCommittedByteCount):
-        Added function which updates committed byte count.
-        
-        * interpreter/RegisterFile.h:
-        (JSC::RegisterFile::RegisterFile):
-        Added call to addToStatistics since memory is committed here.
-        (JSC::RegisterFile::grow):
-        Added call to addToStatistics since memory is committed here.
-        
-        * jit/ExecutableAllocator.h:
-        Added function prototype for public static function committedByteCount().
-        
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::release):
-        Added call to addToStatistics since memory is decommitted here.
-        (JSC::FixedVMPoolAllocator::reuse):
-        Added call to addToStatistics since memory is committed here.
-        (JSC::FixedVMPoolAllocator::addToCommittedByteCount):
-        Added function which updates committed byte count.
-        (JSC::ExecutableAllocator::committedByteCount):
-        Added function which returns the current committed byte count for ExecutableAllocator.
-        
-        * runtime/InitializeThreading.cpp:
-        (JSC::initializeThreadingOnce):
-        Added call to RegisterFile::initializeThreading.
 
-2010-09-09  Mark Rowe  <mrowe@apple.com>
+2011-03-03  Peter Varga  <pvarga@webkit.org>
 
         Reviewed by Oliver Hunt.
 
-        <http://webkit.org/b/45502> JSObjectSetPrivateProperty does not handle NULL values as it claims
-
-        * API/JSObjectRef.cpp:
-        (JSObjectSetPrivateProperty): Don't call toJS if we have a NULL value as that will cause an assertion
-        failure. Instead map NULL directly to the null JSValue.
-        * API/tests/testapi.c:
-        (main): Add test coverage for the NULL value case.
-
-2010-09-09  Csaba Osztrogonác  <ossy@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        [Qt] JSVALUE32_64 not works on Windows platform with MinGW compiler
-        https://bugs.webkit.org/show_bug.cgi?id=29268
-
-        * wtf/Platform.h: Enable JSVALUE32_64 for Qt/Windows/MinGW, because it works now.
-
-2010-09-08  Zoltan Herczeg  <zherczeg@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Removing doneSemicolon label in the lexer
-        https://bugs.webkit.org/show_bug.cgi?id=45289
-
-        As a side effect of moving the multiline comment parsing
-        to a separate function, an opportunity raised to simplify
-        the single line comment parsing, and removing doneSemicolon
-        label. Slight performance increase on --parse-only
-        tests (from 32.8ms to 31.5ms)
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::lex):
-
-2010-09-08  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Remove accessor for private member variable in JSParser
-        https://bugs.webkit.org/show_bug.cgi?id=45378
+        Begin Characters Optimization Causes YARR Interpreter Errors
+        https://bugs.webkit.org/show_bug.cgi?id=55479
 
-        m_token is private to JSParser, so it does not seem to be useful
-        to have an accessor for it. On top of that, the file was both
-        using the accessor and directly accessing the member variable,
-        only one style should be used.
+        The addBeginTerm function is removed because it doesn't correctly handle those
+        cases when an "invalid" term has been
+        collected (e.g. CharacterClass). Move the removed function to the
+        setupAlternativeBeginTerms method's switch-case
+        where the non-allowed cases are correctly handled.
 
-2010-09-08  Csaba Osztrogonác  <ossy@webkit.org>
+        Reenable the Beginning Character Optimization in the YARR Interpreter again.
 
-        Reviewed by Oliver Hunt.
-
-        [Qt] REGRESSION(63348): jsc is broken
-        https://bugs.webkit.org/show_bug.cgi?id=42818
-
-        Need fastcall conventions on Qt/Win/MinGW.
-        Based on patches of Gavin Barraclough: r63947 and r63948.
-
-        * jit/JITStubs.cpp:
-        * jit/JITStubs.h:
-
-2010-09-08  Robert Hogan  <robert@webkit.org>
-
-        Reviewed by Antonio Gomes.
-
-        Remove some unnecessary duplicate calls to string functions
-
-        https://bugs.webkit.org/show_bug.cgi?id=45314
-
-        * wtf/text/WTFString.cpp:
-        (WTF::String::format):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::setupAlternativeBeginTerms):
+        (JSC::Yarr::YarrPattern::compile):
 
-2010-09-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2011-03-02  Jessie Berlin  <jberlin@apple.com>
 
-        Reviewed by Andreas Kling.
+        Reviewed by Adam Roben.
 
-        Re-Disable JIT for MSVC 64bit to fix the build on this compiler.
-        https://bugs.webkit.org/show_bug.cgi?id=45382
+        WebKit2: Use CFNetwork Sessions API.
+        https://bugs.webkit.org/show_bug.cgi?id=55435
 
-        It was enabled in the cleanup made in r64176, though it is still
-        not implemented.
+        Add the ability to create a Private Browsing storage session.
 
         * wtf/Platform.h:
+        Add a new #define for using CF Storage Sessions.
 
-2010-09-08  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Xan Lopez.
+2011-03-02  Oliver Hunt  <oliver@apple.com>
 
-        [GTK] Need a WebSocket implementation
-        https://bugs.webkit.org/show_bug.cgi?id=45197
-
-        Add a GIO-based WebSocket implementation.
-
-        * wtf/gobject/GRefPtr.cpp: Added PlatformRefPtr support for GSource.
-        (WTF::refPlatformPtr):
-        (WTF::derefPlatformPtr):
-        * wtf/gobject/GRefPtr.h: Added new template specialization declarations.
-        * wtf/gobject/GTypedefs.h: Add some more GLib/GIO forward declarations.
+        Reviewed by Gavin Barraclough.
 
-2010-08-30  Maciej Stachowiak  <mjs@apple.com>
+        Remove "register slot" concept from PropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=55621
 
-        Reviewed by Darin Adler.
+        PropertySlot had already stopped storing Register "slots"
+        so this patch is simply removing that api entirely.
+        This exposed a problem in the ProgramNode constructor for
+        BytecodeGenerator where it reads from the registerfile
+        before it has initialised it.
 
-        Handle MediaQueryExp memory management exclusively with smart pointers
-        https://bugs.webkit.org/show_bug.cgi?id=44874
-        
-        Implemented a non-copying sort function to make it possible to sort a Vector
-        of OwnPtrs (which cannot be copied). This is required for the above.
+        This bug wasn't a problem before as we were merely testing
+        for property existence rather than the actual value, and
+        used to work because setRegisterSlot didn't check that the
+        provided slot contained an initialised value.
 
-        * wtf/NonCopyingSort.h: Added.
-        (WTF::nonCopyingSort): It's secretly heapsort.
-        (WTF::heapSort): heapsort implementation.
-        (WTF::siftDown): Helper function for heapsort.
-        (WTF::heapify): ditto
+        To get around this issue we now use symbolTableHasProperty
+        to do the symbol table check without trying to read the
+        RegisterFile.
 
-        Adjust build systems.
-        
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
         * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::symbolTableHasProperty):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::symbolTableGet):
+        * runtime/PropertySlot.h:
 
-2010-09-08  Zoltan Herczeg  <zherczeg@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Refactoring multiline comments in the lexer
-        https://bugs.webkit.org/show_bug.cgi?id=45289
-
-        MultiLine comment parsing is moved to a separate function.
-
-        Slight performance increase on --parse-only tests (from 33.6ms to 32.8ms)
-        SunSpider reports no change (from 523.1ms to 521.2ms).
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::parseMultilineComment):
-        (JSC::Lexer::lex):
-        * parser/Lexer.h:
-
-2010-09-07  James Robinson  <jamesr@chromium.org>
-
-        Compile fix attempt for windows.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-09-07  Mihai Parparita  <mihaip@chromium.org>
-
-        Reviewed by James Robinson.
-
-        Fix Windows build after r66936
-        https://bugs.webkit.org/show_bug.cgi?id=45348
-
-        Add symbol names that were missing from r66936.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-09-07  Mihai Parparita  <mihaip@chromium.org>
-
-        Reviewed by Oliver Hunt.
-
-        pushState and replaceState do not clone RegExp objects correctly
-        https://bugs.webkit.org/show_bug.cgi?id=44718
-        
-        Move internal representation of JSC::RegExp (which depends on wether
-        YARR and YARR_JIT is enabled) into RegExpRepresentation which can live
-        in the implementation only. This makes it feasible to use RegExp in
-        WebCore without bringing in all of YARR.
-
-        * JavaScriptCore.exp: Export RegExp and RegExpObject functions that are
-        needed inside WebCore's JSC bindings.
-        * runtime/RegExp.cpp:
-        (JSC::RegExpRepresentation::~RegExpRepresentation):
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::~RegExp):
-        (JSC::RegExp::compile):
-        (JSC::RegExp::match):
-        * runtime/RegExp.h:
-
-2010-09-07  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/8381749> -Wcast-align warning emitted when building with clang
-
-        Remove the -Wcast-align-warning since it isn't really useful, and clang is more aggressive about warning than gcc.
-
-        * Configurations/Base.xcconfig:
-
-2010-09-07  Zoltan Horvath  <zoltan@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        REGRESSION(66741): Undefined pthread macros
-        https://bugs.webkit.org/show_bug.cgi?id=45246
-
-        PTHREAD_MUTEX_NORMAL and PTHREAD_MUTEX_DEFAULT (introduced in r60487) are not defined on Linux, 
-        but used in a statement. Add an additional check to test this.
-
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_PageHeap::initializeScavenger):
-
-2010-09-06  Oliver Hunt  <oliver@apple.com>
-
-        Windows build fix
-
-2010-09-05  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        SerializedScriptValue needs to use a flat storage mechanism
-        https://bugs.webkit.org/show_bug.cgi?id=45244
-
-        Export JSArray::put
-
-        * JavaScriptCore.exp:
-
-2010-09-06  Chao-ying Fu  <fu@mips.com>
-
-        Reviewed by Oliver Hunt.
+2011-03-02  Daniel Cheng  <dcheng@chromium.org>
 
-        Support JSVALUE32_64 on MIPS
-        https://bugs.webkit.org/show_bug.cgi?id=43999
+        Reviewed by David Levin.
 
-        Add missing functions to support JSVALUE32_64 on MIPS.
-        Remove JSVALUE32 as the default for MIPS.
+        Add feature define for data transfer items
+        https://bugs.webkit.org/show_bug.cgi?id=55510
 
-        * assembler/MIPSAssembler.h:
-        (JSC::MIPSAssembler::divd):
-        (JSC::MIPSAssembler::mthc1):
-        (JSC::MIPSAssembler::cvtwd):
-        * assembler/MacroAssemblerMIPS.h:
-        (JSC::MacroAssemblerMIPS::neg32):
-        (JSC::MacroAssemblerMIPS::branchOr32):
-        (JSC::MacroAssemblerMIPS::set8):
-        (JSC::MacroAssemblerMIPS::loadDouble):
-        (JSC::MacroAssemblerMIPS::divDouble):
-        (JSC::MacroAssemblerMIPS::convertInt32ToDouble):
-        (JSC::MacroAssemblerMIPS::branchDouble):
-        (JSC::MacroAssemblerMIPS::branchConvertDoubleToInt32):
-        (JSC::MacroAssemblerMIPS::zeroDouble):
-        * jit/JIT.h:
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTINativeCall):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::privateCompilePutByIdTransition):
-        * jit/JITStubs.cpp:
-        (JSC::JITThunks::JITThunks):
-        * jit/JITStubs.h:
+        * Configurations/FeatureDefines.xcconfig:
         * wtf/Platform.h:
 
-2010-09-06  Robert Hogan  <robert@webkit.org>
-
-        Unreviewed, compile fix.
-
-        Fix compile failure in r66843
-
-        Revert to original patch in bugzilla. Leave bug open for
-        discussion on potential removal of double utf8 conversion.
+2011-03-02  Adam Roben  <aroben@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=45240
-
-        * wtf/text/WTFString.cpp:
-        (WTF::String::format):
-
-2010-09-06  Robert Hogan  <robert@webkit.org>
-
-        Reviewed by Andreas Kling.
+        Delete old .res files whenever any .vsprops file changes
 
-        [Qt] utf8 encoding of console() messages
+        Prospective fix for <http://webkit.org/b/55599> r80079 caused incremental Windows builds to
+        fail
 
-        Unskip:
-        http/tests/security/xssAuditor/embed-tag-null-char.html
-        http/tests/security/xssAuditor/object-embed-tag-null-char.html
-
-        Both tests failed because Qt's implementation of String::format()
-        is casting a utf8 result to String, which assumes latin1 in
-        its constructor. So instead of casting a QString to a String, use
-        StringImpl::create() instead. Unfortunately, this involves a lot
-        of extra casts but the end result is correct.
-
-        https://bugs.webkit.org/show_bug.cgi?id=45240
-
-        * wtf/text/WTFString.cpp:
-        (WTF::String::format):
-
-2010-09-03  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=45135
-        <rdar://problem/7823714> TCMalloc_PageHeap doesn't hold a mutex while manipulating shared data
-
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_PageHeap::initializeScavenger): Make sure to create a non-recursive mutex
-        regardless of platform default, so that we can assert that it's held (this is for platforms
-        that don't have libdispatch).
-        (WTF::TCMalloc_PageHeap::signalScavenger): Assert that the mutex is held, so we can look
-        at m_scavengeThreadActive. For platforms that have libdispatch, assert that pageheap_lock
-        is held.
-        (WTF::TCMalloc_PageHeap::periodicScavenge): Make sure that pageheap_lock is held before
-        manipulating m_scavengeThreadActive. Otherwise, there is an obvious race condition, and we
-        can make unbalanced calls to dispatch_resume().
-
-2010-09-03  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+        Reviewed by Tony Chang.
 
-        Reviewed by Martin Robinson.
-
-        [EFL] Regression (66531) Build break with Glib Support
-        https://bugs.webkit.org/show_bug.cgi?id=45011
-
-        Move GtkTypedefs.h to GTypedefs.h and let it inside gobject directory
-        since when glib is enabled, EFL port needs it, too.
-
-        * CMakeListsEfl.txt: Include gobject directory to find new header
-        file.
-        * GNUmakefile.am: Ditto.
-        * wtf/CMakeListsEfl.txt: Ditto.
-        * wtf/Platform.h: Include header if port is EFL and glib support is
-        enabled.
-        * wtf/gtk/GtkTypedefs.h: Removed.
-        * wtf/gobject/GTypedefs.h: Added. Sections specific to GTK are now
-        guarded by PLATFORM(GTK).
-
-2010-09-03  Csaba Osztrogonác  <ossy@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Fix warning in wtf/ByteArray.h
-        https://bugs.webkit.org/show_bug.cgi?id=44672
-
-        * wtf/ByteArray.h: Use maximal sized array for MSVC and unsized array for other compilers.
-
-2010-09-02  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Actually parse a URL from ParsedURL
-        https://bugs.webkit.org/show_bug.cgi?id=45080
-
-        This patch only handles standard URLs.  At some point we'll need to
-        distinguish between standard URLs and other kinds of URLs.
-
-        * wtf/url/api/ParsedURL.cpp:
-        (WTF::ParsedURL::ParsedURL):
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        (main): Restructured code to loop over a set of file extensions, deleting any old files that
+        have that extension. Now deletes .res files, too. (We previously deleted any file matching
+        *.manifest*, but that turned out to just be the union of *.manifest and *.res.)
 
-2010-09-02  Adam Barth  <abarth@webkit.org>
+2011-03-02  Adam Barth  <abarth@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Dimitri Glazkov.
 
-        Add ParsedURL and URLString to WTFURL API
-        https://bugs.webkit.org/show_bug.cgi?id=45078
+        Teach JavaScriptCore GYP build how to build minidom
+        https://bugs.webkit.org/show_bug.cgi?id=55536
 
-        Currently there's no actual URL parsing going on, but this patch is a
-        start to sketching out the API.
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/url/api/ParsedURL.cpp: Added.
-        (WTF::ParsedURL::ParsedURL):
-        (WTF::ParsedURL::scheme):
-        (WTF::ParsedURL::username):
-        (WTF::ParsedURL::password):
-        (WTF::ParsedURL::host):
-        (WTF::ParsedURL::port):
-        (WTF::ParsedURL::path):
-        (WTF::ParsedURL::query):
-        (WTF::ParsedURL::fragment):
-        (WTF::ParsedURL::segment):
-        * wtf/url/api/ParsedURL.h: Added.
-        (WTF::ParsedURL::spec):
-        * wtf/url/api/URLString.h: Added.
-        (WTF::URLString::URLString):
-        (WTF::URLString::string):
-
-2010-09-02  Adam Barth  <abarth@webkit.org>
+2011-03-01  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Eric Seidel.
 
-        Add WTFURL to the JavaScriptCore build on Mac
-        https://bugs.webkit.org/show_bug.cgi?id=45075
-
-        Building code is good.
+        JavaScriptCore GYP build should copy some headers into the target framework
+        https://bugs.webkit.org/show_bug.cgi?id=55524
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2010-09-02  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=43230
-        <rdar://problem/8254215> REGRESSION: Memory leak within JSParser::JSParser
-
-        One can't delete a ThreadSpecific object that has data in it. It's not even possible to
-        enumerate data objects in all threads, much less destroy them from a thread that's destroying
-        the ThreadSpecific.
-
-        * parser/JSParser.cpp:
-        (JSC::JSParser::JSParser):
-        * runtime/JSGlobalData.h: 
-        * wtf/WTFThreadData.cpp:
-        (WTF::WTFThreadData::WTFThreadData):
-        * wtf/WTFThreadData.h:
-        (WTF::WTFThreadData::approximatedStackStart):
-        Moved stack guard tracking from JSGlobalData to WTFThreadData.
-
-        * wtf/ThreadSpecific.h: Made destructor unimplemented. It's dangerous, and we probably won't
-        ever face a situation where we'd want to delete a ThreadSpecific object.
-
-2010-09-01  Gavin Barraclough  <barraclough@apple.com>
-
-        Rubber stamped by Oliver Hunt.
+        After this patch, all the framework headers are exported as public
+        headers.  We need to teach GYP how to handle private headers.
 
-        Ecma-262 15.11.1.1 states that if the argument is undefined then an
-        Error object's message property should be set to the empty string.
-
-        * runtime/ErrorInstance.cpp:
-        (JSC::ErrorInstance::ErrorInstance):
-        (JSC::ErrorInstance::create):
-        * runtime/ErrorInstance.h:
-        * runtime/ErrorPrototype.cpp:
-        (JSC::ErrorPrototype::ErrorPrototype):
-
-2010-08-31  Darin Adler  <darin@apple.com>
-
-        Reviewed by Anders Carlsson.
+        I struggled to determine how to store the information about whether a
+        header was public, private, or project (i.e., not exported).
+        Generally, the GYPI should just list the files, but it seemed siliy to
+        have an almost duplicated list of files in the GYP file itself.  If
+        this design doesn't scale, we might have to revisit it in the future.
 
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_PageHeap::scavenge): Replaced somewhat-quirky code that
-        mixed types with code that uses size_t.
-
-        * wtf/TCPageMap.h: Removed names of unused arguments to avoid warning.
-
-2010-08-31  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Gustavo Noronha Silva.
-
-        [GTK] Isolate all GTK+ typedefs into one file
-        https://bugs.webkit.org/show_bug.cgi?id=44900
-
-        * GNUmakefile.am: Add GtkTypedefs.h to the source lists.
-        * wtf/Platform.h: #include GtkTypedefs.h for the GTK+ build.
-        * wtf/ThreadingPrimitives.h: Remove GTK+ typedefs.
-        * wtf/gobject/GOwnPtr.h: Ditto.
-        * wtf/gobject/GRefPtr.h: Ditto.
-        * wtf/gtk/GtkTypedefs.h: Added.
-
-2010-08-31  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Gustavo Noronha Silva.
-
-        [GTK] Fix 'make dist' in preparation of the 1.3.3 release
-        https://bugs.webkit.org/show_bug.cgi?id=44978
-
-        * GNUmakefile.am: Adding missing headers to the sources list.
-
-2010-08-31  Chao-ying Fu  <fu@mips.com>
-
-        Reviewed by Oliver Hunt.
-
-        Support emit_op_mod() for MIPS
-        https://bugs.webkit.org/show_bug.cgi?id=42855
-
-        This patch uses MIPS div instructions for op_mod to improve performance.
-
-        * assembler/MIPSAssembler.h:
-        (JSC::MIPSAssembler::div):
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::emit_op_mod):
-        (JSC::JIT::emitSlow_op_mod):
-
-2010-08-31  Csaba Osztrogonác  <ossy@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Modify ASSERT_UNUSED and UNUSED_PARAM similar to Qt's Q_UNUSED.
-        https://bugs.webkit.org/show_bug.cgi?id=44870
-
-        * wtf/Assertions.h:
-        * wtf/UnusedParam.h:
-
-2010-08-31  Benjamin Poulain  <benjamin.poulain@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        JSC TimeoutChecker::didTimeOut overflows on ARM
-        https://bugs.webkit.org/show_bug.cgi?id=38538
-
-        Make getCPUTime() return values relative to the first call.
-        The previous implementation relied on simply on currentTime(), which
-        return a time since epoch and not a time since the thread started. This
-        made the return value of getCPUTime() overflow on 32 bits.
-
-        * runtime/TimeoutChecker.cpp:
-        (JSC::getCPUTime):
-
-2010-08-30  Mihai Parparita  <mihaip@chromium.org>
-
-        Reviewed by Adam Barth.
-
-        HISTORY_ALWAYS_ASYNC should be removed (history should always be async)
-        https://bugs.webkit.org/show_bug.cgi?id=44315
-
-        Remove ENABLE_HISTORY_ALWAYS_ASYNC #define.
-
-        * wtf/Platform.h: 
-
-2010-08-30  Chris Rogers  <crogers@google.com>
-
-        Reviewed by Kenneth Russell.
-
-        Fix namespace for wtf/Complex.h and wtf/Vector3.h
-        https://bugs.webkit.org/show_bug.cgi?id=44892
-
-        * wtf/Complex.h:
-        * wtf/Vector3.h:
-
-2010-08-30  Andy Estes  <aestes@apple.com>
-
-        Reviewed by Eric Carlson.
-
-        Strings returned by asciiDebug() should be NULL-terminated.
-        https://bugs.webkit.org/show_bug.cgi?id=44866
-
-        * wtf/text/WTFString.cpp:
-        (asciiDebug):
-
-2010-08-30  Zoltan Herczeg  <zherczeg@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Refactor number parsing in the lexer
-        https://bugs.webkit.org/show_bug.cgi?id=44104
-
-        Number parsing was full of gotos, and needed a complete
-        redesign to remove them (Only one remained). Furthermore
-        integer arithmetic is empolyed for fast cases (= small
-        integer numbers).
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::parseHex):
-        (JSC::Lexer::parseOctal):
-        (JSC::Lexer::parseDecimal):
-        (JSC::Lexer::parseNumberAfterDecimalPoint):
-        (JSC::Lexer::parseNumberAfterExponentIndicator):
-        (JSC::Lexer::lex):
-        * parser/Lexer.h:
-
-2010-08-29  Darin Adler  <darin@apple.com>
-
-        Fix Qt build.
-
-        * wtf/unicode/glib/UnicodeMacrosFromICU.h: Added U_IS_BMP.
-        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
-        * wtf/unicode/wince/UnicodeWince.h: Ditto.
-
-2010-08-29  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Kent Tamura.
-
-        [BREWMP] Port vprintf_stderr_common
-        https://bugs.webkit.org/show_bug.cgi?id=33568
-
-        Use BREW's DBGPRINTF to output debug messages.
-
-        * wtf/Assertions.cpp:
-
-2010-08-28  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 44830 - In Array's prototype functyions we're incorrectly handing large index values
-
-        We are in places casting doubles to unsigneds, and unsigneds to ints, without always check
-        that the result is within bounds. This is problematic in the case of double-to-unsigned
-        conversion because we should be saturating to array length.
-
-        Also, the error return value from Array.splice should be [], not undefined.
-
-        I don't see any security concerns here. These methods are spec'ed in such a way that they
-        can be applied to non Array objects, so in all cases the (potentially bogus) indices are
-        being passed to functions that will safely check accesses are within bounds.
-
-        * runtime/ArrayPrototype.cpp:
-        (JSC::argumentClampedIndexFromStartOrEnd):
-        (JSC::arrayProtoFuncJoin):
-        (JSC::arrayProtoFuncConcat):
-        (JSC::arrayProtoFuncReverse):
-        (JSC::arrayProtoFuncShift):
-        (JSC::arrayProtoFuncSlice):
-        (JSC::arrayProtoFuncSort):
-        (JSC::arrayProtoFuncSplice):
-        (JSC::arrayProtoFuncUnShift):
-        (JSC::arrayProtoFuncFilter):
-        (JSC::arrayProtoFuncMap):
-        (JSC::arrayProtoFuncEvery):
-        (JSC::arrayProtoFuncForEach):
-        (JSC::arrayProtoFuncSome):
-        (JSC::arrayProtoFuncReduce):
-        (JSC::arrayProtoFuncReduceRight):
-        (JSC::arrayProtoFuncIndexOf):
-        (JSC::arrayProtoFuncLastIndexOf):
-        * runtime/JSValue.h:
-        (JSC::JSValue::toUInt32):
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
 
-2010-08-28  Pratik Solanki  <psolanki@apple.com>
+2011-03-01  Sheriff Bot  <webkit.review.bot@gmail.com>
 
-        Reviewed by Dan Bernstein.
+        Unreviewed, rolling out r80079.
+        http://trac.webkit.org/changeset/80079
+        https://bugs.webkit.org/show_bug.cgi?id=55547
 
-        Add an ENABLE define for purgeable memory support
-        https://bugs.webkit.org/show_bug.cgi?id=44777
+        "Broke the Win debug build?" (Requested by dcheng on #webkit).
 
         * wtf/Platform.h:
 
-2010-08-27  Kimmo Kinnunen  <kimmo.t.kinnunen@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] NPAPI Plugin metadata should be cached, and loading a plugin should not require loading every plugin
-        https://bugs.webkit.org/show_bug.cgi?id=43179
-
-        Add ENABLE_NETSCAPE_PLUGIN_METADATA_CACHE flag to enable persistent
-        NPAPI Plugin Cache. The flag is enabled by default.
-
-        * wtf/Platform.h: Add ENABLE_NETSCAPE_PLUGIN_METADATA_CACHE
-
-2010-07-27  Jer Noble  <jer.noble@apple.com>
-
-        Reviewed by Eric Carlson.
-
-        Add JavaScript API to allow a page to go fullscreen.
-        rdar://problem/6867795
-        https://bugs.webkit.org/show_bug.cgi?id=43099
-
-        * wtf/Platform.h: Enable FULLSCREEN_API mode for the Mac (except iOS).
-
-2010-08-27  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix pt 2.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-08-27  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix pt 1.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-08-27  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 44745 - Number.toFixed/toExponential/toPrecision are inaccurate.
-
-        These methods should be using a version of dtoa that can generate results accurate
-        to the requested precision, whereas our version of dtoa is only currently able to
-        support producing results sufficiently accurate to distinguish the value from any
-        other IEEE-754 double precision number.
-
-        This change has no impact on benchmarks we track.
-
-        On microbenchmarks for these functions, this is a slight regression where a high
-        precision is requested (dtoa now need to iterate further to generate a a greater
-        number of digits), but with smaller precision values (hopefully more common) this
-        improves performance, since it reduced the accurate of result dtoa is required,
-        to produce, and removes the need to pre-round values before calling dtoa. 
-
-        * JavaScriptCore.exp:
-            doubleToStringInJavaScriptFormat renamed to numberToString
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-            doubleToStringInJavaScriptFormat renamed to numberToString
-
-        * runtime/UString.cpp:
-        (JSC::UString::number):
-            doubleToStringInJavaScriptFormat renamed to numberToString
-
-        * wtf/DecimalNumber.h:
-        (WTF::DecimalNumber::DecimalNumber):
-        (WTF::DecimalNumber::toStringDecimal):
-        (WTF::DecimalNumber::toStringExponential):
-            Remove all pre-rounding of values, instead call dtoa correctly.
-
-        * wtf/dtoa.cpp:
-        (WTF::dtoa):
-        * wtf/dtoa.h:
-            Reenable support for rounding to specific-figures/decimal-places in dtoa.
-            Modify to remove unbiased rounding, provide ECMA required away-from-zero.
-            Rewrite doubleToStringInJavaScriptFormat to use DecimalNumber, rename to
-            numberToString.
-
-2010-08-27  Chao-ying Fu  <fu@mips.com>
-
-        Reviewed by Oliver Hunt.
-
-        Byte alignment issue on MIPS
-        https://bugs.webkit.org/show_bug.cgi?id=29415
-
-        MIPS accesses one byte at a time for now to avoid the help from the
-        kernel to fix unaligned accesses.
-
-        * wtf/text/AtomicString.cpp:
-        (WebCore::equal):
-        * wtf/text/StringHash.h:
-        (WebCore::StringHash::equal):
-
-2010-08-27  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix a couple of typos in comment.
-
-        * bytecode/CodeBlock.h:
-
-2010-08-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix.
-
-        * wtf/dtoa.cpp:
+2011-03-01  Daniel Cheng  <dcheng@chromium.org>
 
-2010-08-26  Gavin Barraclough  <baraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 44735 - Clean up dtoa.cpp
-        Remove unused & unmaintained code paths, reformat code to match
-        coding standard & use platform #defines from Platform.h directly.
-
-        * wtf/dtoa.cpp:
-        (WTF::storeInc):
-        (WTF::multadd):
-        (WTF::s2b):
-        (WTF::lo0bits):
-        (WTF::mult):
-        (WTF::pow5mult):
-        (WTF::lshift):
-        (WTF::diff):
-        (WTF::ulp):
-        (WTF::b2d):
-        (WTF::d2b):
-        (WTF::ratio):
-        (WTF::):
-        (WTF::strtod):
-        (WTF::quorem):
-        (WTF::dtoa):
-
-2010-08-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Rubber Stamped by Oliver Hunt.
-
-        Partially revert r65959. The toString changes regressed the v8 tests,
-        but keep the toFixed/toExponential/toPrecision changes.
-
-        * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * runtime/NumberPrototype.cpp:
-        * runtime/UString.cpp:
-        (JSC::UString::number):
-        * wtf/DecimalNumber.h:
-        * wtf/dtoa.cpp:
-        (WTF::append):
-        (WTF::doubleToStringInJavaScriptFormat):
-        * wtf/dtoa.h:
-        * wtf/text/WTFString.cpp:
-        * wtf/text/WTFString.h:
-
-2010-08-26  James Robinson  <jamesr@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        [chromium] Remove the USE(GLES2_RENDERING) define and associated code
-        https://bugs.webkit.org/show_bug.cgi?id=43761
+        Reviewed by David Levin.
 
-        Remove WTF_USE_GLES2_RENDERING from the list of defines in chromium, it's unused.
+        Add feature define for data transfer items
+        https://bugs.webkit.org/show_bug.cgi?id=55510
 
         * wtf/Platform.h:
 
-2010-08-26  Gavin Barraclough  <barraclough@apple.com>
+2011-03-01  Oliver Hunt  <oliver@apple.com>
 
-        Rolling out r64608, this regressed performance.
+        Reviewed by Joseph Pecoraro.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * assembler/ARMAssembler.cpp:
-        (JSC::ARMAssembler::executableCopy):
-        * assembler/LinkBuffer.h:
-        (JSC::LinkBuffer::LinkBuffer):
-        (JSC::LinkBuffer::~LinkBuffer):
-        (JSC::LinkBuffer::performFinalization):
-        * assembler/MIPSAssembler.h:
-        (JSC::MIPSAssembler::executableCopy):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::executableCopy):
-        * bytecode/StructureStubInfo.h:
-        (JSC::StructureStubInfo::initGetByIdProto):
-        (JSC::StructureStubInfo::initGetByIdChain):
-        (JSC::StructureStubInfo::initGetByIdSelfList):
-        (JSC::StructureStubInfo::initGetByIdProtoList):
-        (JSC::StructureStubInfo::initPutByIdTransition):
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutablePool::systemAlloc):
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutablePool::create):
-        (JSC::ExecutableAllocator::ExecutableAllocator):
-        (JSC::ExecutableAllocator::poolForSize):
-        (JSC::ExecutablePool::ExecutablePool):
-        (JSC::ExecutablePool::poolAllocate):
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::allocInternal):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile):
-        * jit/JIT.h:
-        (JSC::JIT::compileGetByIdProto):
-        (JSC::JIT::compileGetByIdSelfList):
-        (JSC::JIT::compileGetByIdProtoList):
-        (JSC::JIT::compileGetByIdChainList):
-        (JSC::JIT::compileGetByIdChain):
-        (JSC::JIT::compilePutByIdTransition):
-        (JSC::JIT::compilePatchGetArrayLength):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        (JSC::JIT::privateCompileCTINativeCall):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::stringGetByValStubGenerator):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::stringGetByValStubGenerator):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        * jit/JITStubs.cpp:
-        (JSC::JITThunks::tryCachePutByID):
-        (JSC::JITThunks::tryCacheGetByID):
-        (JSC::DEFINE_STUB_FUNCTION):
-        (JSC::getPolymorphicAccessStructureListSlot):
-        * jit/JITStubs.h:
-        * jit/SpecializedThunkJIT.h:
-        (JSC::SpecializedThunkJIT::finalize):
-        * runtime/ExceptionHelpers.cpp:
-        * runtime/ExceptionHelpers.h:
-        * runtime/Executable.cpp:
-        (JSC::EvalExecutable::compileInternal):
-        (JSC::ProgramExecutable::compileInternal):
-        (JSC::FunctionExecutable::compileForCallInternal):
-        (JSC::FunctionExecutable::compileForConstructInternal):
-        (JSC::FunctionExecutable::reparseExceptionInfo):
-        (JSC::EvalExecutable::reparseExceptionInfo):
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::compile):
+        Misaligned memory access in CloneDeserializer on all ARM arch.
+        https://bugs.webkit.org/show_bug.cgi?id=48742
 
-2010-08-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        Bug 44655 - Add debug only convenience methods to obtain a Vector<char> from a String/StringImpl.
-
-        * wtf/text/WTFString.cpp:
-        (asciiDebug):
-            Return a Vector<char> containing the contents of a string as ASCII.
-
-2010-08-26  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Add PassOwnArrayPtr
-        https://bugs.webkit.org/show_bug.cgi?id=44627
-
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        Add the new files.
-
-        * wtf/Forward.h:
-        Forward declare PassOwnArrayPtr.
-        
-        * wtf/OwnArrayPtr.h:
-        Mimic the OwnPtr interface.
-
-        * wtf/OwnArrayPtrCommon.h: Added.
-        (WTF::deleteOwnedArrayPtr):
-        Move delete function here so it can be shared by OwnArrayPtr and
-        PassOwnArrayPtr.
-
-        * wtf/PassOwnArrayPtr.h: Added.
-        Mimic the PassOwnPtr interface.
-
-2010-08-26  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
+        Add a CPU class for architectures that need aligned addresses
+        for memory access.
 
-        [JSC] JavaScript parsing error when loading Equifax web page
-        https://bugs.webkit.org/show_bug.cgi?id=42900
-
-        '-->' is ostensibly only meant to occur when there is only
-        whitespace preceeding it on the line.  However firefox treats
-        multiline comments as a space character, so they are allowed.
-        One side effect of the firefox model is that any line terminators
-        inside the multiline comment are ignored, so
-
-            foo/*
-            */-->
-
-        is treated as
-
-            foo -->
-
-        and so '-->' will not be a comment in this case.  Happily this simply
-        means that to fix this issue all we need to do is stop updating
-        m_atLineStart when handling multiline comments.
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::lex):
-
-2010-08-25  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Improve overflow handling in StringImpl::Replace
-        https://bugs.webkit.org/show_bug.cgi?id=42502
-        <rdar://problem/8203794>
-
-        Harden StringImpl::replace against overflow -- I can't see how this
-        could be abused, but it's better to be safe than sorry.
-
-        * wtf/text/StringImpl.cpp:
-        (WTF::StringImpl::replace):
-
-2010-08-26  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] The GNUmakefile.am files contain a myriad of confusing preprocessor and compiler flag definitions
-        https://bugs.webkit.org/show_bug.cgi?id=44624
-
-        Clean up GNUmakefile.am.
-
-        * GNUmakefile.am: Alphabetize the include order in javascriptcore_cppflags. Move
-        a couple include lines from the top-level GNUmakefile.am.
-
-2010-08-25  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Kent Tamura.
-
-        Local variables 'k' and 'y' in s2b() in dtoa.cpp are computed but not used
-        https://bugs.webkit.org/show_bug.cgi?id=29259
-
-        Remove unused code in dtoa.cpp, spotted by Wan-Teh Chang.
-
-        * wtf/dtoa.cpp:
-        (WTF::s2b):
+        * wtf/Platform.h:
 
-2010-08-25  Kwang Yul Seo  <skyul@company100.net>
+2011-03-01  Adam Barth  <abarth@webkit.org>
 
-        Reviewed by Kevin Ollivier.
+        Reviewed by Dimitri Glazkov.
 
-        [BREWMP] Add build system
-        https://bugs.webkit.org/show_bug.cgi?id=44645
+        Add pre- and post-build actions for JavaScriptCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=55507
 
-        Make waf script portable so that we can add more ports.
+        After this patch, we have all the steps for building the main
+        JavaScriptCore framework except the "copy headers" step, which I'll do
+        next.
 
-        * wscript:
+        * gyp/JavaScriptCore.gyp:
 
-2010-08-25  Michael Saboff  <msaboff@apple.com>
+2011-03-01  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Remove the single entry regular expression cache introduced as part of
-        the fix for https://bugs.webkit.org/show_bug.cgi?id=41238.
-        The performance problem in Dromaeo that initiated that bug is no 
-        longer present. Dromaeo has been modified so that the regular
-        expression tests are somewhat random and don't benefit from a
-        single entry cache.
-
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::match):
-        * runtime/RegExp.h:
-
-2010-08-25  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Gustavo Noronha Silva.
-
-        Cairo and EFL port shouldn't depend on glib.
-        https://bugs.webkit.org/show_bug.cgi?id=44354
-
-        Replace GRefPtr with PlatformRefPtr. Keep GLib specific bits in
-        GRefPtr.h.
-
-        * GNUmakefile.am: Add PlatformRefPtr.h to the source list.
-        * wtf/PlatformRefPtr.h: Migrated from GRefPtr.h.
-        (WTF::PlatformRefPtr::PlatformRefPtr): Ditto.
-        (WTF::PlatformRefPtr::~PlatformRefPtr): Ditto.
-        (WTF::PlatformRefPtr::clear): Ditto.
-        (WTF::PlatformRefPtr::get): Ditto.
-        (WTF::PlatformRefPtr::operator*): Ditto.
-        (WTF::PlatformRefPtr::operator->): Ditto.
-        (WTF::PlatformRefPtr::operator!): Ditto.
-        (WTF::PlatformRefPtr::operator UnspecifiedBoolType): Ditto.
-        (WTF::PlatformRefPtr::hashTableDeletedValue): Ditto.
-        (WTF::::operator): Ditto.
-        (WTF::::swap): Ditto.
-        (WTF::swap): Ditto.
-        (WTF::operator==): Ditto.
-        (WTF::operator!=): Ditto.
-        (WTF::static_pointer_cast): Ditto.
-        (WTF::const_pointer_cast): Ditto.
-        (WTF::getPtr): Ditto.
-        (WTF::adoptPlatformRef): Ditto.
-        * wtf/gobject/GRefPtr.cpp: Changes to reflect new names.
-        (WTF::refPlatformPtr):
-        (WTF::derefPlatformPtr):
-        * wtf/gobject/GRefPtr.h: Ditto.
-        (WTF::refPlatformPtr):
-        (WTF::derefPlatformPtr):
-
-2010-08-25  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Remove dead code in JSGlobalObject
-        https://bugs.webkit.org/show_bug.cgi?id=44615
-
-        The recursion data member in the JSGlobalObject and its getter
-        plus inc/dec methods seems to be unused, remove them.
-
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init):
-        * runtime/JSGlobalObject.h:
-
-2010-08-25  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Changed the initial and subsequent allocation of vector storage to
-        Array()s. The changes are to limit sparse arrays to 100000 entries
-        and fixed the sparse map to vector storage conversion to use the 
-        minimum amount of memory needed to store the current number of entries.
-        These changes address https://bugs.webkit.org/show_bug.cgi?id=43707
-
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::getNewVectorLength):
-
-2010-08-16  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        Avoid increasing required alignment of target type warning
-        https://bugs.webkit.org/show_bug.cgi?id=43963
-
-        Fix platform independent alignment warnings.
-
-        * wtf/ListHashSet.h:
-        (WTF::ListHashSetNodeAllocator::pool):
-
-2010-08-19  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        Enable truncated floating point feature on ARM
-        https://bugs.webkit.org/show_bug.cgi?id=44233
-
-        Enable truncated floating point feature with the help of VCVTR.S32.F64
-        instruction. If VCVTR.S32.F64 can't fit the result into a 32-bit
-        integer/register, it saturates at INT_MAX or INT_MIN. Testing this
-        looks quicker than testing FPSCR for exception.
-
-        Inspired by Jacob Bramley's patch from JaegerMonkey
-
-        * assembler/ARMAssembler.h:
-        (JSC::ARMAssembler::):
-        (JSC::ARMAssembler::cmn_r):
-        (JSC::ARMAssembler::vcvtr_s32_f64_r):
-        * assembler/MacroAssemblerARM.h:
-        (JSC::MacroAssemblerARM::supportsFloatingPointTruncate):
-        (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
-
-2010-08-24  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-08-24  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * wtf/DecimalNumber.h:
-        (WTF::DecimalNumber::intPow10):
-        * wtf/dtoa.cpp:
-        * wtf/dtoa.h:
-
-2010-08-23  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=44487
-
-        Number.toExponential/toFixed/toPrecision all contain a spaghetti of duplicated
-        code & unnecessary complexity. Add a new DecimalNumber class to encapsulate
-        double to string conversion, share the implementations of rounding &
-        decimal-fraction/exponential formatting.
+        Rolled back in r79627 now that the underlying cause for it crashing is fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=55159
 
         * JavaScriptCore.exp:
-            Update exports.
-
-        * runtime/NumberPrototype.cpp:
-        (JSC::toThisNumber):
-        (JSC::getIntegerArgumentInRange):
-            Helper methods used in implementing toExponential/toFixed/toString.
-        (JSC::numberProtoFuncToExponential):
-        (JSC::numberProtoFuncToFixed):
-        (JSC::numberProtoFuncToPrecision):
-            Reimplemented using new DecimalNumber class.
-            
-        * runtime/UString.cpp:
-        (JSC::UString::number):
-            Updated to call numberToString.
-
-        * wtf/DecimalNumber.h: Added.
-        (WTF::):
-        (WTF::DecimalNumber::DecimalNumber):
-        (WTF::DecimalNumber::toStringDecimal):
-        (WTF::DecimalNumber::toStringExponential):
-        (WTF::DecimalNumber::sign):
-        (WTF::DecimalNumber::exponent):
-        (WTF::DecimalNumber::significand):
-        (WTF::DecimalNumber::precision):
-        (WTF::DecimalNumber::init):
-        (WTF::DecimalNumber::isZero):
-        (WTF::DecimalNumber::roundToPrecision):
-            New class to perform double to string conversion.
-            Has three constructors, which allow conversion with no rounding,
-            rounding to significant-figures, or rounding to decimal-places,
-            and two methods for formatting strings, either using decimal
-            fraction or exponential encoding. Internal implementation uses
-            pre-rounding of the values before calling dtoa rather than
-            relying on dtoa to correctly round, which does not produce
-            fully accurate results. Hopefully we can address this in the
-            near future.
-
-        * wtf/dtoa.cpp:
-        (WTF::intPow10):
-        * wtf/dtoa.h:
-            intPow10 is used internally by DecimalNumber.
-            
-        * wtf/text/WTFString.cpp:
-        (WTF::copyToString):
-        (WTF::nanOrInfToString):
-            Used internally in numberToString for NaN/Infinity handling.
-        (WTF::numberToString):
-            Added new method to convert doubles to strings.
-
-        * wtf/text/WTFString.h:
-            Added declaration for numberToString. This is here because
-            we should switch over to using this for all double to string
-            conversion in WebCore (see section 2.4.4.3 of the HTML5 spec).
-
-2010-08-24  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Don't seed the JS random number generator from time()
-        https://bugs.webkit.org/show_bug.cgi?id=41868
-        <rdar://problem/8171025>
-
-        Switch to using the secure random number generator to
-        seed the fast random generator, and make the generator
-        be per global object.
-
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * runtime/JSGlobalData.h:
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
-        (JSC::JSGlobalObject::weakRandomNumber):
-        * runtime/MathObject.cpp:
-        (JSC::mathProtoFuncRandom):
-
-2010-08-24  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        Make overflow guards in UString::utf8 explicit
-        https://bugs.webkit.org/show_bug.cgi?id=44540
-
-        Add an explicit overflow check prior to allocating our buffer,
-        rather than implicitly relying on the guard in convertUTF16ToUTF8.
-
-        * runtime/UString.cpp:
-        (JSC::UString::utf8):
-
-2010-08-24  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Symbian] Fix commit/decommit of system memory using RChunk
-
-        Swap accidentially reversed start and m_base values for determining the
-        offset within the RChunk.
-
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::systemCommit):
-        (WTF::PageReservation::systemDecommit):
-
-2010-08-23  Patrick Gansterer  <paroga@paroga.com>
-
-        Rubber-stamped by Gabor Loki.
-
-        [WINCE] Buildfix for GeneratedJITStubs after r64818
-        https://bugs.webkit.org/show_bug.cgi?id=44469
-
-        Use " THUNK_RETURN_ADDRESS_OFFSET" instead of "#offset#".
-
-        * jit/JITStubs.cpp:
-
-2010-08-23  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Darin Adler.
-
-        [REGRESSION] Interpreter incorrectly excludes prototype chain when validating put_by_id_transition
-        https://bugs.webkit.org/show_bug.cgi?id=44240
-        <rdar://problem/8328995>
-
-        Fix an error I introduced when cleaning up the interpreter side of the logic
-        to prevent setters being called in object initialisers.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-
-2010-08-23  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fixed case where a single character search string in a string.replace()
-        did not properly handle back reference replacement.  The fix is to 
-        check for a '$' as part of the check to see if we can execute the
-        single character replace optimization.
-        https://bugs.webkit.org/show_bug.cgi?id=44067
-
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncReplace):
-
-2010-08-23  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        JSON.stringify is much slower than Firefox on particular pathological input
-        https://bugs.webkit.org/show_bug.cgi?id=44456
-
-        Make StringBuilder::reserveCapacity reserve additional space so we don't end up
-        repeatedly copying the entire result string.
-
-        * runtime/StringBuilder.h:
-        (JSC::StringBuilder::append):
-        (JSC::StringBuilder::reserveCapacity):
-
-2010-08-23  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Darin Fisher.
-
-        Handle blob resource.
-        https://bugs.webkit.org/show_bug.cgi?id=43941
-
-        * JavaScriptCore.exp: Add an export that is neede by BlobResourceHandle.
-
-2010-08-19  Andreas Kling  <andreas.kling@nokia.com>
-
-        Reviewed by Geoffrey Garen.
-
-        JSC: Move the static_cast into to(U)Int32 fast case
-        https://bugs.webkit.org/show_bug.cgi?id=44037
-
-        Do the static_cast<(u)int32_t> inline to avoid the function call overhead
-        for easily converted values (within (u)int32_t range.)
-
-        * runtime/JSValue.cpp:
-        (JSC::toInt32SlowCase):
-        (JSC::toUInt32SlowCase):
-        * runtime/JSValue.h:
-        (JSC::JSValue::toInt32):
-        (JSC::JSValue::toUInt32):
-
-2010-08-18  Andreas Kling  <andreas.kling@nokia.com>
-
-        Reviewed by Geoffrey Garen.
-
-        REGRESSION(r58469): Math.pow() always returns double-backed JSValue which is extremely slow as array subscript
-        https://bugs.webkit.org/show_bug.cgi?id=43742
-
-        Add codegen for pow() to return Int32 values when possible.
-
-        * jit/ThunkGenerators.cpp:
-        (JSC::powThunkGenerator):
-
-2010-08-18  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        The JITStackFrame is wrong using Thumb-2 JIT with JSVALUE32_64
-        https://bugs.webkit.org/show_bug.cgi?id=43897
-
-        A 64 bits wide member in a structure is aligned to 8 bytes on ARM by
-        default, but this is not taken into account in the offset defines of
-        JITStackFrame.
-
-        * jit/JITStubs.cpp:
-        * jit/JITStubs.h:
-
-2010-08-18  Gavin Barraclough  <barraclough@apple.com>
-
-        Rubber stamped by Sam Weinig.
-
-        Rename UString::substr to substringSharingImpl, add to WTF::String.
-        Now WTF::String can do everything that JSC::UString can do!
-
-        * JavaScriptCore.exp:
-        * bytecode/CodeBlock.cpp:
-        (JSC::escapeQuotes):
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::substitute):
-        * parser/SourceProvider.h:
-        (JSC::UStringSourceProvider::getRange):
-        * runtime/FunctionPrototype.cpp:
-        (JSC::insertSemicolonIfNeeded):
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::parseInt):
-        * runtime/JSONObject.cpp:
-        (JSC::gap):
-        (JSC::Stringifier::indent):
-        (JSC::Stringifier::unindent):
-        * runtime/JSString.cpp:
-        (JSC::JSString::replaceCharacter):
-        * runtime/NumberPrototype.cpp:
-        (JSC::numberProtoFuncToFixed):
-        (JSC::numberProtoFuncToPrecision):
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncReplace):
-        (JSC::trimString):
-        * runtime/UString.cpp:
-        (JSC::UString::substringSharingImpl):
-        * runtime/UString.h:
-        * wtf/text/WTFString.cpp:
-        (WTF::String::substringSharingImpl):
-        * wtf/text/WTFString.h:
-
-2010-08-18  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2010-08-18  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix.
-
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
         * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Heap.cpp:
+        (JSC::Heap::allocateSlowCase):
+        * runtime/Heap.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedSpace::sizeClassFor):
+        (JSC::JSCell::Heap::allocate):
+        (JSC::JSCell::JSCell::operator new):
+        * runtime/MarkedBlock.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::SizeClass::SizeClass):
 
-2010-08-17  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 44146 - Remove toDouble/toUInt32 methods from UString.
-
-        These methods all implement JavaScript language specific behaviour, and as such
-        are not suited to being on a generic string object.  They are also inefficient
-        and incorrectly used, refactor & cleanup.  Uses of these methods really divide
-        out into two cases.
-
-        ToNumber:
-        Uses of toDouble from JSString and from parseFloat are implementing ecma's
-        ToNumber conversion from strings (see ecma-262 9.3.1), so UString::toDouble
-        should largely just be moved out to a global jsToNumber function.  ToNumber is
-        capable of recognizing either decimal or hexadecimal numbers, but parseFloat
-        should only recognize decimal values.  This is currently handled by testing for
-        hexadecimal before calling toDouble, which should unnecessary - instead we can
-        just split out the two parts to the grammar into separate functions. Also,
-        strtod recognizes a set of literals (nan, inf, and infinity - all with any
-        capitalization) - which are not defined by any of the specs we are implementing.
-        To handle this we need to perform additional work in toDouble to convert the
-        unsupported cases of infinities back to NaNs.  Instead we should simply remove
-        support for this literals from strtod.  This should provide a more desirable
-        behaviour for all clients of strtod.
-
-        Indexed properties:
-        Uses of the toStrictUInt32 methods are were all converting property names to
-        indices, and all uses of toUInt32 were incorrect; in all cases we should have
-        been calling toUInt32.  This error results in some incorrect behaviour in the
-        DOM (accessing property "0 " of a NodeList should fail; it currently does not).
-        Move this method onto Identifier (our canonical property name), and make it
-        always perform a strict conversion. Add a layout test to check NodeList does
-        convert indexed property names correctly.
-
-        * JavaScriptCore.exp:
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::getOwnPropertyDescriptor):
-        (JSC::Arguments::put):
-        (JSC::Arguments::deleteProperty):
-        * runtime/Identifier.cpp:
-        (JSC::Identifier::toUInt32):
-        * runtime/Identifier.h:
-        (JSC::Identifier::toUInt32):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::deleteProperty):
-        * runtime/JSArray.h:
-        (JSC::Identifier::toArrayIndex):
-        * runtime/JSByteArray.cpp:
-        (JSC::JSByteArray::getOwnPropertySlot):
-        (JSC::JSByteArray::getOwnPropertyDescriptor):
-        (JSC::JSByteArray::put):
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::isInfinity):
-        (JSC::jsHexIntegerLiteral):
-        (JSC::jsStrDecimalLiteral):
-        (JSC::jsToNumber):
-        (JSC::parseFloat):
-        * runtime/JSGlobalObjectFunctions.h:
-        * runtime/JSString.cpp:
-        (JSC::JSString::getPrimitiveNumber):
-        (JSC::JSString::toNumber):
-        (JSC::JSString::getStringPropertyDescriptor):
-        * runtime/JSString.h:
-        (JSC::JSString::getStringPropertySlot):
-        * runtime/ObjectPrototype.cpp:
-        (JSC::ObjectPrototype::put):
-        * runtime/StringObject.cpp:
-        (JSC::StringObject::deleteProperty):
-        * runtime/UString.cpp:
-        * runtime/UString.h:
-        * wtf/dtoa.cpp:
-        (WTF::strtod):
-
-2010-08-17  Gavin Barraclough  <barraclough@apple.com>
+2011-03-01  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Bug 44099 - REGRESSION(r65468): Crashes in StringImpl::find
-
-        Bug 44080 introuduced a couple of cases in which array bounds could be overrun.
-        One of these was fixed in r65493, this patch fixes the other and address the
-        concerns voiced in comment #6 by restructuring the loops to remove the code
-        dupliction without introducing an additional if check.
-
-        * wtf/text/StringImpl.cpp:
-        (WTF::StringImpl::find):
-        (WTF::StringImpl::findIgnoringCase):
-        (WTF::StringImpl::reverseFind):
-        (WTF::StringImpl::reverseFindIgnoringCase):
-
-2010-08-17  No'am Rosenthal  <noam.rosenthal@nokia.com>
-
-        Reviewed by Ariya Hidayat.
-
-        [Qt] Move the accelerated compositing build flag to the right place
-        https://bugs.webkit.org/show_bug.cgi?id=43882
-
-        * wtf/Platform.h:
-
-2010-08-17  Yuta Kitamura  <yutak@chromium.org>
-
-        Reviewed by Shinichiro Hamaji.
-
-        Avoid uninitialized memory read in StringImpl::find().
-
-        REGRESSION(r65468): Crashes in StringImpl::find
-        https://bugs.webkit.org/show_bug.cgi?id=44099
-
-        * wtf/text/StringImpl.cpp:
-        (WTF::StringImpl::find):
-
-2010-08-16  Gavin Barraclough  <barraclough@apple.com>
-
-        Rubber stamped by Sam Weinig
-
-        Add VectorTraits to String & DefaultHash traits to UString to unify behaviour.
-
-        * runtime/UString.h:
-        (JSC::UStringHash::hash):
-        (JSC::UStringHash::equal):
-        (WTF::):
-        * wtf/text/WTFString.h:
-        (WTF::):
-
-2010-08-16  Gavin Barraclough  <barraclough@apple.com>
-
-        Rubber stamped by Sam Weinig
-
-        Remove unnecessary includes from UString.h, add new includes as necessary.
-
-        * profiler/CallIdentifier.h:
-        * profiler/ProfileNode.h:
-        * runtime/DateConversion.cpp:
-        * runtime/Identifier.h:
-        (JSC::IdentifierRepHash::hash):
-        * runtime/RegExpCache.h:
-        * runtime/RegExpKey.h:
-        * runtime/UString.cpp:
-        (JSC::UString::substr):
-        * runtime/UString.h:
-        * wtf/text/WTFString.h:
-
-2010-08-16  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig
+        Replace two script phases that do nothing but copy files with copy files build phases.
 
-        Bug 44080 - String find/reverseFind methods need tidying up
-        These methods have a couple of problems with their interface, and implementation.
-
-        These methods take and int index, and return an int - however this is problematic
-        since on 64-bit string indices may have a full 32-bit range.  This spills out into
-        surrounding code, which unsafely casts string indices from unsigned to int. Code
-        checking the result of these methods check for a mix of "== -1", "< 0", and
-        "== notFound".  Clean this up by changing these methods to take an unsigned
-        starting index, and return a size_t. with a failed match indicated by notFound.
-        reverseFind also has a special meaning for the starting index argument, in that a
-        negative index is interpreted as an offset back from the end of the string. Remove
-        this functionality, in the (1!) case where it is used we should just calculate the
-        offset by subtracting from the string's length.
-
-        The implementation has a few problems too.  The code is not in webkit style, in
-        using assorted abbreviations in variable names, and implementations of similar
-        find methods with differing argument types were unnecessarily inconsistent. When
-        find is passed const char* data the string would be handled as latin1 (zero
-        extended to UTF-16) for all characters but the first; this is sign extended.
-        Case-insensitive find is broken for unicode strings; the hashing optimization is
-        not unicode safe, and could result in false negatives.
-
-        Unify UString find methods to match String.
+        This speeds up the build by a few seconds on high-end Mac Pros.
 
-        * JavaScriptCore.exp:
-        * bytecode/CodeBlock.cpp:
-        (JSC::escapeQuotes):
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::substitute):
-        * runtime/JSString.cpp:
-        (JSC::JSString::replaceCharacter):
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        * runtime/RegExpKey.h:
-        (JSC::RegExpKey::getFlagsValue):
-        * runtime/StringPrototype.cpp:
-        (JSC::substituteBackreferencesSlow):
-        (JSC::substituteBackreferences):
-        (JSC::stringProtoFuncReplace):
-        (JSC::stringProtoFuncIndexOf):
-        (JSC::stringProtoFuncLastIndexOf):
-        (JSC::stringProtoFuncSplit):
-        * runtime/UString.cpp:
-        * runtime/UString.h:
-        (JSC::UString::find):
-        (JSC::UString::reverseFind):
-        * wtf/text/AtomicString.h:
-        (WTF::AtomicString::find):
-        * wtf/text/StringImpl.cpp:
-        (WTF::StringImpl::find):
-        (WTF::StringImpl::findCaseInsensitive):
-        (WTF::StringImpl::reverseFind):
-        (WTF::StringImpl::reverseFindCaseInsensitive):
-        (WTF::StringImpl::endsWith):
-        (WTF::StringImpl::replace):
-        * wtf/text/StringImpl.h:
-        (WTF::StringImpl::startsWith):
-        * wtf/text/WTFString.cpp:
-        (WTF::String::split):
-        * wtf/text/WTFString.h:
-        (WTF::String::find):
-        (WTF::String::reverseFind):
-        (WTF::String::findCaseInsensitive):
-        (WTF::String::reverseFindCaseInsensitive):
-        (WTF::String::contains):
-        (WTF::find):
-        (WTF::reverseFind):
-
-2010-08-16  Kevin Ollivier  <kevino@theolliviers.com>
-
-        [wx] Build fix, do not build WebCore as a convenience library as this leads to
-        errors in the Win build w/export symbols and causes problems with DOM bindings
-        debugging in gdb. 
-
-        * wscript:
-
-2010-08-16  Leandro Pereira  <leandro@profusion.mobi>
+        * JavaScriptCore.xcodeproj/project.pbxproj:
 
-        [EFL] Build fix after r65366.
+2011-03-01  David Kilzer  <ddkilzer@apple.com>
 
-        * CMakeLists.txt: Use if (VAR) instead of if (${VAR}) to check if
-        they're empty.
-        * jsc/CMakeLists.txt: Ditto.
-        * wtf/CMakeLists.txt: Ditto.
+        Spring cleaning!
 
-2010-08-15  Kevin Ollivier  <kevino@theolliviers.com>
+        Rubber-stamped by Mark Rowe.
 
-        [wx] Build fix, don't build intermediate source in DerivedSources dir.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        (Copy Into Framework): Remove "set -x" and its comment.
 
-        * wscript:
+2011-03-01  Michael Saboff  <msaboff@apple.com>
 
-2010-08-14  Patrick Gansterer  <paroga@paroga.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Kenneth Rohde Christiansen.
+        TinyMCE not working in nightlies
+        https://bugs.webkit.org/show_bug.cgi?id=54978
 
-        [CMake] Add preprocessor detection for generator scripts
-        https://bugs.webkit.org/show_bug.cgi?id=43984
+        Disabling setupBeginChars() to temporarily work arround the test 
+        failure.  Filed https://bugs.webkit.org/show_bug.cgi?id=55479
+        to track fixing the issue.
 
-        * CMakeLists.txt:
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPattern::compile):
 
-2010-08-14  Patrick Gansterer  <paroga@paroga.com>
+2011-02-23  Joseph Pecoraro  <joepeck@webkit.org>
 
         Reviewed by Kenneth Rohde Christiansen.
 
-        [CMake] Set target properties only if available
-        https://bugs.webkit.org/show_bug.cgi?id=43978
-
-        * CMakeLists.txt:
-        * jsc/CMakeLists.txt:
-        * wtf/CMakeLists.txt:
-
-2010-08-13  Kevin Ollivier  <kevino@theolliviers.com>
+        Viewport parsing no longer accepts "1.0;" value as valid.
+        https://bugs.webkit.org/show_bug.cgi?id=53705
 
-        [wx] Build fix, add CString to the list of forwards.
-
-        * wtf/Forward.h:
-
-2010-08-13  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-08-13  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-08-13  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-08-13  Gavin Barraclough  <barraclough@apple.com>
-
-        Rubber stamped by Sam Weinig.
-        Switch String::/UString::ascii() to return a CString.
+        Include a didReadNumber parameter to String -> float / double
+        conversion functions. This way, if the "ok" boolean out
+        parameter is false, you can check to see if there in fact
+        was a valid number parsed with garbage at the end. Examples
+        of that would be parsing "123x456" would have ok = false,
+        but didReadNumber = true.
 
         * JavaScriptCore.exp:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * bytecode/SamplingTool.cpp:
-        (JSC::SamplingTool::dump):
-        * interpreter/CallFrame.cpp:
-        (JSC::CallFrame::dumpCaller):
-        * jsc.cpp:
-        (runWithScripts):
-        (runInteractive):
-        * runtime/Identifier.h:
-        (JSC::Identifier::ascii):
-        * runtime/ScopeChain.cpp:
-        (JSC::ScopeChainNode::print):
-        * runtime/UString.cpp:
-        (JSC::UString::ascii):
-        (JSC::UString::latin1):
-        * runtime/UString.h:
         * wtf/text/StringImpl.cpp:
-        (WTF::StringImpl::asciiOLD):
+        (WTF::StringImpl::toDouble):
+        (WTF::StringImpl::toFloat):
         * wtf/text/StringImpl.h:
         * wtf/text/WTFString.cpp:
-        (WTF::String::ascii):
-        (WTF::String::latin1):
+        (WTF::String::toDouble):
+        (WTF::String::toFloat):
+        (WTF::charactersToDouble):
+        (WTF::charactersToFloat):
         * wtf/text/WTFString.h:
 
-2010-08-13  Gabor Loki  <loki@webkit.org>
+2011-02-28  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Gavin Barraclough.
 
-        Avoid increasing required alignment of target type warning on ARM
-        https://bugs.webkit.org/show_bug.cgi?id=38045
-
-        The reinterpret_cast<Type1*>([pointer to Type2]) expressions - where
-        sizeof(Type1) > sizeof(Type2) - cause the following warning on ARM:
-        increases required alignment of target type warnings.
-        Casting the type of [pointer to Type2] object to void* bypasses the
-        warning.
-
-        * assembler/ARMAssembler.cpp:
-        (JSC::ARMAssembler::executableCopy):
-        * assembler/AssemblerBuffer.h:
-        (JSC::AssemblerBuffer::putShortUnchecked):
-        (JSC::AssemblerBuffer::putIntUnchecked):
-        (JSC::AssemblerBuffer::putInt64Unchecked):
-        * interpreter/RegisterFile.h:
-        (JSC::RegisterFile::RegisterFile):
-        (JSC::RegisterFile::grow):
-        * jit/JITStubs.cpp:
-        * pcre/pcre_compile.cpp:
-        (jsRegExpCompile):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::increaseVectorLength):
-        (JSC::JSArray::increaseVectorPrefixLength):
-        (JSC::JSArray::shiftCount):
-        (JSC::JSArray::unshiftCount):
-        * wtf/FastMalloc.cpp:
-        (WTF::PageHeapAllocator::New):
-        (WTF::TCMalloc_Central_FreeList::Populate):
-        * wtf/MD5.cpp:
-        (WTF::reverseBytes):
-        (WTF::MD5::addBytes):
-        (WTF::MD5::checksum):
-        * wtf/StdLibExtras.h:
-        (isPointerTypeAlignmentOkay):
-        (reinterpret_cast_ptr):
-        * wtf/Vector.h:
-        (WTF::VectorBuffer::inlineBuffer):
-        * wtf/qt/StringQt.cpp:
-        (WTF::String::String):
-
-2010-08-13  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig
+        Past-the-end writes in VM exceptions (caused crashes in r79627)
+        https://bugs.webkit.org/show_bug.cgi?id=55448
+        
+        Some exceptions had the wrong structures, so they misoverestimated their
+        inline storage sizes.
 
-        Unify UString::UTF8String() & String::utf8() methods,
-        remove UString::cost() & make atArrayIndex a free function.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Use the right structure.
 
-        * JavaScriptCore.exp:
-        * bytecode/CodeBlock.cpp:
-        (JSC::constantName):
-        (JSC::idName):
-        (JSC::CodeBlock::registerName):
-        (JSC::regexpName):
-        (JSC::printGlobalResolveInfo):
-        (JSC::printStructureStubInfo):
-        (JSC::CodeBlock::printStructure):
-        (JSC::CodeBlock::printStructures):
-        * jsc.cpp:
-        (functionPrint):
-        (functionDebug):
-        (runInteractive):
-        (fillBufferWithContentsOfFile):
-        * pcre/pcre_exec.cpp:
-        (Histogram::~Histogram):
-        * profiler/CallIdentifier.h:
-        (JSC::CallIdentifier::c_str):
-        * profiler/Profile.cpp:
-        (JSC::Profile::debugPrintDataSampleStyle):
-        * profiler/ProfileGenerator.cpp:
-        (JSC::ProfileGenerator::willExecute):
-        (JSC::ProfileGenerator::didExecute):
-        * profiler/ProfileNode.cpp:
-        (JSC::ProfileNode::debugPrintData):
-        (JSC::ProfileNode::debugPrintDataSampleStyle):
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::getOwnPropertyDescriptor):
-        (JSC::Arguments::put):
-        (JSC::Arguments::deleteProperty):
-        * runtime/DateConversion.cpp:
-        (JSC::parseDate):
-        * runtime/Identifier.h:
-        (JSC::Identifier::toStrictUInt32):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::deleteProperty):
-        * runtime/JSArray.h:
-        (JSC::toArrayIndex):
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::encode):
-        (JSC::parseInt):
-        (JSC::globalFuncJSCPrint):
-        * runtime/JSString.h:
-        (JSC::RopeBuilder::JSString):
-        * runtime/UString.cpp:
-        (JSC::UString::toDouble):
-        (JSC::putUTF8Triple):
-        (JSC::UString::utf8):
-        * runtime/UString.h:
-        (JSC::UString::~UString):
-        (JSC::UString::isNull):
-        (JSC::UString::isEmpty):
-        (JSC::UString::impl):
-        * wtf/text/WTFString.cpp:
-        (WTF::String::utf8):
-        * wtf/text/WTFString.h:
-        (WTF::String::~String):
-        (WTF::String::swap):
-        (WTF::String::isNull):
-        (WTF::String::isEmpty):
-        (WTF::String::impl):
-        (WTF::String::length):
-        (WTF::String::String):
-        (WTF::String::isHashTableDeletedValue):
+        * runtime/JSObject.h:
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSFinalObject::JSFinalObject): ASSERT that our structure capacity
+        is correct to verify this doesn't happen again.
 
-2010-08-12  Zoltan Herczeg  <zherczeg@webkit.org>
+2011-03-01  Andras Becsi  <abecsi@webkit.org>
 
-        Reviewed by Gavin Barraclough.
+        Reviewed by Csaba Osztrogonác.
 
-        Refactoring the fpu code generator for the ARM port
-        https://bugs.webkit.org/show_bug.cgi?id=43842
+        [Qt] Clean up the project files and move common options to WebKit.pri.
 
-        Support up to 32 double precision registers, and the
-        recent VFP instruction formats. This patch is mainly
-        a style change which keeps the current functionality.
+        * JavaScriptCore.pri: Move options also needed in WebCore into WebKit.pri.
+        * JavaScriptCore.pro: Deduplicate options.
+        * jsc.pro: Ditto.
 
-        * assembler/ARMAssembler.h:
-        (JSC::ARMRegisters::):
-        (JSC::ARMAssembler::):
-        (JSC::ARMAssembler::emitInst):
-        (JSC::ARMAssembler::emitDoublePrecisionInst):
-        (JSC::ARMAssembler::emitSinglePrecisionInst):
-        (JSC::ARMAssembler::vadd_f64_r):
-        (JSC::ARMAssembler::vdiv_f64_r):
-        (JSC::ARMAssembler::vsub_f64_r):
-        (JSC::ARMAssembler::vmul_f64_r):
-        (JSC::ARMAssembler::vcmp_f64_r):
-        (JSC::ARMAssembler::vsqrt_f64_r):
-        (JSC::ARMAssembler::vmov_vfp_r):
-        (JSC::ARMAssembler::vmov_arm_r):
-        (JSC::ARMAssembler::vcvt_f64_s32_r):
-        (JSC::ARMAssembler::vcvt_s32_f64_r):
-        (JSC::ARMAssembler::vmrs_apsr):
-        * assembler/MacroAssemblerARM.h:
-        (JSC::MacroAssemblerARM::addDouble):
-        (JSC::MacroAssemblerARM::divDouble):
-        (JSC::MacroAssemblerARM::subDouble):
-        (JSC::MacroAssemblerARM::mulDouble):
-        (JSC::MacroAssemblerARM::sqrtDouble):
-        (JSC::MacroAssemblerARM::convertInt32ToDouble):
-        (JSC::MacroAssemblerARM::branchDouble):
-        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+2011-03-01  Adam Barth  <abarth@webkit.org>
 
-2010-08-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+        Reviewed by Eric Seidel.
 
-        Unreviewed, rolling out r65295.
-        http://trac.webkit.org/changeset/65295
-        https://bugs.webkit.org/show_bug.cgi?id=43950
+        Teach JavaScriptCore GYP build about DEPTH
+        https://bugs.webkit.org/show_bug.cgi?id=55425
 
-        It broke 4 sputnik tests (Requested by Ossy on #webkit).
+        In addition to teaching the JavaScriptCore GYP build about DEPTH, this
+        change overrides the GCC warning configuration to disable a warning
+        that's causing probems in Assertions.cpp.  With that warning disabled,
+        JavaScriptCore builds again.
 
-        * JavaScriptCore.exp:
-        * bytecode/CodeBlock.cpp:
-        (JSC::constantName):
-        (JSC::idName):
-        (JSC::CodeBlock::registerName):
-        (JSC::regexpName):
-        (JSC::printGlobalResolveInfo):
-        (JSC::printStructureStubInfo):
-        (JSC::CodeBlock::printStructure):
-        (JSC::CodeBlock::printStructures):
-        * jsc.cpp:
-        (functionPrint):
-        (functionDebug):
-        (runInteractive):
-        (fillBufferWithContentsOfFile):
-        * pcre/pcre_exec.cpp:
-        (Histogram::~Histogram):
-        * profiler/CallIdentifier.h:
-        (JSC::CallIdentifier::c_str):
-        * profiler/Profile.cpp:
-        (JSC::Profile::debugPrintDataSampleStyle):
-        * profiler/ProfileGenerator.cpp:
-        (JSC::ProfileGenerator::willExecute):
-        (JSC::ProfileGenerator::didExecute):
-        * profiler/ProfileNode.cpp:
-        (JSC::ProfileNode::debugPrintData):
-        (JSC::ProfileNode::debugPrintDataSampleStyle):
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::getOwnPropertyDescriptor):
-        (JSC::Arguments::put):
-        (JSC::Arguments::deleteProperty):
-        * runtime/DateConversion.cpp:
-        (JSC::parseDate):
-        * runtime/Identifier.h:
-        (JSC::Identifier::Identifier):
-        (JSC::Identifier::toArrayIndex):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::deleteProperty):
-        * runtime/JSArray.h:
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::encode):
-        (JSC::parseInt):
-        (JSC::globalFuncJSCPrint):
-        * runtime/JSString.h:
-        (JSC::RopeBuilder::JSString):
-        * runtime/UString.cpp:
-        (JSC::UString::toDouble):
-        (JSC::UString::UTF8String):
-        * runtime/UString.h:
-        (JSC::UString::isNull):
-        (JSC::UString::isEmpty):
-        (JSC::UString::impl):
-        (JSC::UString::cost):
-        (JSC::UString::~UString):
-        (JSC::UString::toArrayIndex):
-        * wtf/text/WTFString.cpp:
-        (WTF::String::utf8):
-        * wtf/text/WTFString.h:
-        (WTF::String::String):
-        (WTF::String::isHashTableDeletedValue):
-        (WTF::String::length):
-        (WTF::String::operator[]):
-        (WTF::String::isNull):
-        (WTF::String::isEmpty):
-        (WTF::String::impl):
+        * gyp/JavaScriptCore.gyp:
 
-2010-08-12  Gavin Barraclough  <barraclough@apple.com>
+2011-02-28  Gavin Barraclough  <barraclough@apple.com>
 
         Windows build fix.
 
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-2010-08-12  Gavin Barraclough  <barraclough@apple.com>
+2011-02-28  Sheriff Bot  <webkit.review.bot@gmail.com>
 
-        Reviewed by Sam Weinig
+        Unreviewed, rolling out r79948.
+        http://trac.webkit.org/changeset/79948
+        https://bugs.webkit.org/show_bug.cgi?id=55439
 
-        Unify UString::UTF8String() & String::utf8() methods,
-        remove UString::cost() & make atArrayIndex a free function.
-
-        * JavaScriptCore.exp:
-        * bytecode/CodeBlock.cpp:
-        (JSC::constantName):
-        (JSC::idName):
-        (JSC::CodeBlock::registerName):
-        (JSC::regexpName):
-        (JSC::printGlobalResolveInfo):
-        (JSC::printStructureStubInfo):
-        (JSC::CodeBlock::printStructure):
-        (JSC::CodeBlock::printStructures):
-        * jsc.cpp:
-        (functionPrint):
-        (functionDebug):
-        (runInteractive):
-        (fillBufferWithContentsOfFile):
-        * pcre/pcre_exec.cpp:
-        (Histogram::~Histogram):
-        * profiler/CallIdentifier.h:
-        (JSC::CallIdentifier::c_str):
-        * profiler/Profile.cpp:
-        (JSC::Profile::debugPrintDataSampleStyle):
-        * profiler/ProfileGenerator.cpp:
-        (JSC::ProfileGenerator::willExecute):
-        (JSC::ProfileGenerator::didExecute):
-        * profiler/ProfileNode.cpp:
-        (JSC::ProfileNode::debugPrintData):
-        (JSC::ProfileNode::debugPrintDataSampleStyle):
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::getOwnPropertyDescriptor):
-        (JSC::Arguments::put):
-        (JSC::Arguments::deleteProperty):
-        * runtime/DateConversion.cpp:
-        (JSC::parseDate):
-        * runtime/Identifier.h:
-        (JSC::Identifier::toStrictUInt32):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::deleteProperty):
-        * runtime/JSArray.h:
-        (JSC::toArrayIndex):
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::encode):
-        (JSC::parseInt):
-        (JSC::globalFuncJSCPrint):
-        * runtime/JSString.h:
-        (JSC::RopeBuilder::JSString):
-        * runtime/UString.cpp:
-        (JSC::UString::toDouble):
-        (JSC::putUTF8Triple):
-        (JSC::UString::utf8):
-        * runtime/UString.h:
-        (JSC::UString::~UString):
-        (JSC::UString::isNull):
-        (JSC::UString::isEmpty):
-        (JSC::UString::impl):
-        * wtf/text/WTFString.cpp:
-        (WTF::String::utf8):
-        * wtf/text/WTFString.h:
-        (WTF::String::~String):
-        (WTF::String::swap):
-        (WTF::String::isNull):
-        (WTF::String::isEmpty):
-        (WTF::String::impl):
-        (WTF::String::length):
-        (WTF::String::String):
-        (WTF::String::isHashTableDeletedValue):
-
-2010-08-12  Gavin Barraclough  <barraclough@apple.com>
-
-        Eeerk! - revert accidentally committed changes in UString!
-
-        * JavaScriptCore.exp:
-        * runtime/UString.cpp:
-        (JSC::UString::UString):
-        * runtime/UString.h:
-
-2010-08-12  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig
-
-        Change UString constructors to match those in WTF::String.
-        This changes behaviour of UString((char*)0) to create null
-        strings, akin to UString() rather than UString::empty().
-        (This matches String).  Remove unused constructors from
-        UString, and add null-terminated UTF-16 constructor, to
-        match String.  Move String's constructor into the .cpp to
-        match UString.
-
-        * JavaScriptCore.exp:
-        * debugger/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::calculatedFunctionName):
-        * runtime/RegExpKey.h:
-        (JSC::RegExpKey::RegExpKey):
-        * runtime/SmallStrings.cpp:
-        (JSC::SmallStrings::createSingleCharacterString):
-        * runtime/UString.cpp:
-        (JSC::UString::UString):
-        * runtime/UString.h:
-        (JSC::UString::UString):
-        (JSC::UString::swap):
-        (JSC::UString::adopt):
-        (JSC::UString::operator[]):
-        * wtf/text/WTFString.h:
-        (WTF::String::String):
-        (WTF::String::adopt):
-        (WTF::String::operator[]):
-
-2010-08-12  David Levin  <levin@chromium.org>
-
-        Reviewed by NOBODY (build fix).
-
-        * runtime/UString.h: Removed unneccessary #include.
-
-2010-08-12  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig
-
-        Revert changes to ALWAYS_INLINEness of a couple of functions in UString.
-        This appears to have degraded performance.
-
-        * runtime/UString.cpp:
-        (JSC::UString::ascii):
-        * runtime/UString.h:
-        (JSC::UString::length):
-        (JSC::UString::isEmpty):
-        (JSC::UString::~UString):
-
-2010-08-12  Csaba Osztrogonác  <ossy@webkit.org>
-
-        Reviewed by Antonio Gomes.
-
-        [Qt] Fix warnings: unknown conversion type character 'l' in format
-        https://bugs.webkit.org/show_bug.cgi?id=43359
-
-        Qt port doesn't call any printf in String::format(...), consequently
-        using __attribute__((format(printf,m,n))) is incorrect and causes
-        false positive warnings on Windows if you build with MinGW.
-
-        Qt port calls QString::vsprintf(...) , which is platform
-        independent, and handles %lli, %llu and %llx on all platforms.
-        (http://trac.webkit.org/changeset/35712)
-
-        * wtf/text/WTFString.h:
-
-2010-08-12  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Fix the array subscript is above array bounds warning in ByteArray on ARM.
-        https://bugs.webkit.org/show_bug.cgi?id=43358
-
-        The warning is very similar to this one: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37861
-
-        * wtf/ByteArray.cpp:
-        (WTF::ByteArray::create):
-
-2010-08-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Reviewed by Martin Robinson.
-
-        [GTK] Use GSettings to save/restore Web Inspector settings
-        https://bugs.webkit.org/show_bug.cgi?id=43512
-
-        * wtf/gobject/GRefPtr.cpp: Added support for GVariant, used by our
-        GSettings support.
-        (WTF::refGPtr):
-        (WTF::derefGPtr):
-        * wtf/gobject/GRefPtr.h:
-
-2010-08-12  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        The scratch register should be saved in YARR with ARM JIT
-        https://bugs.webkit.org/show_bug.cgi?id=43910
-
-        Reported by Jocelyn Turcotte.
+        "caused crashes on the SL release bot" (Requested by ggaren on
+        #webkit).
 
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::generateEnter):
-        (JSC::Yarr::RegexGenerator::generateReturn):
+        * runtime/JSGlobalData.h:
+        * runtime/WriteBarrier.h:
 
-2010-08-11  Gavin Barraclough  <barraclough@apple.com>
+2011-02-28  Gavin Barraclough  <barraclough@apple.com>
 
         Windows build fix.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/Forward.h:
-
-2010-08-11  Leo Yang  <leo.yang@torchmobile.com.cn>
-
-        Reviewed by Geoffrey Garen.
-
-        Date("") should be an invalid date. For IE, Firefox and Chrome, Date("") is invalid date,
-        which means isNaN(new Date("")) should return true.
-        https://bugs.webkit.org/show_bug.cgi?id=43793
-        Tests: fast/js/date-constructor.html
-
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::resetDateCache):
-
-2010-08-11  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows & !JIT build fix.
-
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::match):
-
-2010-08-11  Gavin Barraclough  <barraclough@apple.com>
-
-        Rubber stamp by sam weinig
-
-        Touch a file to stop the bot rolling a bit change out!
-
-        * runtime/UString.cpp:
-        (JSC::UString::ascii):
-
-2010-08-11  Kevin Ollivier  <kevino@theolliviers.com>
 
-        [wx] Build fix for wx and WebDOM bindings, add CString classes to the list of forwards.
+2011-02-28  Gavin Barraclough  <barraclough@apple.com>
 
-        * wtf/Forward.h:
+        Reviewed by Sam Weinig & Darin Adler.
 
-2010-08-11  Gavin Barraclough  <barraclough@apple.com>
+        Bug 55423 - Clean up property tables in Structure
 
-        Rubber stamps by Darin Adler & Sam Weinig.
+        Encapsulate, reduce duplication of table search code,
+        and reduce the size of the tables (remove the index,
+        just maintain the tables in the correct order).
 
-        Bug 43867 - Some UString cleanup
+        Shows a 0.5% - 1% progression on sunspider.
 
-        Change JSC::UString data(), size(), and from(), to characters(), length(), and number() to match WTF::String.
-        Move string concatenation methods to a new header to simplify down UString.h.  Remove is8Bit().
-
-        * API/JSClassRef.cpp:
-        (OpaqueJSClass::~OpaqueJSClass):
-        (OpaqueJSClass::className):
-        * API/OpaqueJSString.cpp:
-        (OpaqueJSString::create):
         * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * bytecode/CodeBlock.cpp:
-        (JSC::constantName):
-        (JSC::idName):
-        (JSC::CodeBlock::registerName):
-        (JSC::regexpName):
-        * bytecode/EvalCodeCache.h:
-        (JSC::EvalCodeCache::get):
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::ResolveNode::emitBytecode):
-        (JSC::FunctionCallResolveNode::emitBytecode):
-        (JSC::ReadModifyResolveNode::emitBytecode):
-        (JSC::processClauseList):
-        * parser/ASTBuilder.h:
-        (JSC::ASTBuilder::createRegex):
-        * parser/ParserArena.h:
-        (JSC::IdentifierArena::makeNumericIdentifier):
-        * parser/SourceProvider.h:
-        (JSC::UStringSourceProvider::data):
-        (JSC::UStringSourceProvider::length):
-        * profiler/Profiler.cpp:
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::getOwnPropertyNames):
-        (JSC::Arguments::put):
-        (JSC::Arguments::deleteProperty):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncToString):
-        * runtime/DatePrototype.cpp:
-        (JSC::formatLocaleDate):
-        * runtime/ExceptionHelpers.cpp:
-        * runtime/FunctionConstructor.cpp:
-        * runtime/FunctionPrototype.cpp:
-        (JSC::insertSemicolonIfNeeded):
-        * runtime/Identifier.h:
-        (JSC::Identifier::characters):
-        (JSC::Identifier::length):
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::decode):
-        (JSC::parseInt):
-        (JSC::parseFloat):
-        (JSC::globalFuncEscape):
-        (JSC::globalFuncUnescape):
-        * runtime/JSNumberCell.cpp:
-        (JSC::JSNumberCell::toString):
-        * runtime/JSONObject.cpp:
-        (JSC::gap):
-        (JSC::Stringifier::appendQuotedString):
-        (JSC::Stringifier::appendStringifiedValue):
-        (JSC::Stringifier::indent):
-        (JSC::Stringifier::unindent):
-        (JSC::Walker::walk):
-        * runtime/JSString.cpp:
-        (JSC::JSString::replaceCharacter):
-        (JSC::JSString::getIndexSlowCase):
-        * runtime/JSString.h:
-        (JSC::RopeBuilder::JSString):
-        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
-        (JSC::RopeBuilder::fiberCount):
-        (JSC::jsSingleCharacterSubstring):
-        (JSC::jsNontrivialString):
-        (JSC::JSString::getIndex):
-        (JSC::jsString):
-        (JSC::jsStringWithFinalizer):
-        (JSC::jsSubstring):
-        (JSC::jsOwnedString):
-        * runtime/JSStringBuilder.h:
-        (JSC::JSStringBuilder::append):
-        * runtime/LiteralParser.h:
-        (JSC::LiteralParser::Lexer::Lexer):
-        * runtime/NumberPrototype.cpp:
-        (JSC::numberProtoFuncToString):
-        (JSC::numberProtoFuncToFixed):
-        (JSC::numberProtoFuncToExponential):
-        (JSC::numberProtoFuncToPrecision):
-        * runtime/NumericStrings.h:
-        (JSC::NumericStrings::add):
-        (JSC::NumericStrings::lookupSmallString):
-        * runtime/Operations.h:
-        (JSC::jsString):
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::match):
-        * runtime/RegExpCache.cpp:
-        (JSC::RegExpCache::lookupOrCreate):
-        (JSC::RegExpCache::create):
-        * runtime/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::getRightContext):
-        * runtime/RegExpObject.cpp:
-        (JSC::RegExpObject::match):
-        * runtime/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncToString):
-        * runtime/StringBuilder.h:
-        (JSC::StringBuilder::append):
-        * runtime/StringConcatenate.h: Copied from JavaScriptCore/runtime/UString.h.
-        (JSC::):
-        (JSC::sumWithOverflow):
-        (JSC::tryMakeString):
-        (JSC::makeString):
-        * runtime/StringObject.cpp:
-        (JSC::StringObject::getOwnPropertyNames):
-        * runtime/StringPrototype.cpp:
-        (JSC::substituteBackreferencesSlow):
-        (JSC::localeCompare):
-        (JSC::jsSpliceSubstringsWithSeparators):
-        (JSC::stringProtoFuncReplace):
-        (JSC::stringProtoFuncCharAt):
-        (JSC::stringProtoFuncCharCodeAt):
-        (JSC::stringProtoFuncIndexOf):
-        (JSC::stringProtoFuncLastIndexOf):
-        (JSC::stringProtoFuncSlice):
-        (JSC::stringProtoFuncSplit):
-        (JSC::stringProtoFuncSubstr):
-        (JSC::stringProtoFuncSubstring):
-        (JSC::stringProtoFuncToLowerCase):
-        (JSC::stringProtoFuncToUpperCase):
-        (JSC::stringProtoFuncFontsize):
-        (JSC::stringProtoFuncLink):
-        (JSC::trimString):
-        * runtime/UString.cpp:
-        (JSC::UString::number):
-        (JSC::UString::ascii):
-        (JSC::UString::operator[]):
-        (JSC::UString::toDouble):
-        (JSC::UString::find):
-        (JSC::UString::rfind):
-        (JSC::UString::substr):
-        (JSC::operator==):
-        (JSC::operator<):
-        (JSC::operator>):
-        (JSC::UString::UTF8String):
-        * runtime/UString.h:
-        (JSC::UString::UString):
-        (JSC::UString::adopt):
-        (JSC::UString::length):
-        (JSC::UString::characters):
-        (JSC::UString::isNull):
-        (JSC::UString::isEmpty):
-        (JSC::UString::impl):
-        (JSC::UString::cost):
-        (JSC::operator==):
-        (JSC::operator!=):
-        (JSC::codePointCompare):
-        (JSC::UString::toArrayIndex):
-        (JSC::IdentifierRepHash::hash):
-        (WTF::):
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::jitCompileRegex):
-        * yarr/RegexParser.h:
-        (JSC::Yarr::Parser::Parser):
-
-2010-08-11  Gabor Loki  <loki@webkit.org>
-
-        Qt build fix (ARMv7).
-
-        Fix invalid conversion from int to Condition.
-        Add ARMv7Assembler.cpp to JavaScriptCore.pro.
-
-        * JavaScriptCore.pro:
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::):
-        (JSC::ARMv7Assembler::JmpSrc::JmpSrc):
-
-2010-08-11  Nathan Lawrence  <nlawrence@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        At collection time, we frequently want to mark a cell, while checking
-        whether it was originally checked.  Previously, this was a get
-        operation follwed by a set operation.  Fusing the two saves
-        computation and gives a 0.5% sunspider speedup.
-
-        * runtime/Collector.h:
-        (JSC::CollectorBitmap::getset):
-        (JSC::Heap::checkMarkCell):
-        * runtime/JSArray.h:
-        (JSC::MarkStack::drain):
-        * runtime/JSCell.h:
-        (JSC::MarkStack::append):
-
-2010-08-11  Steve Falkenburg  <sfalken@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Improve vsprops copying for Windows build
-        https://bugs.webkit.org/show_bug.cgi?id=41982
-
-        When we detect a new SDK, always copy a new set of vsprops files.
-        Previously, if someone updated their SDK after updating their sources,
-        they could end up with out-of-date vsprops files.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
-
-2010-08-10  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Add leakRef and clear to all RefPtr variants
-        https://bugs.webkit.org/show_bug.cgi?id=42389
-
-        * API/JSRetainPtr.h: Changed all uses of "template <...>" to instead do
-        "template<...>". We should probably put this in the style guide and do it
-        consitently. Fixed other minor style issues. Defined many of the inlined
-        functions outside the class definition, to avoid style checker warnings
-        about multiple statements on a single line and for slightly better clarity
-        of the class definition itself. Renamed releaseRef to leakRef. Added a
-        releaseRef that calls leakRef so we don't have to rename all callers oat
-        once. Added a clear function.
-
-        * wtf/PassRefPtr.h: Changed all uses of releaseRef to leakRef.
-n
-        * wtf/RefPtr.h: Changed all uses of "template <...>" to instead do
-        "template<...>". Tidied up declarations and comments a bit.
-         Changed all uses of releaseRef to leakRef.
-
-        * wtf/RetainPtr.h: Changed all uses of "template <...>" to instead do
-        "template<...>". Defined many of the inlined functions outside the class
-        definition, to avoid style checker warnings about multiple statements on
-        a single line and for slightly better clarity of the class definition itself.
-        Renamed releaseRef to leakRef. Added a releaseRef that calls leakRef so we
-        don't have to rename all callers at once. Added a clear function.
-
-2010-08-10  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Unreviewed, reverting an unintentional change to a file submitted in r65108.
-
-        * bytecode/CodeBlock.h:
-        (JSC::binaryChop):
-
-2010-08-10  Gavin Barraclough  <barraclough@apple.com>
-
-        Rubber stamped by Sam Weinig
-
-        Bug 43817 - Remove UString::Rep
-        UString::Rep has for a long time been replaced by UStringImpl (Rep
-        remaining as a typedef).  UStringImpl has since been removed too
-        (unified with StringImpl). Remove Rep, rename rep() to impl() and
-        m_rep to m_impl.  Also add impl() method to Identifier, and rename
-        its UString member from _ustring to m_string.
-
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
-        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::deletePrivateProperty):
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::getOwnPropertySlot):
-        (JSC::::put):
-        (JSC::::deleteProperty):
-        (JSC::::getOwnPropertyNames):
-        (JSC::::staticValueGetter):
-        (JSC::::staticFunctionGetter):
-        * API/JSClassRef.cpp:
-        (tryCreateStringFromUTF8):
-        (OpaqueJSClass::OpaqueJSClass):
-        (OpaqueJSClass::~OpaqueJSClass):
-        (OpaqueJSClassContextData::OpaqueJSClassContextData):
-        * API/JSClassRef.h:
-        * API/OpaqueJSString.cpp:
-        (OpaqueJSString::ustring):
-        * bytecode/EvalCodeCache.h:
-        (JSC::EvalCodeCache::get):
-        * bytecode/JumpTable.h:
-        (JSC::StringJumpTable::offsetForValue):
-        (JSC::StringJumpTable::ctiForValue):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::addVar):
-        (JSC::BytecodeGenerator::addGlobalVar):
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::addParameter):
-        (JSC::BytecodeGenerator::registerFor):
-        (JSC::BytecodeGenerator::willResolveToArguments):
-        (JSC::BytecodeGenerator::uncheckedRegisterForArguments):
-        (JSC::BytecodeGenerator::constRegisterFor):
-        (JSC::BytecodeGenerator::isLocal):
-        (JSC::BytecodeGenerator::isLocalConstant):
-        (JSC::BytecodeGenerator::addConstant):
-        (JSC::BytecodeGenerator::emitLoad):
-        (JSC::BytecodeGenerator::findScopedProperty):
-        (JSC::keyForCharacterSwitch):
-        (JSC::prepareJumpTableForStringSwitch):
-        * bytecompiler/BytecodeGenerator.h:
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::processClauseList):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * parser/JSParser.cpp:
-        (JSC::JSParser::parseStrictObjectLiteral):
-        * pcre/pcre_exec.cpp:
-        (Histogram::add):
-        * profiler/CallIdentifier.h:
-        (JSC::CallIdentifier::Hash::hash):
-        * profiler/Profile.cpp:
-        * profiler/ProfileNode.cpp:
-        (JSC::ProfileNode::debugPrintDataSampleStyle):
-        * profiler/ProfileNode.h:
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncToString):
-        * runtime/Identifier.cpp:
-        (JSC::Identifier::equal):
-        (JSC::IdentifierCStringTranslator::hash):
-        (JSC::IdentifierCStringTranslator::equal):
-        (JSC::IdentifierCStringTranslator::translate):
-        (JSC::Identifier::add):
-        (JSC::IdentifierUCharBufferTranslator::hash):
-        (JSC::IdentifierUCharBufferTranslator::equal):
-        (JSC::IdentifierUCharBufferTranslator::translate):
-        (JSC::Identifier::addSlowCase):
-        * runtime/Identifier.h:
-        (JSC::Identifier::Identifier):
-        (JSC::Identifier::ustring):
-        (JSC::Identifier::impl):
-        (JSC::Identifier::data):
-        (JSC::Identifier::size):
-        (JSC::Identifier::ascii):
-        (JSC::Identifier::isNull):
-        (JSC::Identifier::isEmpty):
-        (JSC::Identifier::toUInt32):
-        (JSC::Identifier::toStrictUInt32):
-        (JSC::Identifier::toArrayIndex):
-        (JSC::Identifier::toDouble):
-        (JSC::Identifier::equal):
-        (JSC::Identifier::add):
-        * runtime/InitializeThreading.cpp:
-        (JSC::initializeThreadingOnce):
-        * runtime/InternalFunction.cpp:
-        (JSC::InternalFunction::displayName):
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::displayName):
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::addStaticGlobals):
-        * runtime/JSStaticScopeObject.h:
-        (JSC::JSStaticScopeObject::JSStaticScopeObject):
-        * runtime/JSString.h:
-        (JSC::):
-        (JSC::RopeBuilder::appendStringInConstruct):
-        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
-        (JSC::jsSingleCharacterSubstring):
-        (JSC::jsSubstring):
-        * runtime/JSVariableObject.cpp:
-        (JSC::JSVariableObject::deleteProperty):
-        (JSC::JSVariableObject::symbolTableGet):
-        * runtime/JSVariableObject.h:
-        (JSC::JSVariableObject::symbolTableGet):
-        (JSC::JSVariableObject::symbolTablePut):
-        (JSC::JSVariableObject::symbolTablePutWithAttributes):
-        * runtime/Lookup.cpp:
-        (JSC::HashTable::createTable):
-        (JSC::HashTable::deleteTable):
-        * runtime/Lookup.h:
-        (JSC::HashEntry::initialize):
-        (JSC::HashEntry::setKey):
-        (JSC::HashEntry::key):
-        (JSC::HashTable::entry):
         * runtime/PropertyMapHashTable.h:
+        (JSC::isPowerOf2):
+        (JSC::nextPowerOf2):
+            bit ops used to calculate table size.
         (JSC::PropertyMapEntry::PropertyMapEntry):
-        * runtime/PropertyNameArray.cpp:
-        (JSC::PropertyNameArray::add):
-        * runtime/PropertyNameArray.h:
-        (JSC::PropertyNameArray::add):
-        (JSC::PropertyNameArray::addKnownUnique):
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::match):
-        * runtime/RegExpCache.cpp:
-        (JSC::RegExpCache::create):
-        * runtime/RegExpKey.h:
-        (JSC::RegExpKey::RegExpKey):
-        * runtime/SmallStrings.cpp:
-        (JSC::SmallStringsStorage::rep):
-        (JSC::SmallStrings::singleCharacterStringRep):
-        * runtime/SmallStrings.h:
-        * runtime/StringPrototype.cpp:
-        (JSC::jsSpliceSubstringsWithSeparators):
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
+        (JSC::PropertyTable::ordered_iterator::operator++):
+        (JSC::PropertyTable::ordered_iterator::operator==):
+        (JSC::PropertyTable::ordered_iterator::operator!=):
+        (JSC::PropertyTable::ordered_iterator::operator*):
+        (JSC::PropertyTable::ordered_iterator::operator->):
+        (JSC::PropertyTable::ordered_iterator::ordered_iterator):
+            implementation of the iterator types
+        (JSC::PropertyTable::PropertyTable):
+        (JSC::PropertyTable::~PropertyTable):
+            constructors take an initial capacity for the table,
+            a table to copy, or both.
+        (JSC::PropertyTable::begin):
+        (JSC::PropertyTable::end):
+            create in-order iterators.
+        (JSC::PropertyTable::find):
+            search the hash table
+        (JSC::PropertyTable::add):
+            add a value to the hash table
+        (JSC::PropertyTable::remove):
+            remove a value from the hash table
+        (JSC::PropertyTable::size):
+        (JSC::PropertyTable::isEmpty):
+            accessors.
+        (JSC::PropertyTable::propertyStorageSize):
+        (JSC::PropertyTable::clearDeletedOffsets):
+        (JSC::PropertyTable::hasDeletedOffset):
+        (JSC::PropertyTable::getDeletedOffset):
+        (JSC::PropertyTable::addDeletedOffset):
+            cache deleted (available) offsets in the property storage array.
+        (JSC::PropertyTable::copy):
+            take a copy of the PropertyTable, potentially expanding the capacity.
+        (JSC::PropertyTable::sizeInMemory):
+            used for DEBUG build statistics
+        (JSC::PropertyTable::reinsert):
+        (JSC::PropertyTable::rehash):
+        (JSC::PropertyTable::tableCapacity):
+        (JSC::PropertyTable::deletedEntryIndex):
+        (JSC::PropertyTable::skipDeletedEntries):
+        (JSC::PropertyTable::table):
+        (JSC::PropertyTable::usedCount):
+        (JSC::PropertyTable::dataSize):
+        (JSC::PropertyTable::sizeForCapacity):
+        (JSC::PropertyTable::canInsert):
+            these methods provide internal implementation.
         * runtime/Structure.cpp:
+        (JSC::Structure::dumpStatistics):
         (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
         (JSC::Structure::despecifyDictionaryFunction):
-        (JSC::Structure::addPropertyTransitionToExistingStructure):
         (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
         (JSC::Structure::copyPropertyTable):
         (JSC::Structure::get):
         (JSC::Structure::despecifyFunction):
+        (JSC::Structure::despecifyAllFunctions):
         (JSC::Structure::put):
-        (JSC::Structure::hasTransition):
         (JSC::Structure::remove):
+        (JSC::Structure::createPropertyMap):
+        (JSC::Structure::getPropertyNames):
+        (JSC::PropertyTable::checkConsistency):
         (JSC::Structure::checkConsistency):
+            factored out code to PropertyMapHashTable.h
         * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+        (JSC::Structure::isEmpty):
         (JSC::Structure::get):
-        (JSC::Structure::hasTransition):
-        * runtime/StructureTransitionTable.h:
-        * runtime/SymbolTable.h:
-        * runtime/UString.cpp:
-        (JSC::UString::UString):
-        (JSC::UString::toStrictUInt32):
-        (JSC::UString::substr):
-        * runtime/UString.h:
-        (JSC::UString::UString):
-        (JSC::UString::adopt):
-        (JSC::UString::data):
-        (JSC::UString::size):
-        (JSC::UString::isNull):
-        (JSC::UString::isEmpty):
-        (JSC::UString::impl):
-        (JSC::UString::cost):
-        (JSC::operator==):
-        (JSC::codePointCompare):
-        (JSC::IdentifierRepHash::hash):
-        (WTF::):
-
-2010-08-10  Gavin Barraclough  <barraclough@apple.com>
-
-        Bug 43816 - Remove UStringImpl
-        The class was actually removed a long time ago, replaced by StringImpl.
-        UStringImpl is just a typedef onto StringImpl.  Remove this.
+            factored out code to PropertyMapHashTable.h
 
-        * API/JSClassRef.cpp:
-        (OpaqueJSClass::OpaqueJSClass):
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/JSString.cpp:
-        (JSC::JSString::resolveRope):
-        (JSC::JSString::replaceCharacter):
-        * runtime/JSString.h:
-        (JSC::RopeBuilder::RopeIterator::operator*):
-        (JSC::RopeBuilder::JSString):
-        (JSC::RopeBuilder::appendStringInConstruct):
-        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
-        (JSC::jsSingleCharacterSubstring):
-        (JSC::jsSubstring):
-        * runtime/JSStringBuilder.h:
-        (JSC::jsMakeNontrivialString):
-        * runtime/RopeImpl.cpp:
-        (JSC::RopeImpl::derefFibersNonRecursive):
-        * runtime/RopeImpl.h:
-        (JSC::RopeImpl::deref):
-        * runtime/SmallStrings.cpp:
-        (JSC::SmallStringsStorage::SmallStringsStorage):
-        * runtime/StringConstructor.cpp:
-        (JSC::stringFromCharCodeSlowCase):
-        * runtime/StringPrototype.cpp:
-        (JSC::jsSpliceSubstringsWithSeparators):
-        (JSC::stringProtoFuncFontsize):
-        (JSC::stringProtoFuncLink):
-        * runtime/UString.cpp:
-        (JSC::initializeUString):
-        * runtime/UString.h:
-        (JSC::UString::adopt):
-        (JSC::tryMakeString):
-        (JSC::makeString):
-        * runtime/UStringImpl.h: Removed.
-
-2010-08-10  Patrick Gansterer  <paroga@paroga.com>
+2011-02-28  Xan Lopez  <xlopez@igalia.com>
 
-        Reviewed by Eric Seidel.
+        Another fix build :(
 
-        Make FastMalloc more portable.
-        https://bugs.webkit.org/show_bug.cgi?id=41790
+        Fix typo.
 
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_Central_FreeList::Populate):
-        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
-
-2010-08-10  Patrick Gansterer  <paroga@paroga.com>
-
-        Reviewed by David Levin.
-
-        [WINCE] Buildfix for CE 6.0
-        https://bugs.webkit.org/show_bug.cgi?id=43027
-
-        CE 6.0 doesn't define localtime in the system include files.
-
-        * wtf/Platform.h: Include ce_time.h on all OS(WINCE).
-
-2010-08-10  Gavin Barraclough  <barraclough@apple.com>
-
-        Rubber stamped by Sam Weinig.
-
-        Bug 43786 - Move AtomicStringHash from WebCore to WTF
-        Also remove deprecated string headers from WebCore/platform/text.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/text/AtomicString.h:
-        * wtf/text/AtomicStringHash.h: Copied from WebCore/platform/text/AtomicStringHash.h.
-
-2010-08-09  Oliver Hunt  <oliver@apple.com>
-
-        Fix Qt/ARM again, this time including the other changed file.
-
-        * jit/JIT.h:
-
-2010-08-09  Oliver Hunt  <oliver@apple.com>
-
-        Fix Qt/ARM
-
-        C++ overload resolution I stab at thee
-
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::beginUninterruptedSequence):
-        (JSC::JIT::endUninterruptedSequence):
-
-2010-08-09  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Allow an assembler/macroassembler to compact branches to more concise forms when linking
-        https://bugs.webkit.org/show_bug.cgi?id=43745
-
-        This patch makes it possible for an assembler to convert jumps into a different
-        (presumably more efficient) form at link time.  Currently implemented in the
-        ARMv7 JIT as that already had logic to delay linking of jumps until the end of
-        compilation already.  The ARMv7 JIT chooses between either a 4 byte short jump
-        or a full 32-bit offset (and rewrites ITTT instructions as appropriate), so does
-        not yet produce the most compact form possible.  The general design of the linker
-        should make it relatively simple to introduce new branch types with little effort,
-        as the linker has no knowledge of the exact form of any of the branches.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * assembler/ARMv7Assembler.cpp: Added.
-        (JSC::):
-          Record jump sizes
-
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
-        (JSC::ARMv7Assembler::LinkRecord::from):
-        (JSC::ARMv7Assembler::LinkRecord::setFrom):
-        (JSC::ARMv7Assembler::LinkRecord::to):
-        (JSC::ARMv7Assembler::LinkRecord::type):
-        (JSC::ARMv7Assembler::LinkRecord::linkType):
-        (JSC::ARMv7Assembler::LinkRecord::setLinkType):
-          Encapsulate LinkRecord fields so we can compress the values somewhat
-
-        (JSC::ARMv7Assembler::JmpSrc::JmpSrc):
-          Need to record the jump type now
-
-        (JSC::ARMv7Assembler::b):
-        (JSC::ARMv7Assembler::blx):
-        (JSC::ARMv7Assembler::bx):
-          Need to pass the jump types
-
-        (JSC::ARMv7Assembler::executableOffsetFor):
-        (JSC::ARMv7Assembler::jumpSizeDelta):
-        (JSC::ARMv7Assembler::linkRecordSourceComparator):
-        (JSC::ARMv7Assembler::computeJumpType):
-        (JSC::ARMv7Assembler::convertJumpTo):
-        (JSC::ARMv7Assembler::recordLinkOffsets):
-        (JSC::ARMv7Assembler::jumpsToLink):
-        (JSC::ARMv7Assembler::link):
-        (JSC::ARMv7Assembler::unlinkedCode):
-          Helper functions for the linker
-
-        (JSC::ARMv7Assembler::linkJump):
-        (JSC::ARMv7Assembler::canBeShortJump):
-        (JSC::ARMv7Assembler::linkLongJump):
-        (JSC::ARMv7Assembler::linkShortJump):
-        (JSC::ARMv7Assembler::linkJumpAbsolute):
-           Moving code around for the various jump linking functions
-
-        * assembler/AbstractMacroAssembler.h:
-        (JSC::AbstractMacroAssembler::beginUninterruptedSequence):
-        (JSC::AbstractMacroAssembler::endUninterruptedSequence):
-          We have to track uninterrupted sequences in any assembler that compacts
-          branches as that's not something we're allowed to do in such sequences.
-          AbstractMacroAssembler has a nop version of these functions as it makes the
-          code elsewhere nicer.
-
-        * assembler/LinkBuffer.h:
-        (JSC::LinkBuffer::LinkBuffer):
-        (JSC::LinkBuffer::link):
-        (JSC::LinkBuffer::patch):
-        (JSC::LinkBuffer::locationOf):
-        (JSC::LinkBuffer::locationOfNearCall):
-        (JSC::LinkBuffer::returnAddressOffset):
-        (JSC::LinkBuffer::trampolineAt):
-          Updated these functions to adjust for any changed offsets in the linked code
-
-        (JSC::LinkBuffer::applyOffset):
-          A helper function to deal with the now potentially moved labels
-
-        (JSC::LinkBuffer::linkCode):
-          The new and mighty linker function
-
-        * assembler/MacroAssemblerARMv7.h:
-        (JSC::MacroAssemblerARMv7::MacroAssemblerARMv7):
-        (JSC::MacroAssemblerARMv7::beginUninterruptedSequence):
-        (JSC::MacroAssemblerARMv7::endUninterruptedSequence):
-        (JSC::MacroAssemblerARMv7::jumpsToLink):
-        (JSC::MacroAssemblerARMv7::unlinkedCode):
-        (JSC::MacroAssemblerARMv7::computeJumpType):
-        (JSC::MacroAssemblerARMv7::convertJumpTo):
-        (JSC::MacroAssemblerARMv7::recordLinkOffsets):
-        (JSC::MacroAssemblerARMv7::jumpSizeDelta):
-        (JSC::MacroAssemblerARMv7::link):
-        (JSC::MacroAssemblerARMv7::jump):
-        (JSC::MacroAssemblerARMv7::branchMul32):
-        (JSC::MacroAssemblerARMv7::breakpoint):
-        (JSC::MacroAssemblerARMv7::nearCall):
-        (JSC::MacroAssemblerARMv7::call):
-        (JSC::MacroAssemblerARMv7::ret):
-        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
-        (JSC::MacroAssemblerARMv7::executableOffsetFor):
-        (JSC::MacroAssemblerARMv7::inUninterruptedSequence):
-        (JSC::MacroAssemblerARMv7::makeJump):
-        (JSC::MacroAssemblerARMv7::makeBranch):
-           All branches need to pass on their type now
-
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutablePool::returnLastBytes):
-           We can't know ahead of time how much space will be necessary to
-           hold the linked code if we're compacting branches, this new
-           function allows us to return the unused bytes at the end of linking
-
-        * jit/JIT.cpp:
-        (JSC::JIT::JIT):
-        (JSC::JIT::privateCompile):
-        * jit/JIT.h:
-        (JSC::JIT::compile):
-           The JIT class now needs to take a linker offset so that recompilation
-           can generate the same jumps when using branch compaction.
-        * jit/JITArithmetic32_64.cpp:
-        (JSC::JIT::emitSlow_op_mod):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        (JSC::JIT::privateCompileCTINativeCall):
-          Update for new trampolineAt changes
-
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMallocStats::):
-        * wtf/Platform.h:
-
-2010-08-09  Gavin Barraclough  <barraclough@apple.com>
-
-        Qt build fix III.
-
-        * wtf/text/WTFString.h:
-
-2010-08-09  Gavin Barraclough  <barraclough@apple.com>
-
-        Qt build fix.
-
-        * wtf/qt/StringQt.cpp:
+        * runtime/MachineStackMarker.cpp:
+        (JSC::freePlatformThreadRegisters):
 
-2010-08-06  Gavin Barraclough  <barraclough@apple.com>
+2011-02-28  Xan Lopez  <xlopez@igalia.com>
 
-        Rubber stamped by Sam Weinig
+        Unreviewed build fix for Snow Leopard.
 
-        Bug 43594 - Add string forwards to Forward.h
-        This allows us to remove forward declarations for these classes from
-        WebCore/WebKit (a step in moving these class from WebCore:: to WTF::).
+        * runtime/MachineStackMarker.cpp:
+        (JSC::freePlatformThreadRegisters):
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/Forward.h:
+2011-02-28  Alejandro G. Castro  <alex@igalia.com>
 
-2010-08-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+        Unreviewed, fix SnowLeopard compilation after r79952.
 
-        Unreviewed, rolling out r64938.
-        http://trac.webkit.org/changeset/64938
-        https://bugs.webkit.org/show_bug.cgi?id=43685
+        * runtime/MachineStackMarker.cpp:
+        (JSC::freePlatformThreadRegisters):
 
-        Did not compile on several ports (Requested by abarth on
-        #webkit).
+2011-02-28  Mark Rowe  <mrowe@apple.com>
 
-        * Android.mk:
-        * CMakeLists.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * assembler/AbstractMacroAssembler.h:
-        * assembler/MacroAssembler.h:
-        * assembler/MacroAssemblerX86.h:
-        (JSC::MacroAssemblerX86::load32):
-        (JSC::MacroAssemblerX86::store32):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::movl_rm):
-        (JSC::X86Assembler::movl_mr):
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::markAggregate):
-        * bytecode/Instruction.h:
-        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::):
-        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
-        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
-        * bytecode/StructureStubInfo.cpp:
-        (JSC::StructureStubInfo::deref):
-        * bytecode/StructureStubInfo.h:
-        (JSC::StructureStubInfo::initGetByIdProto):
-        (JSC::StructureStubInfo::initGetByIdChain):
-        (JSC::StructureStubInfo::):
-        * jit/JIT.h:
-        * jit/JITMarkObjects.cpp: Removed.
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetDirectOffset):
-        (JSC::JIT::testPrototype):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::compileGetDirectOffset):
-        (JSC::JIT::testPrototype):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        * jit/JITStubs.cpp:
-        (JSC::setupPolymorphicProtoList):
-        * wtf/Platform.h:
-
-2010-08-07  Nathan Lawrence  <nlawrence@apple.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Geoffrey Garen.
+        <http://webkit.org/b/55430> OwnArrayPtr.h's LOOSE_OWN_ARRAY_PTR results in link errors.
 
-        The JIT code contains a number of direct references to GC'd objects.
-        When we have movable objects, these references will need to be
-        updated.
+        * wtf/OwnArrayPtr.h:
+        (WTF::::set): Implement OwnArrayPtr::set.
 
-        * Android.mk:
-        * CMakeLists.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * assembler/AbstractMacroAssembler.h:
-        (JSC::AbstractMacroAssembler::int32AtLocation):
-        (JSC::AbstractMacroAssembler::pointerAtLocation):
-        (JSC::AbstractMacroAssembler::jumpTarget):
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::loadPtrWithPatch):
-            Normally, loadPtr will optimize when the register is eax.  Since
-            the slightly smaller instruction changes the offsets, it messes up
-            our ability to repatch the code.  We added this new instruction
-            that garuntees a constant size.
-        * assembler/MacroAssemblerX86.h:
-        (JSC::MacroAssemblerX86::load32WithPatch):
-            Changed load32 in the same way described above.
-        (JSC::MacroAssemblerX86::load32):
-            Moved the logic to optimize laod32 from movl_mr to load32
-        (JSC::MacroAssemblerX86::store32):
-            Moved the logic to optimize store32 from movl_rm to store32
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::movl_rm):
-        (JSC::X86Assembler::movl_mr):
-        (JSC::X86Assembler::int32AtLocation):
-        (JSC::X86Assembler::pointerAtLocation):
-        (JSC::X86Assembler::jumpTarget):
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::markAggregate):
-        * bytecode/Instruction.h:
-            As described in StructureStubInfo.h, we needed to add additional
-            fields to both StructureStubInfo and
-            PolymorphicAccessStructureList so that we can determine the
-            structure of the JITed code at patch time.
-        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
-        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
-        * bytecode/StructureStubInfo.cpp:
-        (JSC::StructureStubInfo::markAggregate):
-            Added this function to mark the JITed code that correosponds to
-            this structure stub info.
-        * bytecode/StructureStubInfo.h:
-        (JSC::StructureStubInfo::initGetByIdProto):
-        (JSC::StructureStubInfo::initGetByIdChain):
-        (JSC::StructureStubInfo::):
-        * jit/JIT.h:
-        * jit/JITMarkObjects.cpp: Added.
-        (JSC::JIT::patchPrototypeStructureAddress):
-        (JSC::JIT::patchGetDirectOffset):
-        (JSC::JIT::markGetByIdProto):
-        (JSC::JIT::markGetByIdChain):
-        (JSC::JIT::markGetByIdProtoList):
-        (JSC::JIT::markPutByIdTransition):
-        (JSC::JIT::markGlobalObjectReference):
-        * jit/JITPropertyAccess.cpp:
-            Added asserts for the patch offsets.
-        (JSC::JIT::compileGetDirectOffset):
-        (JSC::JIT::testPrototype):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::compileGetDirectOffset):
-        (JSC::JIT::testPrototype):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        * jit/JITStubs.cpp:
-        (JSC::setupPolymorphicProtoList):
-        * wtf/Platform.h:
-            Added ENABLE_MOVABLE_GC_OBJECTS flag
+2011-02-28  Martin Zoubek  <martin.zoubek@acision.com> and Alejandro G. Castro  <alex@igalia.com>
 
-2010-08-07  Michael Saboff  <msaboff@apple.com>
+        Reviewed by Martin Robinson.
 
-        Reviewed by Geoffrey Garen.
+        Multithread support for JSC on UNIX
+        https://bugs.webkit.org/show_bug.cgi?id=26838
 
-        Revert JSArray to point to the beginning of the contained ArrayStorage
-        struct.  This is described in
-        https://bugs.webkit.org/show_bug.cgi?id=43526.
+        Implement suspendThread() and resumeThread() for systems with
+        pthread.h using thread signal handler.
 
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::emit_op_get_by_val):
-        (JSC::JIT::emit_op_put_by_val):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::emit_op_get_by_val):
-        (JSC::JIT::emit_op_put_by_val):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::JSArray):
-        (JSC::JSArray::~JSArray):
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::deleteProperty):
-        (JSC::JSArray::getOwnPropertyNames):
-        (JSC::JSArray::getNewVectorLength):
-        (JSC::JSArray::increaseVectorLength):
-        (JSC::JSArray::increaseVectorPrefixLength):
-        (JSC::JSArray::setLength):
-        (JSC::JSArray::pop):
-        (JSC::JSArray::push):
-        (JSC::JSArray::shiftCount):
-        (JSC::JSArray::unshiftCount):
-        (JSC::JSArray::sortNumeric):
-        (JSC::JSArray::sort):
-        (JSC::JSArray::fillArgList):
-        (JSC::JSArray::copyToRegisters):
-        (JSC::JSArray::compactForSorting):
-        (JSC::JSArray::subclassData):
-        (JSC::JSArray::setSubclassData):
-        (JSC::JSArray::checkConsistency):
-        * runtime/JSArray.h:
-        (JSC::JSArray::length):
-        (JSC::JSArray::canGetIndex):
-        (JSC::JSArray::getIndex):
-        (JSC::JSArray::setIndex):
-        (JSC::JSArray::uncheckedSetIndex):
-        (JSC::JSArray::markChildrenDirect):
+        * runtime/MachineStackMarker.cpp:
+        (JSC::pthreadSignalHandlerSuspendResume):
+        (JSC::MachineStackMarker::Thread::Thread):
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        (JSC::freePlatformThreadRegisters):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        * wtf/Platform.h: Added Gtk port to use
+        ENABLE_JSC_MULTIPLE_THREADS.
 
-2010-08-07  Kwang Yul Seo  <skyul@company100.net>
+2011-02-28  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Darin Adler.
 
-        Add ENABLE(YARR) guard around JSGlobalData::m_regexAllocator
-        https://bugs.webkit.org/show_bug.cgi?id=43399
+        Stop using DeprecatedPtr for the global exception slot
+        https://bugs.webkit.org/show_bug.cgi?id=55424
 
-        m_regexAllocator is used only by RegExp::compile which is guarded with ENABLE(YARR).
+        Create GCRootPtr to signify that the exception slot is
+        a gcroot, and so is exempt from the usual writebarrier
+        restrictions.
 
         * runtime/JSGlobalData.h:
+        * runtime/WriteBarrier.h:
+        (JSC::GCRootPtr::GCRootPtr):
+        (JSC::GCRootPtr::operator=):
 
-2010-08-07  Patrick Roland Gansterer  <paroga@paroga.com>
-
-        Reviewed by Eric Seidel.
-
-        [Qt] Enable JIT on WinCE
-        https://bugs.webkit.org/show_bug.cgi?id=43303
-
-        Add ExtraCompiler for generating GeneratedJITStubs_MSVC.asm.
-
-        * DerivedSources.pro:
-
-2010-08-07  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Created a separate SimpleFontData constructor exclusively for SVG fonts and moved the CTFontRef
-        from SimpleFontData to FontPlatformData.
-        https://bugs.webkit.org/show_bug.cgi?id=43674
-
-        * wtf/Platform.h: Moved definitions of WTF_USE_CORE_TEXT and WTF_USE_ATSUI here from WebCore/config.h.
-
-2010-08-07  Zoltan Herczeg  <zherczeg@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Bitmap.h has no default constructor
-        https://bugs.webkit.org/show_bug.cgi?id=43619
-
-        Without a constructor, the initial bits of the Bitmap class
-        are undefinied. If only a few, or zero bits are 0, the memory
-        area provided by AlignedMemoryAllocator can be easly exhausted.
-
-        Csaba Osztrogonác helped to find this bug.
-
-        * wtf/Bitmap.h:
-        (WTF::::Bitmap):
+2011-02-28  Adam Barth  <abarth@webkit.org>
 
-2010-08-06  Rafael Antognolli  <antognolli@profusion.mobi>
+        Reviewed by Dimitri Glazkov.
 
-        [EFL] Build fix.
+        Use more xcconfig files in JavaScriptCore gyp build
+        https://bugs.webkit.org/show_bug.cgi?id=55391
 
-        * CMakeLists.txt: add runtime/CGHandle.cpp.
+        The GYP experts tell me that we have have a total of two xcconfig
+        files: one for the xcodeproj as a whole and one for each target.  This
+        patch uses that technique to re-use the existing xcconfig files and
+        eliminate the duplication.
 
-2010-08-06  Jessie Berlin  <jberlin@apple.com>
+        Technically, this patch introduces some build errors because the
+        xcconfig files assume that the xcodeproj file is one level higher in
+        the directory hierarchy.  Specifically, the xcodeproj file can no
+        longer find the Info.plist or the prefix header.  I plan to fix that in
+        a subsequent patch.
 
-        Roll out http://trac.webkit.org/changeset/64801, which broke the Safari Windows Build.
-        Unreviewed.
+        Also, this patch introduces the Release and Production configurations,
+        which should work correctly now.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/Forward.h:
+        * gyp/JavaScriptCore.gyp:
 
-2010-08-06  Jessie Berlin  <jberlin@apple.com>
+2011-02-28  Jon Honeycutt  <jhoneycutt@apple.com>
 
-        Windows Build Fix (continued). Unreviewed.
+        Windows build fix.
 
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Add symbol to export.
 
-2010-08-06  Jessie Berlin  <jberlin@apple.com>
-
-        Windows Build Fix. Unreviewed.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        Add GCHandle.h and GCHandle.cpp.
-
-2010-08-06  Nathan Lawrence  <nlawrence@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=43207
-
-        WeakGCPtr's should instead of directly pointing to the GC'd object
-        should be directed to an array of pointers that can be updated for
-        movable objects.
-
-        * Android.mk:
-        * GNUmakefile.am:
-        * JavaScriptCore.exp:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/Collector.cpp:
-        (JSC::Heap::destroy):
-        (JSC::Heap::allocateBlock):
-        (JSC::Heap::freeBlock):
-        (JSC::Heap::updateWeakGCHandles):
-        (JSC::WeakGCHandlePool::update):
-        (JSC::Heap::addWeakGCHandle):
-        (JSC::Heap::markRoots):
-        * runtime/Collector.h:
-        (JSC::Heap::weakGCHandlePool):
-        * runtime/GCHandle.cpp: Added.
-        (JSC::WeakGCHandle::pool):
-        (JSC::WeakGCHandlePool::WeakGCHandlePool):
-        (JSC::WeakGCHandlePool::allocate):
-        (JSC::WeakGCHandlePool::free):
-        (JSC::WeakGCHandlePool::operator new):
-        * runtime/GCHandle.h: Added.
-        (JSC::WeakGCHandle::isValidPtr):
-        (JSC::WeakGCHandle::isPtr):
-        (JSC::WeakGCHandle::isNext):
-        (JSC::WeakGCHandle::invalidate):
-        (JSC::WeakGCHandle::get):
-        (JSC::WeakGCHandle::set):
-        (JSC::WeakGCHandle::getNextInFreeList):
-        (JSC::WeakGCHandle::setNextInFreeList):
-        (JSC::WeakGCHandlePool::isFull):
-        * runtime/WeakGCPtr.h:
-        (JSC::WeakGCPtr::WeakGCPtr):
-        (JSC::WeakGCPtr::~WeakGCPtr):
-        (JSC::WeakGCPtr::get):
-        (JSC::WeakGCPtr::clear):
-        (JSC::WeakGCPtr::assign):
-        (JSC::get):
-
-2010-08-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Antonio Gomes.
-
-        [Qt] Fix warnings about difference in symbol visiblity on Mac OS X
-
-        * jsc.pro:
-
-2010-08-06  Zoltan Herczeg  <zherczeg@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Refactor identifier parsing in lexer
-        https://bugs.webkit.org/show_bug.cgi?id=41845
-
-        The code is refactored to avoid gotos. The new code
-        has the same performance as the old one.
-
-        SunSpider --parse-only: no change (from 34.0ms to 33.6ms)
-        SunSpider: no change (from 523.2ms to 523.5ms)
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::parseIdent):
-        (JSC::Lexer::lex):
-        * parser/Lexer.h:
-
-2010-08-06  Gabor Loki  <loki@webkit.org>
+2011-02-28  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Gavin Barraclough.
 
-        The ARM JIT does not support JSValue32_64 with RVCT
-        https://bugs.webkit.org/show_bug.cgi?id=43411
-
-        JSValue32_64 is enabled for RVCT by default.
-
-        * create_jit_stubs:
-        * jit/JITStubs.cpp:
-        (JSC::ctiTrampoline):
-        (JSC::ctiVMThrowTrampoline):
-        (JSC::ctiOpThrowNotCaught):
-        * wtf/Platform.h:
-
-2010-08-05  Chao-ying Fu  <fu@mips.com>
-
-        Reviewed by Darin Adler.
+        Make ScopeChainNode GC allocated
+        https://bugs.webkit.org/show_bug.cgi?id=55283
 
-        Define WTF_USE_ARENA_ALLOC_ALIGNMENT_INTEGER for MIPS
-        https://bugs.webkit.org/show_bug.cgi?id=43514
-
-        MIPS needs to define WTF_USE_ARENA_ALLOC_ALIGNMENT_INTEGER, so that
-        RenderArena::allocate() can return 8-byte aligned memory to avoid
-        exceptions on sdc1/ldc1.
-
-        * wtf/Platform.h:
-
-2010-08-05  Gavin Barraclough  <barraclough@apple.com>
-
-        Rubber stamped by Sam Weinig
-
-        Bug 43594 - Add string forwards to Forward.h
-        This allows us to remove forward declarations for these classes from
-        WebCore/WebKit (a step in moving these class from WebCore:: to WTF::).
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/Forward.h:
-
-2010-08-05  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        Fixed leak seen on buildbot.
-
-        * runtime/GCActivityCallbackCF.cpp:
-        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
-        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
-        (JSC::DefaultGCActivityCallback::operator()): Make out timer a RetainPtr,
-        since anything less would be uncivilized.
-
-2010-08-05  Andy Estes  <aestes@apple.com>
-
-        Reviewed by David Kilzer.
-
-        Rename iOS-related OS and PLATFORM macros.
-        https://bugs.webkit.org/show_bug.cgi?id=43493
-        
-        Rename WTF_OS_IPHONE_OS to WTF_OS_IOS, WTF_PLATFORM_IPHONE to
-        WTF_PLATFORM_IOS, and WTF_PLATFORM_IPHONE_SIMULATOR to
-        WTF_PLATFORM_IOS_SIMULATOR.
-
-        * jit/ExecutableAllocator.h:
-        * jit/JITStubs.cpp:
-        * profiler/ProfilerServer.mm:
-        (-[ProfilerServer init]):
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMallocStats::):
-        * wtf/Platform.h:
-        * wtf/unicode/icu/CollatorICU.cpp:
-        (WTF::Collator::userDefault):
-
-2010-08-05  Nathan Lawrence  <nlawrence@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=43464
-
-        Currently, the global object is being embedded in the JavaScriptCore
-        bytecode, however since the global object is the same for all opcodes
-        in a code block, we can have the global object just be a member of the
-        associated code block.
-
-        Additionally, I added an assert inside of emitOpcode that verifies
-        that the last generated opcode was of the correct length.
+        Simplify lifetime and other issues with the scopechain
+        by making it gc allocated.  This allows us to simplify
+        function exit and unwinding, as well as making the
+        current iterative refcounting go away.
 
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
         * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::CodeBlock::derefStructures):
-        (JSC::CodeBlock::markAggregate):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::globalObject):
-        (JSC::GlobalCodeBlock::GlobalCodeBlock):
-        (JSC::ProgramCodeBlock::ProgramCodeBlock):
-        (JSC::EvalCodeBlock::EvalCodeBlock):
-        (JSC::FunctionCodeBlock::FunctionCodeBlock):
-        * bytecode/Opcode.h:
-        (JSC::opcodeLength):
+        (JSC::CodeBlock::createActivation):
+        * bytecode/StructureStubInfo.cpp:
         * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
         (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitOpcode):
-            Added an assert to check that the last generated opcode is the
-            correct length.
-        (JSC::BytecodeGenerator::rewindBinaryOp):
-            Changed the last opcode to op_end since the length will no longer
-            be correct.
-        (JSC::BytecodeGenerator::rewindUnaryOp):
-            Changed the last opcode to op_end since the length will no longer
-            be correct.
-        (JSC::BytecodeGenerator::emitResolve):
-        (JSC::BytecodeGenerator::emitGetScopedVar):
-        (JSC::BytecodeGenerator::emitPutScopedVar):
-        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
         * bytecompiler/BytecodeGenerator.h:
+        * debugger/Debugger.cpp:
+        (JSC::Recompiler::operator()):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::scopeChain):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrame.h:
         * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::resolveGlobal):
-        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::depth):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
         (JSC::Interpreter::privateExecute):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::compileOpCall):
         * jit/JITOpcodes.cpp:
-        (JSC::JIT::emit_op_get_global_var):
-        (JSC::JIT::emit_op_put_global_var):
-        (JSC::JIT::emit_op_resolve_global):
-        (JSC::JIT::emitSlow_op_resolve_global):
-        (JSC::JIT::emit_op_resolve_global_dynamic):
-        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_get_global_var):
-        (JSC::JIT::emit_op_put_global_var):
-        (JSC::JIT::emit_op_resolve_global):
-        (JSC::JIT::emitSlow_op_resolve_global):
-        * jit/JITStubs.cpp:
-        (JSC::cti_op_resolve_global):
-        * runtime/Executable.cpp:
-        (JSC::FunctionExecutable::compileForCallInternal):
-        (JSC::FunctionExecutable::compileForConstructInternal):
-        (JSC::FunctionExecutable::reparseExceptionInfo):
-
-2010-08-05  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 43185 - Switch RegisterFile over to use PageAllocation
-
-        Remove platform-specific memory allocation code.
-
-        * interpreter/RegisterFile.cpp:
-        (JSC::RegisterFile::~RegisterFile):
-        (JSC::RegisterFile::releaseExcessCapacity):
-        * interpreter/RegisterFile.h:
-        (JSC::RegisterFile::RegisterFile):
-        (JSC::RegisterFile::grow):
-        (JSC::RegisterFile::checkAllocatedOkay):
-        * wtf/PageAllocation.cpp:
-        (WTF::PageAllocation::lastError):
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::allocate):
-        (WTF::PageAllocation::allocateAt):
-        (WTF::PageAllocation::allocateAligned):
-        (WTF::PageAllocation::pageSize):
-        (WTF::PageAllocation::isPageAligned):
-        (WTF::PageAllocation::isPowerOfTwo):
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::commit):
-        (WTF::PageReservation::decommit):
-        (WTF::PageReservation::reserve):
-        (WTF::PageReservation::reserveAt):
-
-2010-08-05  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=43401 where array 
-        content aren't properly initialized as part of unshift.  
-
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::unshiftCount):
-
-2010-08-05  Jian Li  <jianli@chromium.org>
-
-        Reviewed by David Levin.
-
-        Unify blob related feature defines to ENABLE(BLOB).
-        https://bugs.webkit.org/show_bug.cgi?id=43081
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2010-08-05  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Rubber-stamped by Xan Lopez.
-
-        Remove GHashTable left-overs. GHashTable is ref-counted, and is
-        correctly supported by GRefPtr.
-
-        * wtf/gobject/GOwnPtr.h:
-
-2010-08-05  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
-
-        Unreviewed.
-
-        Typo fix that makes distcheck happy.
-
-        * GNUmakefile.am:
-
-2010-08-03  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt and Beth Dakin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=43461
-        Invalid NaN parsing
-        
-        * wtf/dtoa.cpp: Turn off the dtoa feature that allows you to specify a
-        non-standard NaN representation, since our NaN encoding assumes that all
-        true NaNs have the standard bit pattern.
-
-        * API/JSValueRef.cpp:
-        (JSValueMakeNumber): Don't allow an API client to accidentally specify
-        a non-standard NaN either.
-
-2010-08-04  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix part II.
-
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::systemReserve):
-
-2010-08-04  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix.
-
-        * wtf/PageReservation.h:
-        (WTF::PageReservation::systemReserve):
-
-2010-08-04  Gavin Barraclough  <barraclough@apple.com>
-
-        Build fix - add new header to !Mac projects.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-
-2010-08-04  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 43515 - Fix small design issues with PageAllocation, split out PageReservation.
-
-        The PageAllocation class has a number of issues:
-        * Changes in bug #43269 accidentally switched SYMBIAN over to use malloc/free to allocate
-          blocks of memory for the GC heap, instead of allocating RChunks.  Revert this change in
-          behaviour.
-        * In order for PageAllocation to work correctly on WinCE we should be decommitting memory
-          before deallocating.  In order to simplify understanding the expected state at deallocate,
-          split behaviour out into PageAllocation and PageReservation classes.  Require that all
-          memory be decommitted before calling deallocate on a PageReservation, add asserts to
-          enforce this.
-        * add many missing asserts.
-        * inline more functions.
-        * remove ability to create sub-PageAllocations from an existing PageAllocations object -
-          this presented an interface that would allow sub regions to be deallocated, which would
-          not have provided expected behaviour.
-        * remove writable/executable arguments to commit, this value can be cached at the point
-          the memory is reserved.
-        * remove writable/executable arguments to allocateAligned, protection other than RW is not
-          supported.
-        * add missing checks for overflow & failed allocation to mmap path through allocateAligned.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutableAllocator::intializePageSize):
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutablePool::Allocation::Allocation):
-        (JSC::ExecutablePool::Allocation::base):
-        (JSC::ExecutablePool::Allocation::size):
-        (JSC::ExecutablePool::Allocation::operator!):
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::reuse):
-        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
-        (JSC::FixedVMPoolAllocator::alloc):
-        (JSC::FixedVMPoolAllocator::free):
-        (JSC::FixedVMPoolAllocator::allocInternal):
-        * runtime/AlignedMemoryAllocator.h:
-        (JSC::::allocate):
-        (JSC::::AlignedMemoryAllocator):
-        * runtime/Collector.cpp:
-        (JSC::Heap::allocateBlock):
-        * runtime/Collector.h:
-        * wtf/PageAllocation.cpp:
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::operator!):
-        (WTF::PageAllocation::allocate):
-        (WTF::PageAllocation::allocateAt):
-        (WTF::PageAllocation::allocateAligned):
-        (WTF::PageAllocation::deallocate):
-        (WTF::PageAllocation::pageSize):
-        (WTF::PageAllocation::systemAllocate):
-        (WTF::PageAllocation::systemAllocateAt):
-        (WTF::PageAllocation::systemAllocateAligned):
-        (WTF::PageAllocation::systemDeallocate):
-        (WTF::PageAllocation::systemPageSize):
-        * wtf/PageReservation.h: Copied from JavaScriptCore/wtf/PageAllocation.h.
-        (WTF::PageReservation::PageReservation):
-        (WTF::PageReservation::commit):
-        (WTF::PageReservation::decommit):
-        (WTF::PageReservation::reserve):
-        (WTF::PageReservation::reserveAt):
-        (WTF::PageReservation::deallocate):
-        (WTF::PageReservation::systemCommit):
-        (WTF::PageReservation::systemDecommit):
-        (WTF::PageReservation::systemReserve):
-        (WTF::PageReservation::systemReserveAt):
-        * wtf/Platform.h:
-
-2010-08-04  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r64655.
-        http://trac.webkit.org/changeset/64655
-        https://bugs.webkit.org/show_bug.cgi?id=43496
-
-        JavaScriptCore references patch seems to have caused
-        regressions in QT and GTK builds (Requested by nlawrence on
-        #webkit).
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::markAggregate):
-        * runtime/Collector.cpp:
-        (JSC::Heap::markConservatively):
-        * runtime/JSCell.h:
-        (JSC::JSValue::asCell):
-        (JSC::MarkStack::append):
-        * runtime/JSGlobalObject.cpp:
-        (JSC::markIfNeeded):
-        * runtime/JSONObject.cpp:
-        (JSC::Stringifier::Holder::object):
-        * runtime/JSObject.h:
-        (JSC::JSObject::prototype):
-        * runtime/JSStaticScopeObject.cpp:
-        (JSC::JSStaticScopeObject::markChildren):
-        * runtime/JSValue.h:
-        (JSC::JSValue::):
-        (JSC::JSValue::JSValue):
-        (JSC::JSValue::asCell):
-        * runtime/MarkStack.h:
-        * runtime/NativeErrorConstructor.cpp:
-        * runtime/NativeErrorConstructor.h:
-        * runtime/Structure.h:
-        (JSC::Structure::storedPrototype):
-
-2010-08-04  Gavin Barraclough  <barraclough@apple.com>
-
-        Rubber stamped by Sam Weinig.
-
-        Enable JSVALUE64 for CPU(PPC64).
-        Basic browsing seems to work.
-
-        * wtf/Platform.h:
-
-2010-08-04  Nathan Lawrence  <nlawrence@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Refactoring MarkStack::append to take a reference.  This is in
-        preparation for movable objects when we will need to update pointers.
-        http://bugs.webkit.org/show_bug.cgi?id=41177
-
-        Unless otherwise noted, all changes are to either return by reference
-        or pass a reference to MarkStack::append.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::markAggregate):
-        * runtime/Collector.cpp:
-        (JSC::Heap::markConservatively):
-            Added a temporary variable to prevent marking from changing an
-            unknown value on the stack
-        * runtime/JSCell.h:
-        (JSC::JSValue::asCell):
-        (JSC::MarkStack::append):
-        (JSC::MarkStack::appendInternal):
-        * runtime/JSGlobalObject.cpp:
-        (JSC::markIfNeeded):
-        * runtime/JSONObject.cpp:
-        (JSC::Stringifier::Holder::object):
-        * runtime/JSObject.h:
-        (JSC::JSObject::prototype):
-        * runtime/JSStaticScopeObject.cpp:
-        (JSC::JSStaticScopeObject::markChildren):
-        * runtime/JSValue.h:
-        (JSC::JSValue::JSValue):
-        (JSC::JSValue::asCell):
-        * runtime/MarkStack.h:
-        * runtime/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::createStructure):
-            Changed the structure flags to include a custom markChildren.
-        (JSC::NativeErrorConstructor::markChildren):
-            Update the prototype of the stored structure.
-        * runtime/NativeErrorConstructor.h:
-            Added structure flags.
-        * runtime/Structure.h:
-        (JSC::Structure::storedPrototype):
-
-2010-08-03  Nathan Lawrence  <nlawrence@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Tightened up some get_by_id_chain* code generation
-        https://bugs.webkit.org/show_bug.cgi?id=40935
-
-        This is in the style of
-        https://bugs.webkit.org/show_bug.cgi?id=30539, and changed code to
-        call accessor functions when it was not necessary to directly access
-        the private variables.
-
-        * jit/JIT.h:
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetDirectOffset):
-        (JSC::JIT::testPrototype):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::testPrototype):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-
-2010-08-03  Adam Roben  <aroben@apple.com>
-
-        Turn on PLATFORM_STRATEGIES on Windows
-
-        Fixes <http://webkit.org/b/43431>.
-
-        Reviewed by Anders Carlsson.
-
-        * wtf/Platform.h:
-
-2010-08-04  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Enable JSValue32_64 for GCC on ARM by default
-        https://bugs.webkit.org/show_bug.cgi?id=43410
-
-        * wtf/Platform.h:
-
-2010-08-03  Gavin Barraclough  <barraclough@apple.com>
-
-        Speculative windows build fix.
-
-        * wtf/Bitmap.h:
-
-2010-08-03  Gavin Barraclough  <barraclough@apple.com>
-
-        Build fix following r64624.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/PageAllocation.h:
-
-2010-08-03  Nathan Lawrence  <nlawrence@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        https://bugs.webkit.org/show_bug.cgi?id=43269
-
-        Added new allocateAligned methods to PageAllocation.  In order to
-        prevent a regress in performance, the function needs to be inlined.
-
-        Additionally, I ported the symbian block allocator to use
-        PageAllocation and added a new WTF::Bitmap class to support this.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/AlignedMemoryAllocator.h: Added.
-        (JSC::AlignedMemory::deallocate):
-        (JSC::AlignedMemory::base):
-        (JSC::AlignedMemory::AlignedMemory):
-        (JSC::AlignedMemoryAllocator::destroy):
-        (JSC::AlignedMemoryAllocator::allocate):
-        (JSC::AlignedMemoryAllocator::AlignedMemoryAllocator):
-        (JSC::AlignedMemoryAllocator::~AlignedMemoryAllocator):
-        (JSC::AlignedMemoryAllocator::free):
-        * runtime/Collector.cpp:
-        (JSC::Heap::Heap):
-        (JSC::Heap::destroy):
-        (JSC::Heap::allocateBlock):
-        (JSC::Heap::freeBlock):
-        (JSC::Heap::freeBlocks):
-        (JSC::Heap::allocate):
-        (JSC::Heap::shrinkBlocks):
-        (JSC::Heap::markConservatively):
-        (JSC::Heap::clearMarkBits):
-        (JSC::Heap::markedCells):
-        * runtime/Collector.h:
-        (JSC::CollectorHeap::collectorBlock):
-        * runtime/CollectorHeapIterator.h:
-        (JSC::CollectorHeapIterator::operator*):
-        (JSC::LiveObjectIterator::operator++):
-        (JSC::DeadObjectIterator::operator++):
-        * wtf/Bitmap.h: Added.
-        (WTF::Bitmap::get):
-        (WTF::Bitmap::set):
-        (WTF::Bitmap::clear):
-        (WTF::Bitmap::clearAll):
-        (WTF::Bitmap::advanceToNextFreeBit):
-        (WTF::Bitmap::count):
-        (WTF::Bitmap::isEmpty):
-        (WTF::Bitmap::isFull):
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::operator UnspecifiedBoolType):
-        (WTF::PageAllocation::allocateAligned):
-        (WTF::PageAllocation::reserveAligned):
-        * wtf/Platform.h:
-        * wtf/symbian: Removed.
-        * wtf/symbian/BlockAllocatorSymbian.cpp: Removed.
-        * wtf/symbian/BlockAllocatorSymbian.h: Removed.
-
-2010-08-03  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=43314.  The prior code
-        was using the wrong "length" value to move array contents when adding
-        space to the beginning of an array for an unshift() or similar
-        operation.  Instead of using m_vectorLength, the length of the
-        allocated JSValue array, the code was using m_length, the declared
-        length of the array.  These two values do not need to match.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::increaseVectorPrefixLength):
-
-2010-08-03  Chao-ying Fu  <fu@mips.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Fix following https://bugs.webkit.org/show_bug.cgi?id=43089
-        (accidentally inverted a compiler version check).
-
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutableAllocator::cacheFlush):
-
-2010-08-03  Patrick Gansterer  <paroga@paroga.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Implement DEFINE_STUB_FUNCTION for WinCE.
-        https://bugs.webkit.org/show_bug.cgi?id=34953
-
-        * jit/JITStubs.cpp:
-        (JSC::):
-        (JSC::DEFINE_STUB_FUNCTION):
-
-2010-08-02  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 43390 - Do not CRASH if we run out of room for jit code.
-
-        Change the ExecutableAllocator implementations not to crash, and to return 0 if memory cannot be allocated.
-        The assemblers should pass this through without trying to use it in executableCopy.
-        Change the LinkBuffer to handle this, and to provide an allocationSuccessful() method to test for this.
-
-        Change the JIT to throw an exception if allocation fails.
-        Make JIT optimizations fail gracefully if memory cannot be allocated (use non-optimized path).
-        Change YARR JIT to fallback to PCRE 
-
-        * assembler/ARMAssembler.cpp:
-        (JSC::ARMAssembler::executableCopy):
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::executableCopy):
-        * assembler/LinkBuffer.h:
-        (JSC::LinkBuffer::allocationSuccessful):
-        * assembler/MIPSAssembler.h:
-        (JSC::MIPSAssembler::executableCopy):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::executableCopy):
-        * bytecode/StructureStubInfo.h:
-        (JSC::StructureStubInfo::initGetByIdProto):
-        (JSC::StructureStubInfo::initGetByIdChain):
-        (JSC::StructureStubInfo::initGetByIdSelfList):
-        (JSC::StructureStubInfo::initGetByIdProtoList):
-        (JSC::StructureStubInfo::initPutByIdTransition):
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutablePool::systemAlloc):
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::allocInternal):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile):
-        * jit/JIT.h:
-        (JSC::JIT::compileGetByIdProto):
-        (JSC::JIT::compileGetByIdSelfList):
-        (JSC::JIT::compileGetByIdProtoList):
-        (JSC::JIT::compileGetByIdChainList):
-        (JSC::JIT::compileGetByIdChain):
-        (JSC::JIT::compilePutByIdTransition):
-        (JSC::JIT::compilePatchGetArrayLength):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
         * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        (JSC::JIT::privateCompileCTINativeCall):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::stringGetByValStubGenerator):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::stringGetByValStubGenerator):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::emit_op_end):
         * jit/JITStubs.cpp:
-        (JSC::JITThunks::tryCachePutByID):
-        (JSC::JITThunks::tryCacheGetByID):
         (JSC::DEFINE_STUB_FUNCTION):
-        (JSC::setupPolymorphicProtoList):
         * jit/JITStubs.h:
-        * jit/SpecializedThunkJIT.h:
-        (JSC::SpecializedThunkJIT::finalize):
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createOutOfMemoryError):
-        * runtime/ExceptionHelpers.h:
+        * runtime/ArgList.cpp:
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        * runtime/DateConversion.cpp:
         * runtime/Executable.cpp:
         (JSC::EvalExecutable::compileInternal):
         (JSC::ProgramExecutable::compileInternal):
         (JSC::FunctionExecutable::compileForCallInternal):
         (JSC::FunctionExecutable::compileForConstructInternal):
-        (JSC::FunctionExecutable::reparseExceptionInfo):
-        (JSC::EvalExecutable::reparseExceptionInfo):
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::compile):
-
-2010-08-03  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fixed a crash seen on the GTK 64bit buildbot.
-        
-        When JSArray is allocated for the vptr stealing hack, it's not allocated
-        in the heap, so the JSArray constructor can't safely call Heap::heap().
-        
-        Since this was subtle enough to confuse smart people, I've changed JSArray
-        to have an explicit vptr stealing constructor.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::JSArray):
-        * runtime/JSArray.h:
-        (JSC::JSArray::):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/GCActivityCallbackCF.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSChunk.cpp: Added.
+        * runtime/JSChunk.h: Added.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::markChildren):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getConstructData):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::scope):
+        (JSC::JSFunction::setScope):
         * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::storeVPtrs):
-
-2010-08-03  Alex Milowski  <alex@milowski.com>
-
-        Reviewed by Beth Dakin.
-
-        Changed the ENABLE_MATHML value to enable MathML by default.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2010-08-03  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Change to keep returned pointer from malloc family functions to
-        quiet memory leak detect.  The pointer is saved in the new m_allocBase
-        member of the ArrayStorage structure.  This fixes the issue found in 
-        https://bugs.webkit.org/show_bug.cgi?id=43229.
-
-        As part of this change, we use m_allocBase when reallocating and
-        freeing the memory associated with ArrayStorage.
-
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::JSArray):
-        (JSC::JSArray::~JSArray):
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::increaseVectorLength):
-        (JSC::JSArray::increaseVectorPrefixLength):
-        * runtime/JSArray.h:
-
-2010-08-03  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=43444
-        PLATFORM(CF) is false on Windows in JavaScriptCore
-
-        Moved some PLATFORM(WIN) #defines down into JavaScriptCore.
-
-        * wtf/Platform.h: Added WTF_PLATFORM_CF 1 and WTF_USE_PTHREADS 0, inherited
-        from WebCore/config.h. Removed WTF_USE_WININET 1 since WebCore/config.h
-        just #undefined that later.
-
-2010-08-03  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix Windows build: Don't use GCActivityCallbackCF on Windows, since
-        PLATFORM(CF) is not defined on Windows.
-        
-        We'll need to enable the GC activity callback some other way, but this
-        change should get the build back to normal.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-        * runtime/GCActivityCallbackCF.cpp: Make it easier to detect this error
-        in the future with an explicit error message.
-
-2010-08-03  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix Windows build: update .def file.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-08-03  Nathan Lawrence  <nlawrence@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=41318
-        GC should reclaim garbage even when new objects are not being allocated rapidly
-
-        Added a callback in JavaScriptCore that gets triggered after an
-        allocation causes the heap to reset.  This is useful for adding a
-        timer that will trigger garbage collection after the "last" allocation.
-
-        Also needed was to add lock and unlock methods to JSLock that needed
-        only a JSGlobalData object versus an ExecState object.
-
-        * CMakeLists.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.exp:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::emit_op_put_by_val):
-        * runtime/Collector.cpp:
-        (JSC::Heap::Heap):
-        (JSC::Heap::reset):
-        (JSC::Heap::setActivityCallback):
-        * runtime/Collector.h:
-        * runtime/GCActivityCallback.cpp: Added.
-        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
-        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
-        (JSC::DefaultGCActivityCallback::operator()):
-        * runtime/GCActivityCallback.h: Added.
-        (JSC::GCActivityCallback::~GCActivityCallback):
-        (JSC::GCActivityCallback::operator()):
-        (JSC::GCActivityCallback::GCActivityCallback):
-        (JSC::DefaultGCActivityCallback::create):
-        * runtime/GCActivityCallbackCF.cpp: Added.
-        (JSC::DefaultGCActivityCallbackPlatformData::trigger):
-        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
-        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
-        (JSC::DefaultGCActivityCallback::operator()):
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::globalScopeChain):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
         * runtime/JSLock.cpp:
-        (JSC::JSLock::JSLock):
-        * runtime/JSLock.h:
-
-2010-08-02  Kevin Ollivier  <kevino@theolliviers.com>
-
-        [wx] Build fix after removal of need to compile ExecutableAllocatorPosix.cpp
-
-        * wscript:
-
-2010-08-02  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [QT] build fix for symbian
-        https://bugs.webkit.org/show_bug.cgi?id=43234
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSZombie.cpp:
+        * runtime/MarkedBlock.cpp:
+        * runtime/MarkedSpace.cpp:
+        * runtime/PropertyNameArray.cpp:
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        (JSC::ScopeChainNode::localDepth):
+        (JSC::ScopeChainNode::markChildren):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        (JSC::ScopeChainNode::createStructure):
+        (JSC::ScopeChainNode::push):
+        (JSC::ScopeChainNode::pop):
+        (JSC::ScopeChainIterator::ScopeChainIterator):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChainIterator::operator++):
+        (JSC::ScopeChainNode::begin):
+        (JSC::ScopeChainNode::end):
+        (JSC::ExecState::globalData):
+        (JSC::ExecState::lexicalGlobalObject):
+        (JSC::ExecState::globalThisValue):
+        * runtime/ScopeChainMark.h:
+        * wtf/DateMath.cpp:
 
-        1) wrong order of passing param's
-        2) static_cast complains on symbian so using reinterpret_cast
+2011-02-27  Adam Barth  <abarth@webkit.org>
 
-        No new tests added. Just a build fix for qt symbian
+        Reviewed by Eric Seidel.
 
-        * wtf/PageAllocation.cpp:
-        (WTF::PageAllocation::commit):
-        (WTF::PageAllocation::decommit):
-        (WTF::PageAllocation::reserve):
+        Implement WTF::randomNumber in terms of WTF::cryptographicallyRandomNumber when possible
+        https://bugs.webkit.org/show_bug.cgi?id=55326
 
-2010-07-30  Luiz Agostini  <luiz.agostini@openbossa.org>
+        Currently, randomNumber does a bunch of platform-specific work that to
+        get a cryptographic randomness when available.  Instead, we should use
+        cryptographicallyRandomNumber, which abstracts this work.
+        Unfortunately, we can't remove all of the WTF::randomNumber
+        implementation because not every port has access to cryptographically
+        random numbers.
 
-        Reviewed by Simon Fraser.
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
 
-        Enabling view modes to all platforms
-        https://bugs.webkit.org/show_bug.cgi?id=37505
+2011-02-27  Benjamin Poulain  <ikipou@gmail.com>
 
-        Removing ENABLE_WIDGETS_10_SUPPORT flag.
+        Reviewed by Darin Adler.
 
-        As view mode media feature is not part of widget 1.0 specification
-        any more the ENABLE_WIDGETS_10_SUPPORT flag may be removed. The only use
-        of this flag was related to view mode media feature implementation in Qt. 
+        Eliminate DeprecatedPtrList from RenderBlock
+        https://bugs.webkit.org/show_bug.cgi?id=54972
 
-        * wtf/Platform.h:
+        Add methods find() and contains() using an adaptor to ListHashSet.
+        Those method are like the one of HashSet, they allow to find objects
+        based on a different key than the one used to define the set.
 
-2010-07-30  Andy Estes  <aestes@apple.com>
+        Add convenience methods for direct access to the head and tail of the list.
+        Those methods are providing similar API/behavior as Vector.
 
-        Reviewed by David Kilzer.
+        * wtf/ListHashSet.h:
+        (WTF::::first):
+        (WTF::::last):
+        (WTF::::removeLast):
+        (WTF::ListHashSetTranslatorAdapter::hash):
+        (WTF::ListHashSetTranslatorAdapter::equal):
+        (WTF::::find):
+        (WTF::::contains):
 
-        Add Xcode support for compiling WebKit against iOS SDKs.
-        https://bugs.webkit.org/show_bug.cgi?id=42796
+2011-02-26  Patrick Gansterer  <paroga@webkit.org>
 
-        * Configurations/Base.xcconfig:
-        * Configurations/DebugRelease.xcconfig:
-        * Configurations/FeatureDefines.xcconfig:
+        Reviewed by Andreas Kling.
 
-2010-07-30  Dumitru Daniliuc  <dumi@chromium.org>
+        Add support for DragonFly BSD
+        https://bugs.webkit.org/show_bug.cgi?id=54407
 
-        Reviewed by Davin Levin.
+        DragonFly BSD is based on FreeBSD, so handle it like FreeBSD.
 
-        Added a yield() function.
-        https://bugs.webkit.org/show_bug.cgi?id=42843
+        * wtf/Platform.h:
 
-        * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * wtf/Threading.h:
-        * wtf/ThreadingPthreads.cpp:
-        (WTF::yield):
-        * wtf/ThreadingWin.cpp:
-        (WTF::yield):
-        * wtf/gtk/ThreadingGtk.cpp:
-        (WTF::yield):
-        * wtf/qt/ThreadingQt.cpp:
-        (WTF::yield):
+2011-02-26  Adam Barth  <abarth@webkit.org>
 
-2010-07-30  Rafael Antognolli  <antognolli@profusion.mobi>
+        Reviewed by Dimitri Glazkov.
 
-        Reviewed by Antonio Gomes.
+        JavaScriptCore should use the xcconfig file instead of importing that information into GYP
+        https://bugs.webkit.org/show_bug.cgi?id=55282
 
-        [EFL] Add library version and soname to EFL generated libraries and binary.
-        https://bugs.webkit.org/show_bug.cgi?id=43212
+        Technically, this breaks the build because I had removed one of the
+        warnings in this config file, but this change seems like an
+        improvement.
 
-        Add version and soname to libjavascriptcore.so and libwtf.so in case of
-        linking as shared libraries, and version to jsc executable.
+        * gyp/JavaScriptCore.gyp:
 
-        * CMakeLists.txt:
-        * jsc/CMakeLists.txt:
-        * wtf/CMakeLists.txt:
+2011-02-26  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
 
-2010-07-30  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+        Reviewed by Nikolas Zimmermann.
 
-        Reviewed by Simon Hausmann.
+        SH4 JIT SUPPORT
+        https://bugs.webkit.org/show_bug.cgi?id=44329
 
-        [QT] build fix for symbian
-        https://bugs.webkit.org/show_bug.cgi?id=43234
+        Provide an ExecutableAllocater::cacheFlush() implementation for
+        Linux/SH4.
 
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::PageAllocation):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
 
-2010-07-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+2011-02-25  Sheriff Bot  <webkit.review.bot@gmail.com>
 
-        Unreviewed, rolling out r64313.
-        http://trac.webkit.org/changeset/64313
-        https://bugs.webkit.org/show_bug.cgi?id=43233
+        Unreviewed, rolling out r79627.
+        http://trac.webkit.org/changeset/79627
+        https://bugs.webkit.org/show_bug.cgi?id=55274
 
-        Some Chromium bots are not happy with it for some unknown
-        reason. (Requested by dumi on #webkit).
+        broke worker tests (Requested by olliej on #webkit).
 
         * JavaScriptCore.exp:
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * wtf/Threading.h:
-        * wtf/ThreadingPthreads.cpp:
-        * wtf/ThreadingWin.cpp:
-        * wtf/gtk/ThreadingGtk.cpp:
-        * wtf/qt/ThreadingQt.cpp:
-
-2010-07-29  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r64302.
-        http://trac.webkit.org/changeset/64302
-        https://bugs.webkit.org/show_bug.cgi?id=43223
-
-        Assertion is bogus (Requested by olliej on #webkit).
-
-        * assembler/ARMAssembler.cpp:
-        (JSC::ARMAssembler::executableCopy):
-        * assembler/AssemblerBuffer.h:
-        (JSC::AssemblerBuffer::putShortUnchecked):
-        (JSC::AssemblerBuffer::putIntUnchecked):
-        (JSC::AssemblerBuffer::putInt64Unchecked):
-        * jit/JITStubs.cpp:
-        * pcre/pcre_compile.cpp:
-        (jsRegExpCompile):
-        * wtf/FastMalloc.cpp:
-        (WTF::PageHeapAllocator::New):
-        (WTF::TCMalloc_Central_FreeList::Populate):
-        * wtf/MD5.cpp:
-        (WTF::reverseBytes):
-        (WTF::MD5::addBytes):
-        (WTF::MD5::checksum):
-        * wtf/StdLibExtras.h:
-        * wtf/Vector.h:
-        (WTF::VectorBuffer::inlineBuffer):
-        * wtf/qt/StringQt.cpp:
-        (WebCore::String::String):
-
-2010-07-29  Michael Saboff  <msaboff@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Changed the handling for removing and adding elements at the front
-        of an array.  The code now keeps a bias that indicates the amount of
-        JSValue sized holes are prior to the ArrayStorage block.  This means
-        that shift operations are now memmove's of the header part of
-        the ArrayStorage and unshift operations are similar, but may require a
-        realloc first to create the space.  Similar operations are performed
-        for special cases of splice and slice.
-        Also optimized the new Array(size) case so that we don't allocate and
-        initialize array elements until the JS code starts using elements.
-        The array growth code is slightly more aggressive for initial growth
-        based on size growth of any previous array.
-
-        * Configurations/JavaScriptCore.xcconfig:
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::emit_op_get_by_val):
-        (JSC::JIT::emit_op_put_by_val):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::emit_op_get_by_val):
-        (JSC::JIT::emit_op_put_by_val):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncShift):
-        (JSC::arrayProtoFuncSplice):
-        (JSC::arrayProtoFuncUnShift):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::JSArray):
-        (JSC::JSArray::~JSArray):
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::deleteProperty):
-        (JSC::JSArray::getOwnPropertyNames):
-        (JSC::JSArray::getNewVectorLength):
-        (JSC::JSArray::increaseVectorLength):
-        (JSC::JSArray::increaseVectorPrefixLength):
-        (JSC::JSArray::setLength):
-        (JSC::JSArray::pop):
-        (JSC::JSArray::push):
-        (JSC::JSArray::shiftCount):
-        (JSC::JSArray::unshiftCount):
-        (JSC::JSArray::sortNumeric):
-        (JSC::JSArray::sort):
-        (JSC::JSArray::fillArgList):
-        (JSC::JSArray::copyToRegisters):
-        (JSC::JSArray::compactForSorting):
-        (JSC::JSArray::subclassData):
-        (JSC::JSArray::setSubclassData):
-        (JSC::JSArray::checkConsistency):
-        * runtime/JSArray.h:
-        (JSC::JSArray::length):
-        (JSC::JSArray::canGetIndex):
-        (JSC::JSArray::getIndex):
-        (JSC::JSArray::setIndex):
-        (JSC::JSArray::uncheckedSetIndex):
-        (JSC::JSArray::arrayStorage):
-        (JSC::JSArray::setArrayStorage):
-        (JSC::JSArray::markChildrenDirect):
+        * runtime/Heap.cpp:
+        (JSC::Heap::allocate):
+        * runtime/Heap.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::operator new):
+        (JSC::JSCell::MarkedSpace::sizeClassFor):
+        (JSC::JSCell::MarkedSpace::allocate):
+        * runtime/MarkedBlock.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::SizeClass::SizeClass):
 
-2010-07-29  Michael Saboff  <msaboff@apple.com>
+2011-02-25  Michael Saboff  <msaboff@apple.com>
 
         Reviewed by Darin Adler.
 
-        Changed MINIMUM_CELL_SIZE to be fixed at 64 bytes.
-
-        * runtime/Collector.h:
+        Leak in JSParser::Scope of ScopeLabelInfo Vector
+        https://bugs.webkit.org/show_bug.cgi?id=55249
 
-2010-07-28  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by David Levin.
+        Changed m_labels to be an OwnPtr<>.  Added VectorTraits
+        and Scope copy constructor to support this change.
 
-        Added a yield() function.
-        https://bugs.webkit.org/show_bug.cgi?id=42843
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::~Scope):
 
-        * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * wtf/Threading.h:
-        * wtf/ThreadingPthreads.cpp:
-        (WTF::yield):
-        * wtf/ThreadingWin.cpp:
-        (WTF::yield):
-        * wtf/gtk/ThreadingGtk.cpp:
-        (WTF::yield):
-        * wtf/qt/ThreadingQt.cpp:
-        (WTF::yield):
+2011-02-25  Fumitoshi Ukai  <ukai@chromium.org>
 
-2010-07-29  Michael Saboff  <msaboff@apple.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Oliver Hunt.
+        WebSocket uses insecure random numbers
+        https://bugs.webkit.org/show_bug.cgi?id=54714
 
-        Fixed issue where RegExp greedy jit code loops when no input is
-        consumed.  Changed the code to only loop if some input was consumed,
-        but fall through if we successfully match an alternative that 
-        doesn't consume any input.
-        https://bugs.webkit.org/show_bug.cgi?id=42664
+        * JavaScriptCore.exp: Export WTF::cryptographicallyRandomNumber()
 
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
+2011-02-25  Patrick Gansterer  <paroga@webkit.org>
 
-2010-07-29  Gabor Loki  <loki@webkit.org>
+        Reviewed by Adam Roben.
 
-        Reviewed by Gavin Barraclough.
+        Move timeBeginPeriod into OS(WINDOWS) section
+        https://bugs.webkit.org/show_bug.cgi?id=55247
 
-        Avoid increasing required alignment of target type warning on ARM
-        https://bugs.webkit.org/show_bug.cgi?id=38045
+        * jsc.cpp:
+        (main): timeBeginPeriod is available on all Windows versions and not compiler specific.
 
-        The reinterpret_cast<Type1*>([pointer to Type2]) expressions - where
-        sizeof(Type1) > sizeof(Type2) - cause the following warning on ARM:
-        increases required alignment of target type warnings.
-        Casting the type of [pointer to Type2] object to void* bypasses the
-        warning.
+2011-02-25  Patrick Gansterer  <paroga@webkit.org>
 
-        * assembler/ARMAssembler.cpp:
-        (JSC::ARMAssembler::executableCopy):
-        * assembler/AssemblerBuffer.h:
-        (JSC::AssemblerBuffer::putShortUnchecked):
-        (JSC::AssemblerBuffer::putIntUnchecked):
-        (JSC::AssemblerBuffer::putInt64Unchecked):
-        * jit/JITStubs.cpp:
-        * pcre/pcre_compile.cpp:
-        (jsRegExpCompile):
-        * wtf/FastMalloc.cpp:
-        (WTF::PageHeapAllocator::New):
-        (WTF::TCMalloc_Central_FreeList::Populate):
-        * wtf/MD5.cpp:
-        (WTF::reverseBytes):
-        (WTF::MD5::addBytes):
-        (WTF::MD5::checksum):
-        * wtf/StdLibExtras.h:
-        (reinterpret_cast_ptr):
-        * wtf/Vector.h:
-        (WTF::VectorBuffer::inlineBuffer):
-        * wtf/qt/StringQt.cpp:
-        (WebCore::String::String):
+        Unreviewed WinCE build fix for r79695.
 
-2010-07-29  Martin Robinson  <mrobinson@igalia.com>
+        * jsc.cpp:
+        (main): SetErrorMode isn't available on WinCE.
 
-        Unreviewed build fix.
+2011-02-25  Adam Roben  <aroben@apple.com>
 
-        Include a missing header in the source list to fix 'make dist.'
+        Work around Cygwin's crash-suppression behavior
 
-        * GNUmakefile.am: Include missing header.
+        Cygwin calls ::SetErrorMode(SEM_FAILCRITICALERRORS), which any processes it launches will
+        inherit. This is bad for testing/debugging, as it causes the post-mortem debugger not to be
+        invoked. (Cygwin does this because it makes crashes more UNIX-y.) We reset the error mode
+        when our test apps launch to work around Cygwin's behavior.
 
-2010-07-28  Gavin Barraclough  <barraclough@apple.com>
+        Fixes <http://webkit.org/b/55222> Test apps crash silently (without invoking post-mortem
+        debugger) when launched from Cygwin 1.7
 
         Reviewed by Darin Adler.
 
-        Bug 43162 - Add support for MADV_FREE to PageAllocation.
-
-        * wtf/PageAllocation.cpp:
-        (WTF::PageAllocation::commit):
-        (WTF::PageAllocation::decommit):
-
-2010-07-27  Kinuko Yasuda  <kinuko@chromium.org>
-
-        Reviewed by Ojan Vafai.
-
-        Add FILE_SYSTEM build flag for FileSystem API
-        https://bugs.webkit.org/show_bug.cgi?id=42915
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2010-07-27  Gavin Barraclough  <barraclough@apple.com>
-
-        Temporarily rolling out http://trac.webkit.org/changeset/64177,
-        this seems to give QT ARM/Win a headache (specifically, looks
-        like structure layour differs, objects get too large - 
-        "..\..\..\JavaScriptCore\runtime\ArrayPrototype.cpp:41:"
-        "error: size of array 'dummyclass_fits_in_cell' is negative").
-
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::emit_op_get_by_val):
-        (JSC::JIT::emit_op_put_by_val):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::emit_op_get_by_val):
-        (JSC::JIT::emit_op_put_by_val):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncShift):
-        (JSC::arrayProtoFuncSplice):
-        (JSC::arrayProtoFuncUnShift):
-        * runtime/JSArray.cpp:
-        (JSC::increasedVectorLength):
-        (JSC::JSArray::JSArray):
-        (JSC::JSArray::~JSArray):
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::deleteProperty):
-        (JSC::JSArray::getOwnPropertyNames):
-        (JSC::JSArray::increaseVectorLength):
-        (JSC::JSArray::setLength):
-        (JSC::JSArray::pop):
-        (JSC::JSArray::push):
-        (JSC::JSArray::sortNumeric):
-        (JSC::JSArray::sort):
-        (JSC::JSArray::fillArgList):
-        (JSC::JSArray::copyToRegisters):
-        (JSC::JSArray::compactForSorting):
-        (JSC::JSArray::subclassData):
-        (JSC::JSArray::setSubclassData):
-        (JSC::JSArray::checkConsistency):
-        * runtime/JSArray.h:
-        (JSC::JSArray::length):
-        (JSC::JSArray::canGetIndex):
-        (JSC::JSArray::getIndex):
-        (JSC::JSArray::setIndex):
-        (JSC::JSArray::uncheckedSetIndex):
-        (JSC::JSArray::markChildrenDirect):
-
-2010-07-27  Gavin Barraclough  <barraclough@apple.com>
-
-        Speculative build fix for Chromium/Win
+        * API/tests/testapi.c: Added a now-needed #include.
+        (main):
+        * jsc.cpp:
+        (main):
+        Call ::SetErrorMode(0) to undo Cygwin's folly.
 
-        * wtf/Platform.h:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Define NOMINMAX like many of our
+        other projects do so that windows.h won't define min/max macros that interfere with
+        std::numeric_limits<T>::min/max.
 
-2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+2011-02-24  Adam Barth  <abarth@webkit.org>
 
-        Oh! that makes more sense!  Maybe C++-style comments are bringing teh bad mojo.
+        Reviewed by Eric Seidel.
 
-        * wtf/Platform.h:
+        Add GYP project for JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=55027
 
-2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+        Again, this GYP files is very rough, but it succeeds in building
+        JavaScriptCore.  There's a lot more work to do here, especially in the
+        area of sharing with JavaScriptGlue.gyp.  This patch is more of a
+        checkpoint so that other folks can help out if they wish.
 
-        Speculative build fix for GTK/64 ... seems to be barfing on a comment o_O
+        * gyp: Added.
+        * gyp/JavaScriptCore.gyp: Added.
+        * gyp/generate-derived-sources.sh: Added.
 
-        * wtf/Platform.h:
+2011-02-24  Adam Barth  <abarth@webkit.org>
 
-2010-07-27  Michael Saboff  <msaboff@apple.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Gavin Barraclough.
+        Add missing files to JavaScriptCore.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=55193
 
-        Changed the handling for removing and adding elements at the front
-        of an array.  The code now keeps a bias that indicates the amount of
-        JSValue sized holes are prior to the ArrayStorage block.  This means
-        that shift operations are now memmove's of the header part of
-        the ArrayStorage and unshift operations are similar, but may require a
-        realloc first to create the space.  Similar operations are performed
-        for special cases of splice and slice.
-        Also optimized the new Array(size) case so that we don't allocate and
-        initialize array elements until the JS code starts using elements.
-        The array growth code is slightly more aggressive for initial growth
-        based on size growth of any previous array.
-
-        * Configurations/JavaScriptCore.xcconfig:
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::emit_op_get_by_val):
-        (JSC::JIT::emit_op_put_by_val):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::emit_op_get_by_val):
-        (JSC::JIT::emit_op_put_by_val):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncShift):
-        (JSC::arrayProtoFuncSplice):
-        (JSC::arrayProtoFuncUnShift):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::JSArray):
-        (JSC::JSArray::~JSArray):
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::getOwnPropertyDescriptor):
-        (JSC::JSArray::put):
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::deleteProperty):
-        (JSC::JSArray::getOwnPropertyNames):
-        (JSC::JSArray::getNewVectorLength):
-        (JSC::JSArray::increaseVectorLength):
-        (JSC::JSArray::increaseVectorPrefixLength):
-        (JSC::JSArray::setLength):
-        (JSC::JSArray::pop):
-        (JSC::JSArray::push):
-        (JSC::JSArray::shiftCount):
-        (JSC::JSArray::unshiftCount):
-        (JSC::JSArray::sortNumeric):
-        (JSC::JSArray::sort):
-        (JSC::JSArray::fillArgList):
-        (JSC::JSArray::copyToRegisters):
-        (JSC::JSArray::compactForSorting):
-        (JSC::JSArray::subclassData):
-        (JSC::JSArray::setSubclassData):
-        (JSC::JSArray::checkConsistency):
-        * runtime/JSArray.h:
-        (JSC::JSArray::length):
-        (JSC::JSArray::canGetIndex):
-        (JSC::JSArray::getIndex):
-        (JSC::JSArray::setIndex):
-        (JSC::JSArray::uncheckedSetIndex):
-        (JSC::JSArray::arrayStorage):
-        (JSC::JSArray::setArrayStorage):
-        (JSC::JSArray::markChildrenDirect):
+        I forgot to add mm files in my previous patch.
 
-2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
 
-        Reviewed by Oliver Hunt.
+2011-02-24  Adam Barth  <abarth@webkit.org>
 
-        Bug 43089 - Cleanup JIT related switched in Platform.h
+        Reviewed by Eric Seidel.
 
-        The code the enable to JIT checks every permutation of platform & OS individually, but
-        now the JIT is enabled on the majority much all x86/x86-64/ARM/MIPS systems.  It should
-        be cleaner to just enable by default on these platforms, and explicitly disable on configs
-        that don't aren't supported.
+        Remove unused parameter name in GCActivityCallback.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=55194
 
-        Also, rename ENABLE_JIT_OPTIMIZE_MOD to ENABLE_JIT_USE_SOFT_MODULO.  I always find this
-        confusing since enabling this "optimization" would be possible, but would be a regression
-        on x86/x86-64 systems!  I think it's clearer to reserve "JIT_OPTIMIZE" for compiler
-        technologies applicable to all platforms, and make a more optional behaviour like this a
-        "USE".
+        This change is not strictly required for the GYP-based build system,
+        but I noticed this error when working on the new build system.
 
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutableAllocator::cacheFlush):
-        * jit/JIT.h:
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::emit_op_mod):
-        (JSC::JIT::emitSlow_op_mod):
-        * jit/JITArithmetic32_64.cpp:
-        (JSC::JIT::emit_op_mod):
-        (JSC::JIT::emitSlow_op_mod):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * wtf/Platform.h:
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
 
-2010-07-27  James Robinson  <jamesr@chromium.org>
+2011-02-24  James Robinson  <jamesr@chromium.org>
 
         Reviewed by Darin Fisher.
 
-        [chromium] Make PLATFORM(CHROMIUM) and not OS(MAC) turn USE(GLES2_RENDERING) on
-        https://bugs.webkit.org/show_bug.cgi?id=43084
+        Add a USE() macro to control use of the built-in UTF8 codec
+        https://bugs.webkit.org/show_bug.cgi?id=55189
 
-        This turns USE(GLES2_RENDERING) on for chromium on windows/linux.  This causes no
-        change in behavior, that's all controlled by ENABLE() macros that are currently off.
+        Defaults USE(BUILTIN_UTF8_CODEC) to true for all platforms except chromium, which controls the flag via features.gypi.
 
         * wtf/Platform.h:
 
-2010-07-23  Helder Correia  <heldercorreia@codeaurora.org>
-
-        Reviewed by Darin Adler.
-
-        Canvas tests 2d.imageData.object.round and 2d.imageData.object.wrap are
-        failing. For canvas image data manipulation, the values passed should
-        be truncated and wrapped. Also fix the canvas-ImageData-behaviour test
-        to expect wrapping rather than clamping, and add some new checkings.
-        https://bugs.webkit.org/show_bug.cgi?id=40272
-
-        * runtime/JSByteArray.h:
-        (JSC::JSByteArray::setIndex):
-        (JSC::JSByteArray::JSByteArray):
-
-2010-07-27  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 42621 - Add a bump allocator for the YARR interpreter
-
-        The regex engine requires lifo allocation, however currently uses the general purpose
-        malloc/free memory allocation.  A simple bump pointer allocator should provide a lower
-        overhead allocation solution.
-
-        When using YARR interpreter, 15% progression on v8-regex.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/JSGlobalData.h:
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::compile):
-        * wtf/BumpPointerAllocator.h: Added.
-        (WTF::BumpPointerPool::ensureCapacity):
-        (WTF::BumpPointerPool::alloc):
-        (WTF::BumpPointerPool::dealloc):
-        (WTF::BumpPointerPool::operator new):
-        (WTF::BumpPointerPool::BumpPointerPool):
-        (WTF::BumpPointerPool::create):
-        (WTF::BumpPointerPool::shrink):
-        (WTF::BumpPointerPool::destroy):
-        (WTF::BumpPointerPool::ensureCapacityCrossPool):
-        (WTF::BumpPointerPool::deallocCrossPool):
-        (WTF::BumpPointerAllocator::BumpPointerAllocator):
-        (WTF::BumpPointerAllocator::~BumpPointerAllocator):
-        (WTF::BumpPointerAllocator::startAllocator):
-        (WTF::BumpPointerAllocator::stopAllocator):
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::Interpreter::allocDisjunctionContext):
-        (JSC::Yarr::Interpreter::freeDisjunctionContext):
-        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
-        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
-        (JSC::Yarr::Interpreter::interpret):
-        (JSC::Yarr::Interpreter::Interpreter):
-        (JSC::Yarr::ByteCompiler::compile):
-        (JSC::Yarr::byteCompileRegex):
-        * yarr/RegexInterpreter.h:
-        (JSC::Yarr::BytecodePattern::BytecodePattern):
-
-2010-07-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Windows build fix from Chromium/GTK build fix!
-
-        * wtf/PageAllocation.cpp:
-
-2010-07-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Chromium/GTK build fix
-
-        * wtf/PageAllocation.cpp:
-
-2010-07-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Build fix for !Mac platforms.
-
-        * Android.mk:
-        * CMakeLists.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-
-2010-07-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 43009 - Abstract out page allocation from executable allocators
-
-        It would be great to have a single platform abstraction for block allocation, rather than copy/paste code.
-
-        In this initial implementation I've made Symbian fall back to use malloc/free for non-executable memory.
-        I think this will match current behaviour for the next client we will want to port across (RegisterFile &
-        Collector).
-
-        * CMakeListsEfl.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutableAllocator::intializePageSize):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        (JSC::ExecutableAllocator::isValid):
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutablePool::ExecutablePool):
-        (JSC::ExecutablePool::poolAllocate):
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::release):
-        (JSC::FixedVMPoolAllocator::reuse):
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
-        (JSC::FixedVMPoolAllocator::alloc):
-        (JSC::FixedVMPoolAllocator::free):
-        (JSC::FixedVMPoolAllocator::isValid):
-        (JSC::FixedVMPoolAllocator::isWithinVMPool):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        * jit/ExecutableAllocatorPosix.cpp: Removed.
-        * jit/ExecutableAllocatorSymbian.cpp: Removed.
-        * jit/ExecutableAllocatorWin.cpp: Removed.
-        * wscript:
-        * wtf/PageAllocator.cpp: Added.
-        (WTF::protection):
-        (WTF::PageAllocation::commit):
-        (WTF::PageAllocation::decommit):
-        (WTF::PageAllocator::allocate):
-        (WTF::PageAllocator::reserve):
-        (WTF::PageAllocator::deallocate):
-        (WTF::PageAllocator::pagesize):
-        * wtf/PageAllocator.h: Added.
-        (WTF::PageAllocation::PageAllocation):
-        (WTF::PageAllocation::base):
-        (WTF::PageAllocation::size):
-        (WTF::PageAllocation::chunk):
-        (WTF::PageAllocation::operator!):
-        (WTF::PageAllocator::):
-
-2010-07-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Rolling out r64097:64100, oops, more b0rked than I relized by my last changes, sorry!
-
-        * CMakeListsEfl.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutableAllocator::reprotectRegion):
-        (JSC::ExecutableAllocator::cacheFlush):
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutablePool::ExecutablePool):
-        (JSC::ExecutablePool::poolAllocate):
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::release):
-        (JSC::FixedVMPoolAllocator::reuse):
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
-        (JSC::FixedVMPoolAllocator::alloc):
-        (JSC::FixedVMPoolAllocator::free):
-        (JSC::FixedVMPoolAllocator::isValid):
-        (JSC::FixedVMPoolAllocator::isWithinVMPool):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        * jit/ExecutableAllocatorPosix.cpp: Added.
-        (JSC::ExecutableAllocator::intializePageSize):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        (JSC::ExecutableAllocator::isValid):
-        * jit/ExecutableAllocatorSymbian.cpp: Added.
-        (JSC::ExecutableAllocator::intializePageSize):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        (JSC::ExecutableAllocator::isValid):
-        * jit/ExecutableAllocatorWin.cpp: Added.
-        (JSC::ExecutableAllocator::intializePageSize):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        (JSC::ExecutableAllocator::isValid):
-        * wscript:
-        * wtf/PageAllocation.cpp: Removed.
-        * wtf/PageAllocation.h: Removed.
-
-2010-07-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Speculative !debug build fix II.
-
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::PageAllocation):
-
-2010-07-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Speculative !debug build fix.
-
-        * wtf/PageAllocation.h:
-        (WTF::PageAllocation::PageAllocation):
-
-2010-07-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 43009 - Abstract out page allocation from executable allocators
-
-        It would be great to have a single platform abstraction for block allocation, rather than copy/paste code.
-
-        In this initial implementation I've made Symbian fall back to use malloc/free for non-executable memory.
-        I think this will match current behaviour for the next client we will want to port across (RegisterFile &
-        Collector).
-
-        * CMakeListsEfl.txt:
-        * GNUmakefile.am:
-        * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutableAllocator::intializePageSize):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        (JSC::ExecutableAllocator::isValid):
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutablePool::ExecutablePool):
-        (JSC::ExecutablePool::poolAllocate):
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::release):
-        (JSC::FixedVMPoolAllocator::reuse):
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
-        (JSC::FixedVMPoolAllocator::alloc):
-        (JSC::FixedVMPoolAllocator::free):
-        (JSC::FixedVMPoolAllocator::isValid):
-        (JSC::FixedVMPoolAllocator::isWithinVMPool):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        * jit/ExecutableAllocatorPosix.cpp: Removed.
-        * jit/ExecutableAllocatorSymbian.cpp: Removed.
-        * jit/ExecutableAllocatorWin.cpp: Removed.
-        * wscript:
-        * wtf/PageAllocator.cpp: Added.
-        (WTF::protection):
-        (WTF::PageAllocation::commit):
-        (WTF::PageAllocation::decommit):
-        (WTF::PageAllocator::allocate):
-        (WTF::PageAllocator::reserve):
-        (WTF::PageAllocator::deallocate):
-        (WTF::PageAllocator::pagesize):
-        * wtf/PageAllocator.h: Added.
-        (WTF::PageAllocation::PageAllocation):
-        (WTF::PageAllocation::base):
-        (WTF::PageAllocation::size):
-        (WTF::PageAllocation::chunk):
-        (WTF::PageAllocation::operator!):
-        (WTF::PageAllocator::):
-
-2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml()
-
-        This ensures that long-running JavaScript (for example due to a modal alert() dialog),
-        will not trigger a deferred load after only 500ms (the default tokenizer delay) while
-        still giving a reasonable timeout (10 seconds) to prevent deadlock.
-
-        https://bugs.webkit.org/show_bug.cgi?id=29381
-
-        * runtime/TimeoutChecker.h: Add getter for the timeout interval
-
-2010-07-25  Patrick Gansterer  <paroga@paroga.com>
-
-        Reviewed by Kent Tamura.
-
-        [WINCE] Buildfix for JSC in release mode
-        https://bugs.webkit.org/show_bug.cgi?id=42934
-
-        * jsc.cpp: Don't use __try on WinCE.
-
-2010-07-24  Patrick Gansterer  <paroga@paroga.com>
-
-        Reviewed by Darin Adler.
-
-        [MSVC] Ensure 4 byte alignment on ARM
-        https://bugs.webkit.org/show_bug.cgi?id=42935
-
-        * jit/JITStubs.h: Added #pragma pack(4) around JITStackFrame.
-
-2010-07-24  Patrick Gansterer  <paroga@paroga.com>
+2011-02-24  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Darin Adler.
 
-        [WINCE] Cleanup defines in Platform.h
-        https://bugs.webkit.org/show_bug.cgi?id=42933
-
-        * wtf/Platform.h:
-
-2010-07-23  Rafael Antognolli  <antognolli@profusion.mobi>
-
-        Reviewed by Antonio Gomes.
-
-        [EFL] Cleanup glib support (make it optional)
-        https://bugs.webkit.org/show_bug.cgi?id=42480
-
-        Remove gobject/GRefPtr.cpp if not using soup/glib.
-
-        * wtf/CMakeListsEfl.txt:
-
-2010-07-23  Patrick Gansterer  <paroga@paroga.com>
-
-        Reviewed by Adam Roben.
-
-        [WINCE] Implement TCSpinLock.
-        https://bugs.webkit.org/show_bug.cgi?id=41792
-
-        Implement the SpinLock with InterlockedExchange from the Windows API.
-
-        * wtf/TCSpinLock.h:
-        (TCMalloc_SpinLock::Lock):
-        (TCMalloc_SpinLock::Unlock):
-        (TCMalloc_SpinLock::IsHeld):
-        (TCMalloc_SpinLock::Init):
-        (TCMalloc_SlowLock):
-
-2010-07-22  Csaba Osztrogonác  <ossy@webkit.org>
-
-        Unreviewed rolling out r63947 and r63948, because they broke Qt Windows build.
-
-        * jit/JITStubs.cpp:
-        * jit/JITStubs.h:
-
-2010-07-22  Gavin Barraclough  <barraclough@apple.com>
-
-        Eeeep! r63947 hosed all non-x86 builds!
-
-        * jit/JITStubs.h:
-
-2010-07-22  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 42818 - [Qt] REGRESSION(63348): jsc is broken
-        Speculative fix, need fastcall conventions on Qt/Win.
-
-        * jit/JITStubs.cpp:
-        * jit/JITStubs.h:
-
-2010-07-22  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Do more constant folding
-        https://bugs.webkit.org/show_bug.cgi?id=42867
-
-        Constant fold a few more operations.  SunSpider says this is
-        a win but I suspect that's just code motion at play.
-
-        * parser/ASTBuilder.h:
-        (JSC::ASTBuilder::makeModNode):
-        (JSC::ASTBuilder::makeURightShiftNode):
-        (JSC::ASTBuilder::makeBitOrNode):
-        (JSC::ASTBuilder::makeBitAndNode):
-        (JSC::ASTBuilder::makeBitXOrNode):
-        (JSC::ASTBuilder::makeBinaryNode):
-
-2010-07-22  Kent Hansen  <kent.hansen@nokia.com>
-
-        Reviewed by Kent Tamura.
-
-        Error properties of the Global Object are missing the DontEnum attribute
-        https://bugs.webkit.org/show_bug.cgi?id=28771
-
-        Add the attributes to become spec compliant.
-
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-
-2010-07-20  Steve Falkenburg  <sfalken@apple.com>
-
-        Reviewed by Adam Roben.
-
-        WebKit on Windows should build optionally with an unversioned ICU DLL
-        https://bugs.webkit.org/show_bug.cgi?id=42722
-        <rdar://problem/8211743> JavaScriptCore needs to link against unversioned ICU
-        
-        Dynamically create a new header, ICUVersion.h, as part of build-generated-files.sh.
-        Header contains a preprocessor define (U_DISABLE_RENAMING) indicating to ICU whether the ICU API
-        should be namespaced with the current ICU version number. Proper value is determined
-        by checking for the presence of libicuuc.lib, the unversioned copy of ICU.
+        Variable-sized allocation (but still capped at 64 bytes)
+        https://bugs.webkit.org/show_bug.cgi?id=55159
         
-        To get the proper value for U_DISABLE_RENAMING into all source files, we force
-        the include of ICUVersion.h (our generated header) via the compiler options.
-        
-        Since the versioned and unversioned ICU have different filenames (libicuuc.lib vs icuuc.lib)
-        we copy the ICU lib to an intermediate location under obj with a common name. This
-        allows us to link properly with either without adding a new build configuration.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
-        Copy ICU libs into a common location with a common name.
-        Add additional library search path to pick up icu lib.
-        Change ICU library filename specified to linker.
-        Add forced include of ICUVersion.h.
-        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Generate ICUVersion.h
-        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops: Add forced include of ICUVersion.h.
-        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
-        Copy ICU libs into a common location with a common name.
-        Add additional library search path to pick up icu lib.
-        Change ICU library filename specified to linker.
-        Add forced include of ICUVersion.h.
-        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
-        Copy ICU libs into a common location with a common name.
-        Add additional library search path to pick up icu lib.
-        Change ICU library filename specified to linker.
-        Add forced include of ICUVersion.h.
-
-2010-07-20  Steve Falkenburg  <sfalken@apple.com>
-
-        Re-save vsprops files after no-op edits in Visual Studio
-        to fix manual edit issues.
-
-2010-07-20  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
-
-        Reviewed by Steve Block.
-
-        Need to be able to configure Geolocation policy regarding user permissions
-        https://bugs.webkit.org/show_bug.cgi?id=42068
+        SunSpider reports no change.
 
-        If CLIENT_BASED_GEOLOCATION is enabled, enable preemtive permission policy
-        by default 
+        * JavaScriptCore.exp: Some day, I hope not to have to edit this file.
 
-        * wtf/Platform.h:
+        * runtime/Heap.cpp:
+        (JSC::Heap::allocateSlowCase): Split allocation into a fast and slow
+        case, so the fast case can inline size class selection and turn it into
+        a compile-time constant.
         
-2010-07-20  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r63742.
-        http://trac.webkit.org/changeset/63742
-        https://bugs.webkit.org/show_bug.cgi?id=42641
-
-        Broke Leopard Intel build. (Requested by bbandix on #webkit).
-
-        * wtf/Platform.h:
-
-2010-07-20  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
-
-        Reviewed by Steve Block.
+        Changed the collect-on-every allocation debugging switch to collect only
+        on every slow allocation, so you can still flip the switch without
+        recompiling the world. This may also be preferable for debugging purposes,
+        since collecting after every single allocation can be unusably slow,
+        and can mask problems by running destructors early.
 
-        Need to be able to configure Geolocation policy regarding user permissions
-        https://bugs.webkit.org/show_bug.cgi?id=42068
+        * runtime/Heap.h: Ditto.
 
-        If CLIENT_BASED_GEOLOCATION is enabled, enable preemtive permission policy
-        by default 
-
-        * wtf/Platform.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedSpace::sizeClassFor):
+        (JSC::JSCell::Heap::allocate):
+        (JSC::JSCell::JSCell::operator new): The inlining mentioned above.
+
+        * runtime/MarkedBlock.h: Dropped the block size from 256KB to 16KB. With
+        multiple size classes, allocating a full 256KB for the first allocation
+        in a given class can be pathologically wasteful. (8KB, or 4KB Mac and
+        8KB Windows, would be even better, but that seems to be a peformance
+        regression for now.)
         
-2010-07-19  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        SVG CleanUp of SVGPathData parsing
-        https://bugs.webkit.org/show_bug.cgi?id=41410
-
-        Added piOverTwo to MathExtras.
-
-        * wtf/MathExtras.h:
-
-2010-07-19  Mike Moretti  <mike.moretti@nokia.com>
-
-        Reviewed by Laszlo Gombos.
-
-        [Symbian] Build fix after r63404.
-
-        Implement isValid() function for the Symbian executable allocator.
-
-        * jit/ExecutableAllocatorSymbian.cpp:
-        (JSC::ExecutableAllocator::isValid):
-
-2010-07-19  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=42118
-        Disable WebGL on Leopard for now. 
-
-        LayoutTests fail on some graphics hardware on Leopard because one of the features we use,
-        GL_ARB_framebuffer_object, is not universally available in Leopard like it is in
-        SnowLeopard. This will allow LayoutTests to pass on Leopard until we add logic to use a
-        software OpenGL driver on machines without this support.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2010-07-16  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Use OwnPtr for CodeBlock objects
-        https://bugs.webkit.org/show_bug.cgi?id=42490
-
-        * runtime/Executable.cpp:
-        (JSC::EvalExecutable::EvalExecutable): Moved this here and made it non-inline.
-        Eliminated the code that used to initialize the raw pointer since it's now
-        an OwnPtr.
-        (JSC::EvalExecutable::~EvalExecutable): Removed the explicit delete here.
-        (JSC::ProgramExecutable::ProgramExecutable): Ditto.
-        (JSC::ProgramExecutable::~ProgramExecutable): Ditto.
-        (JSC::FunctionExecutable::FunctionExecutable): Ditto.
-        (JSC::FunctionExecutable::~FunctionExecutable): Ditto.
-        (JSC::EvalExecutable::compileInternal): Added use of adoptPtr and get.
-        (JSC::ProgramExecutable::compileInternal): Ditto.
-        (JSC::FunctionExecutable::compileForCallInternal): Ditto.
-        (JSC::FunctionExecutable::compileForConstructInternal): Ditto.
-        (JSC::FunctionExecutable::recompile): Use clear instead of delete followed
-        by assignment of 0.
-
-        * runtime/Executable.h: Moved constructors to the cpp file and changed
-        raw pointers to OwnPtr.
-
-2010-07-19  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [EFL] Fix build on 64-bit systems. According to
-        JavaScriptCore/wtf/Platform.h, x86_64 uses fixed allocator, which
-        needs jit/ExecutableAllocatorFixedVMPool.cpp to be included in build
-        system.
-        https://bugs.webkit.org/show_bug.cgi?id=42559
-
-        * CMakeListsEfl.txt: add missing file for x86_64.
-
-2010-07-16  Leandro Pereira  <leandro@profusion.mobi>
-
-        [EFL] Unreviewed build system cleanup.
-
-        Move ExecutableAllocator{FixedVMPool,Posix,Symbian,Win}.cpp from
-        root CMakeLists.txt to the platform CMakeLists.txt.
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::reset): There's more than one size class now, and its
+        cell size is not constant.
 
-        * CMakeLists.txt:
-        * CMakeListsEfl.txt: Add ExecutableAllocatorPosix.cpp.
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::SizeClass::SizeClass): Ditto.
 
-2010-07-16  Oliver Hunt  <oliver@apple.com>
+2011-02-23  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Geoffrey Garen.
 
-        ES5 allows use of reserved words as IdentifierName
-        https://bugs.webkit.org/show_bug.cgi?id=42471
-
-        Modify the lexer to allow us to avoid identifying reserved
-        words in those contexts where they are valid identifiers, and
-        we know it's safe.  Additionally tag the reserved word tokens
-        so we can easily identify them in those cases where we can't
-        guarantee that we've skipped reserved word identification.
-
-        * parser/JSParser.cpp:
-        (JSC::JSParser::next):
-        (JSC::JSParser::parseProperty):
-        (JSC::JSParser::parseMemberExpression):
-        * parser/JSParser.h:
-        (JSC::):
-        * parser/Lexer.cpp:
-        (JSC::Lexer::lex):
-        * parser/Lexer.h:
-        (JSC::Lexer::):
-
-2010-07-16  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        clang++ build fixes for JavaScriptCore and WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=42478
+        Make WeakGCMap use new handle infrastructure
+        https://bugs.webkit.org/show_bug.cgi?id=55100
 
-        * runtime/RegExpKey.h:
-        (JSC::operator==):
-        Move the RegExpKey equals operator into the JSC namespace so it can be found by ADL.
-
-2010-07-16  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by David Levin.
+        Remove old WeakGCMap implementation and move over to new handle
+        based logic.
 
-        Really add WARN_UNUSED_RESULT to leakRef
-        https://bugs.webkit.org/show_bug.cgi?id=42464
+        This has a number of benefits, most notably it makes a WeakGCMap
+        always reflect the true state of the world by as all entries are
+        removed at the first gc cycle that makes them dead.  This allows
+        us to get rid of code in a wide variety of objects where the only
+        purpose was to remove themselves from maps.
 
-        * wtf/PassRefPtr.h:
-        (WTF::PassRefPtr::):
-        (WTF::NonNullPassRefPtr::):
-        Put the WARN_UNUSED_RESULT attribute at the right place.
-
-        * wtf/RetainPtr.h:
-        (WTF::RetainPtr::releaseRef):
-        Remove WARN_UNUSED_RESULT here for now, it leads to two warnings that need
-        to be fixed first.
-
-2010-07-15  Victor Wang  <victorw@chromium.org>
-
-        Reviewed by David Levin.
-
-        [Chromium] Disable c4291 for chromium windows multi dll build.
-
-        https://bugs.webkit.org/show_bug.cgi?id=42177
-
-        * JavaScriptCore.gyp/JavaScriptCore.gyp:
-
-2010-07-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Crash entering mail.yahoo.com
-        https://bugs.webkit.org/show_bug.cgi?id=42394
-    
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::argumentNumberFor): Added a NULL check. If the
-        identifier we're resolving is not a local variable, registerFor returns
-        NULL.
-
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::FunctionBodyNode::emitBytecode): Unrelated to the crash, but I
-        noticed this while working on it: No need to NULL-check returnNode,
-        since an early return has already done so.
-
-2010-07-15  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Oliver Hunt.
-
-        [GTK] Simplify the distribution step
-        https://bugs.webkit.org/show_bug.cgi?id=42414
-
-        * GNUmakefile.am: Add extra dist files directly to EXTRA_DIST instead
-        of adding them by proxy via javascriptcore_dist. Sort the EXTRA_DIST list.
-        Refer to create_hash_table and create_regexp_tables directly, as is the
-        behavior with other code generation scripts.
-
-2010-07-15  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Fix dumping of op_put_by_id.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::printPutByIdOp):
-
-2010-07-15  Zoltan Herczeg  <zherczeg@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Refactoring some parts of the lexer
-        https://bugs.webkit.org/show_bug.cgi?id=41845
-
-        This patch is a precursor of refactoring the identifier
-        parsing, which currently slows down the lexer, and not
-        ready for landing. This patch contains those sources,
-        which does not slow down the lexer (mainly style changes).
-
-        SunSpider: no change (529.4ms to 528.7ms)
-        --parse-only: no change (31.0ms to 31.2ms)
-
-        * parser/Lexer.cpp:
-        (JSC::isIdentStart): using typesOfASCIICharacters to determine
-             whether the current character is in identifier start
-        (JSC::isIdentPart): using typesOfASCIICharacters to determine
-             whether the current character is in identifier part
-        (JSC::Lexer::parseString): style fix
-        (JSC::Lexer::lex): removing the else after the main which
-             which reduces code duplication
-
-2010-07-15  Mark Rowe  <mrowe@apple.com>
-
-        Update the sorting in the Xcode project files.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2010-07-14  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
+        It also means that we no longer need to have special "unchecked"
+        versions of any functions on WeakGCMap.  Alas in order to maintain
+        compatibility with the JSWeakObjectMapClear API it is still
+        necessary to have an api that resembles uncheckedRemove, this is
+        now deprecatedRemove and will be dealt with in a later patch.
 
-        Make sure that mixed interpreter/jit builds don't try to use the jit if the allocator fails
-        https://bugs.webkit.org/show_bug.cgi?id=42310
+        In order to get correct semantics in WeakGCMap we need more
+        contextual information in the finalizer, so we've added an
+        abstract class based finaliser and a context parameter to the
+        calls.
 
-        Add some null checks to deal with the Fixed VM allocator failing
-        to get the requested executable region, delay the creation of the
-        JITStubs in JSGlobalData until after we know whether we're using
-        the JIT.
+        The new an improved WeakGCMap also results in sigificantly more
+        churn in the weak handle lists so exposed some potential problems
+        during the post mark phase which have been rectified as well.
 
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutableAllocator::ExecutableAllocator):
-        (JSC::ExecutableAllocator::poolForSize):
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
-        (JSC::FixedVMPoolAllocator::alloc):
-        (JSC::FixedVMPoolAllocator::free):
-        (JSC::FixedVMPoolAllocator::isValid):
-        (JSC::ExecutableAllocator::isValid):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        * jit/ExecutableAllocatorPosix.cpp:
-        (JSC::ExecutableAllocator::isValid):
-        * jit/ExecutableAllocatorWin.cpp:
-        (JSC::ExecutableAllocator::isValid):
-        * jit/JIT.cpp:
-        (JSC::JIT::linkCall):
-        (JSC::JIT::linkConstruct):
-        * jit/JIT.h:
-        (JSC::JIT::compileCTIMachineTrampolines):
-        (JSC::JIT::compileCTINativeCall):
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::emit_op_mod):
-        * jit/JITArithmetic32_64.cpp:
-        (JSC::JIT::emit_op_mod):
-        * jit/JITCall.cpp:
-        (JSC::JIT::compileOpCallVarargs):
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpCallSlowCase):
-        * jit/JITCall32_64.cpp:
-        (JSC::JIT::compileOpCallVarargs):
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpCallSlowCase):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTINativeCall):
-        * jit/JITStubs.cpp:
-        (JSC::JITThunks::JITThunks):
-        (JSC::JITThunks::tryCacheGetByID):
-        (JSC::JITThunks::hostFunctionStub):
-        * jit/ThunkGenerators.cpp:
-        (JSC::charCodeAtThunkGenerator):
-        (JSC::charAtThunkGenerator):
-        (JSC::fromCharCodeThunkGenerator):
-        (JSC::sqrtThunkGenerator):
-        (JSC::powThunkGenerator):
-        * runtime/Executable.h:
-        (JSC::NativeExecutable::create):
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * API/JSWeakObjectMapRefPrivate.h:
+        * runtime/Heap.cpp:
+        (JSC::Heap::globalObjectCount):
+        (JSC::Heap::protectedGlobalObjectCount):
         * runtime/JSGlobalData.cpp:
         (JSC::JSGlobalData::JSGlobalData):
-        (JSC::JSGlobalData::getHostFunction):
         * runtime/JSGlobalData.h:
-        (JSC::JSGlobalData::getCTIStub):
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::jitCompileRegex):
-
-2010-07-14  Gavin Barraclough  <barraclough@apple.com>
-
-        Speculative Qt/Windows build fix.
-
-        * jit/JITStubs.h:
-
-2010-07-14  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=42280
-        JIT_STUB_ARGUMENT_VA_LIST is only slowing us down! Remove it!
-
-        * jit/JIT.h:
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::restoreArgumentReferenceForTrampoline):
-        * jit/JITStubs.cpp:
-        * jit/JITStubs.h:
-        * wtf/Platform.h:
-
-2010-07-14  Oliver Hunt  <oliver@apple.com>
-
-        RS=Geoff Garen.
-
-        Guard the CF path of interpreter vs. jit selection with PLATFORM(CF)
-
-        This allows the code to work on windows as well.  Also unifies the
-        environment variable with the preference name.
-
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-
-2010-07-14  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Don Melton.
-
-        Crash when trying to enable JIT and Interpreter in a single build.
-
-        CFPreferences code added at the last minute failed to account for
-        the preference not being present and then attempted to CFRelease
-        a null value.
-
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-
-2010-07-14  Zoltan Herczeg  <zherczeg@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Change indentations in the lexer
-        https://bugs.webkit.org/show_bug.cgi?id=41845
-
-        This patch fixes an old, indentation error comes from kjs,
-        as webkit has a different style rule for switches, and change
-        the indentation of the main switch, which is a temporary
-        style error. This change makes easier to see the behavioural
-        changes in the follow-up patch.
-
-        No behavioural changes.
-
-        * parser/Lexer.cpp:
-        (JSC::singleEscape):
-        (JSC::Lexer::lex):
-
-2010-07-13  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r63262.
-        http://trac.webkit.org/changeset/63262
-        https://bugs.webkit.org/show_bug.cgi?id=42229
-
-        broke Windows compile (Requested by bweinstein on #webkit).
-
-        * API/tests/testapi.c:
-        (assertEqualsAsCharactersPtr):
-        (main):
-        * testapi.pro: Removed.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::iterator::iterator):
+        (JSC::WeakGCMap::iterator::get):
+        (JSC::WeakGCMap::iterator::getSlot):
+        (JSC::WeakGCMap::iterator::operator++):
+        (JSC::WeakGCMap::iterator::operator==):
+        (JSC::WeakGCMap::iterator::operator!=):
+        (JSC::WeakGCMap::WeakGCMap):
+        (JSC::WeakGCMap::isEmpty):
+        (JSC::WeakGCMap::clear):
+        (JSC::WeakGCMap::get):
+        (JSC::WeakGCMap::getSlot):
+        (JSC::WeakGCMap::set):
+        (JSC::WeakGCMap::take):
+        (JSC::WeakGCMap::size):
+        (JSC::WeakGCMap::deprecatedRemove):
+        (JSC::WeakGCMap::begin):
+        (JSC::WeakGCMap::end):
+        (JSC::WeakGCMap::~WeakGCMap):
+        (JSC::WeakGCMap::finalize):
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::set):
 
-2010-07-13  Oliver Hunt  <oliver@apple.com>
+2011-02-24  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Gavin Barraclough.
 
-        ES5 requires BOMs to be treated as whitespace
-        https://bugs.webkit.org/show_bug.cgi?id=42218
-
-        Add BOM character to the Lexer's definition of whitespace,
-        and remove the logic that dealt with stripping BOMs and
-        caching the cleaned string.
-
-        * parser/Lexer.h:
-        (JSC::Lexer::isWhiteSpace):
-        * parser/SourceProvider.h:
-        (JSC::UStringSourceProvider::create):
-        (JSC::UStringSourceProvider::UStringSourceProvider):
-        * wtf/text/StringImpl.h:
-
-2010-07-13  Andreas Kling  <andreas.kling@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        Avoid slow-path for put() in Array.splice()
-        https://bugs.webkit.org/show_bug.cgi?id=41920
-
-        Defer creation of the returned array until its final size is known
-        to avoid growing it while adding elements.
-
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::JSArray): Add two modes of creation, CreateInitialized (old)
-        and CreateCompact (which should only be used when constructing arrays whose
-        size and contents are known at the time of creation.)
-        (JSC::JSArray::setLength): Skip first consistency check if in CreateCompact
-        initialization mode. (Only applies to non-empty arrays.)
-        (JSC::JSArray::checkConsistency): Build fix (JSValue::type() is gone)
-        * runtime/JSArray.h:
-        (JSC::JSArray::uncheckedSetIndex): Added for fast initialization of compact
-        arrays. Does no bounds or other sanity checking.
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncSplice): Optimized creation of the returned JSArray.
-        * runtime/ArrayConstructor.cpp:
-        (JSC::constructArrayWithSizeQuirk): Pass CreateInitialized to ctor.
-        * runtime/JSGlobalObject.h:
-        (JSC::constructEmptyArray): Pass CreateInitialized to ctor.
-        * runtime/RegExpConstructor.cpp:
-        (JSC::RegExpMatchesArray::RegExpMatchesArray): Pass CreateInitialized to ctor.
-
-2010-07-13  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 42207 - Clean up interface to compile executables, always check for exceptions
-
-        Presently interface to compile executable is inconsistent between eval/program and
-        function code, and is error prone in allowing a caller to byte compile without JIT
-        compiling an executable (we rely on all executables with codeblocks having JIT code).
-        Unify on an interface where all compilation is performed by a single compile (with
-        ForCall|ForConstruct variants) method, and make all clients check for errors.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::executeCall):
-        (JSC::Interpreter::executeConstruct):
-        (JSC::Interpreter::prepareForRepeatCall):
-        (JSC::Interpreter::privateExecute):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * parser/Parser.h:
-        (JSC::Parser::isFunctionBodyNode):
-        (JSC::Parser::parse):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::isNumericCompareFunction):
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createStackOverflowError):
-        * runtime/ExceptionHelpers.h:
-        * runtime/Executable.cpp:
-        (JSC::EvalExecutable::compileInternal):
-        (JSC::ProgramExecutable::checkSyntax):
-        (JSC::ProgramExecutable::compileInternal):
-        (JSC::FunctionExecutable::compileForCallInternal):
-        (JSC::FunctionExecutable::compileForConstructInternal):
-        (JSC::FunctionExecutable::reparseExceptionInfo):
-        (JSC::EvalExecutable::reparseExceptionInfo):
-        (JSC::FunctionExecutable::fromGlobalCode):
-        * runtime/Executable.h:
-        (JSC::EvalExecutable::compile):
-        (JSC::EvalExecutable::generatedBytecode):
-        (JSC::EvalExecutable::generatedJITCode):
-        (JSC::ProgramExecutable::compile):
-        (JSC::ProgramExecutable::generatedBytecode):
-        (JSC::ProgramExecutable::generatedJITCode):
-        (JSC::FunctionExecutable::generatedBytecode):
-        (JSC::FunctionExecutable::compileForCall):
-        (JSC::FunctionExecutable::compileForConstruct):
-        (JSC::FunctionExecutable::generatedJITCodeForConstructWithArityCheck):
-        * runtime/FunctionConstructor.cpp:
-        (JSC::constructFunction):
-        * runtime/JSActivation.cpp:
-        (JSC::JSActivation::argumentsGetter):
-        * runtime/JSGlobalData.h:
-        (JSC::JSGlobalData::canUseJIT):
-
-2010-07-13  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
-
-        Reviewed by Oliver Hunt.
-
-        testapi.c depends on the Core Foundation.
-        https://bugs.webkit.org/show_bug.cgi?id=40058
-
-        Separate CoreFoundation specific tests in JSC's testapi.c. Enabling it
-        to compile in Qt environments.
-
-        All tests should work except for the JSStringCreateWithCharacters() function,
-        because its tests depend on Core Foundation specific functions.
-
-        * API/tests/testapi.c:
-        (testJSStringRefCF): moved CoreFoundation specific tests to this function.
-        (main): The moves plus some minor tweaks.
-        * testapi.pro: Added.
+        Make weaklist processing deal with weak handles being removed during the iteration
+        https://bugs.webkit.org/show_bug.cgi?id=55105
+
+        It is possible for the handle heap to end up in a broken state if
+        a handle's finalizer removes either the current or next handle
+        to be visited during the post-gc cleanup.  This patch removes that
+        problem by allowing the deallocate(Node*) routine to update the
+        iterator if it is called during finalization.
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::HandleHeap):
+        (JSC::HandleHeap::updateAfterMark):
+        (JSC::HandleHeap::clearWeakPointers):
+        (JSC::HandleHeap::writeBarrier):
+        (JSC::HandleHeap::protectedGlobalObjectCount):
+        * collector/handles/HandleHeap.h:
+        (JSC::Finalizer::~Finalizer):
+        (JSC::HandleHeap::getFinalizer):
+        (JSC::HandleHeap::deallocate):
+        (JSC::HandleHeap::makeWeak):
+        (JSC::HandleHeap::makeSelfDestroying):
+        (JSC::HandleHeap::Node::Node):
+        (JSC::HandleHeap::Node::setFinalizer):
+        (JSC::HandleHeap::Node::finalizer):
+        (JSC::HandleHeap::Node::finalizerContext):
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::setGlobalObject):
+        (JSC::GlobalObjectNotifier::finalize):
+        (JSC::RegisterFile::globalObjectCollectedNotifier):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * runtime/Heap.cpp:
+        (JSC::Heap::destroy):
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::set):
 
-2010-07-13  Gavin Barraclough  <barraclough@apple.com>
+2011-02-24  Michael Saboff  <msaboff@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Bug 42182 - Change how numeric compare functions are detected
-
-        There are three problems with the current mechanism:
-          * It requires that a function executable be bytecode compiled without
-            being JIT generated (in order to copy the bytecode from the numeric
-            compare function).  This is a problem since we have an invariant when
-            running with the JIT that functions are never bytecode compiled without
-            also being JIT generated (after checking the codeblock we assume the
-            function has JIT code).  To help maintain this invariant 
-          * This implementation will prevent us from experimenting with alternate
-            compilation paths which do not compile via bytecode.
-          * It doesn't work.  Functions passing more than two arguments will match
-            if they are comparing their last two arguments, not the first two.
-            Generally the mapping back from bytecode to semantics may be more
-            complex then initially expected.
-
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::generate):
-        (JSC::BytecodeGenerator::setIsNumericCompareFunction):
-        (JSC::BytecodeGenerator::argumentNumberFor):
-        * bytecompiler/BytecodeGenerator.h:
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::BlockNode::singleStatement):
-        (JSC::FunctionBodyNode::emitBytecode):
-        * parser/Nodes.h:
-        (JSC::ExpressionNode::isSubtract):
-        (JSC::BinaryOpNode::lhs):
-        (JSC::BinaryOpNode::rhs):
-        (JSC::SubNode::isSubtract):
-        (JSC::ReturnNode::value):
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * runtime/JSGlobalData.h:
-
-2010-07-12  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        REGRESSION: Crash at JSC::JIT::privateCompile(JSC::MacroAssemblerCodePtr*)
-        https://bugs.webkit.org/show_bug.cgi?id=41763
-
-        There are two parts to this patch, the first is to fix the actual
-        problem.  When calling copyStringWithoutBOMs on a string we know
-        to contain BOMs we return a value indicating that there are no
-        BOMs.
-
-        The second part of this fix is simply to harden the path that
-        led to a crash when parsing failed.
-
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-           Harden compilation stubs against parser failure.
-        * parser/Lexer.cpp:
-        (JSC::Lexer::sourceCode):
-           Add assertions to ensure that subranges into a source provider
-           are always actually braces.  Hopefully this should catch similar
-           failures in future.  These assertions fire on existing tests
-           without this fix.
-        * runtime/Executable.h:
-        (JSC::FunctionExecutable::tryJitCodeForCall):
-        (JSC::FunctionExecutable::tryJitCodeForConstruct):
-        * wtf/text/StringImpl.h:
-        (WebCore::StringImpl::copyStringWithoutBOMs):
-           Make copyStringWithBOMs do the right thing.
-
-2010-07-13  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        Fix the constant encoding in data transfer instructions on ARM
-        https://bugs.webkit.org/show_bug.cgi?id=42166
-
-        The getImm function is designed to produce modified immediate constant
-        for data processing instructions. It should not be used to encode
-        any constant for data transfer. In the current situation there is no
-        way to use any immediate constant for data transfer. So, the moveImm
-        function is the desired method to pass the offset value to the data
-        transfer instructions.
-
-        Reported by Jacob Bramley.
-
-        * assembler/ARMAssembler.cpp:
-        (JSC::ARMAssembler::dataTransfer32):
-        * assembler/MacroAssemblerARM.h:
-        (JSC::MacroAssemblerARM::call32):
-
-2010-07-09  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        String to number coercion is not spec compliant
-        https://bugs.webkit.org/show_bug.cgi?id=31349
-
-        ToNumber should ignore NBSP (\u00a0)
-        https://bugs.webkit.org/show_bug.cgi?id=25490
-
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::parseIntOverflow): Added a version that works on UChar.
-        * runtime/JSGlobalObjectFunctions.h: Ditto.
-
-        * runtime/UString.cpp:
-        (JSC::isInfinity): Added helper functions.
-        (JSC::UString::toDouble): Use isStrWhiteSpace instead of
-        isSASCIISpace to define what we should skip. Got rid of the
-        code that used CString and UTF8String, instead processing the
-        UChar of the string directly, except for when we call strtod.
-        For strtod, use our own home-grown conversion function that
-        does not try to do any UTF-16 processing. Tidied up the logic
-        a bit as well.
-
-2010-07-12  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Xan Lopez.
+        PatternAlternative leaked in YarrPatternConstructor::atomParenthesesEnd()
+        https://bugs.webkit.org/show_bug.cgi?id=55156
 
-        [GTK] make dist is broken because of missing headers and other miscellaneous reasons
-        https://bugs.webkit.org/show_bug.cgi?id=42107
+        Added code to delete unneeded PatternAlternative after it is removed
+        from m_alternatives Vector.
 
-        * GNUmakefile.am: Add missing header to the sources list.
-
-2010-07-12  Adam Roben  <aroben@apple.com>
-
-        Stop generating stripped symbols for Release builds
-
-        It turns out we can strip the symbols after-the-fact using PDBCopy.
-
-        Fixes <http://webkit.org/b/42085>.
-
-        Reviewed by Steve Falkenburg.
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
-        Removed the pre-link event, which just created the public\sym
-        directory.
+2011-02-24  Eric Seidel  <eric@webkit.org>
 
-2010-07-12  Anders Carlsson  <andersca@apple.com>
+        Reviewed by Anders Carlsson.
 
-        Reviewed by Dan Bernstein.
+        VectorBuffer should not call malloc(0)
+        https://bugs.webkit.org/show_bug.cgi?id=55091
 
-        Add WARN_UNUSED_RETURN to the smart pointer "leak" member functions
-        https://bugs.webkit.org/show_bug.cgi?id=42086
+        Turns out the malloc() call which was so hot in:
+        https://bugs.webkit.org/show_bug.cgi?id=55005
+        was actually just malloc(0).
 
-        * wtf/OwnPtr.h:
-        * wtf/PassOwnPtr.h:
-        * wtf/PassRefPtr.h:
-        (WTF::PassRefPtr::releaseRef):
-        (WTF::NonNullPassRefPtr::leakRef):
-        (WTF::NonNullPassRefPtr::releaseRef):
-        * wtf/RetainPtr.h:
-        (WTF::RetainPtr::releaseRef):
+        We shouldn't be calling malloc(0) anyway, since there is no need to
+        and it might actually do work on some systems.
+        I believe on Mac it ends up taking the standard spinlocks (expensive)
+        and the code on Brew actually does a malloc(1) instead.  Neither is desirable.
 
-2010-07-10  Oliver Hunt  <oliver@apple.com>
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::allocateBuffer):
+        (WTF::VectorBufferBase::tryAllocateBuffer):
 
-        Reviewed by Maciej Stachowiak.
+2011-02-24  Patrick Gansterer  <paroga@webkit.org>
 
-        HAVE_COMPUTED_GOTO is dependent on the interpreter being enabled
-        https://bugs.webkit.org/show_bug.cgi?id=42039
+        Reviewed by Darin Adler.
 
-        Separate the existence of computed goto support in the compiler
-        from whether or not we are using the interpreter.  All the current
-        HAVE(COMPUTED_GOTO) guards are for the interpreter, but I'd like
-        the option of using it elsewhere.  The interpreter now uses
-        ENABLE(COMPUTED_GOTO_INTERPRETER) 
+        Remove obsolete PLATFORM(CI)
+        https://bugs.webkit.org/show_bug.cgi?id=55082
 
-        * bytecode/Instruction.h:
-        (JSC::Instruction::Instruction):
-        * bytecode/Opcode.h:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::Interpreter):
-        (JSC::Interpreter::isOpcode):
-        (JSC::Interpreter::privateExecute):
-        * interpreter/Interpreter.h:
-        (JSC::Interpreter::getOpcode):
-        (JSC::Interpreter::getOpcodeID):
         * wtf/Platform.h:
 
-2010-07-10  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Remove switches from inner expression loops in the parser
-        https://bugs.webkit.org/show_bug.cgi?id=42035
-
-        Use bitmasks and flags on the token types to identify unary and
-        binary operators, rather than switching on the token type to
-        identify them.
-
-        * parser/JSParser.cpp:
-        (JSC::isUnaryOp):
-        (JSC::JSParser::isBinaryOperator):
-        * parser/JSParser.h:
-        (JSC::):
-
-2010-07-09  Leon Clarke  <leonclarke@google.com>
-
-        Reviewed by Adam Barth.
-
-        add support for link prefetching
-        https://bugs.webkit.org/show_bug.cgi?id=3652
-
-        * Configurations/FeatureDefines.xcconfig:
+2011-02-24  Martin Robinson  <mrobinson@igalia.com>
 
-2010-07-09  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Darin Adler.
+        Reviewed by Xan Lopez.
 
-        Tidy up lexer token ids
-        https://bugs.webkit.org/show_bug.cgi?id=42014
+        [GTK] Remove the GFile GOwnPtr specialization
+        https://bugs.webkit.org/show_bug.cgi?id=55154
 
-        Stop using character literals to identify single character tokens
-        and instead use symbolic names for all tokens.
+        Remove the GFile specialization of GOwnPtr. It's sufficient to use GRefPtr
+        to track GFiles since they are just regular reference-counted GObjects.
 
-        * parser/ASTBuilder.h:
-        (JSC::ASTBuilder::makeBinaryNode):
-        * parser/JSParser.cpp:
-        (JSC::JSParser::consume):
-        (JSC::JSParser::match):
-        (JSC::JSParser::autoSemiColon):
-        (JSC::JSParser::JSParser):
-        (JSC::JSParser::parseProgram):
-        (JSC::JSParser::allowAutomaticSemicolon):
-        (JSC::JSParser::parseDoWhileStatement):
-        (JSC::JSParser::parseWhileStatement):
-        (JSC::JSParser::parseVarDeclarationList):
-        (JSC::JSParser::parseConstDeclarationList):
-        (JSC::JSParser::parseForStatement):
-        (JSC::JSParser::parseReturnStatement):
-        (JSC::JSParser::parseWithStatement):
-        (JSC::JSParser::parseSwitchStatement):
-        (JSC::JSParser::parseSwitchClauses):
-        (JSC::JSParser::parseSwitchDefaultClause):
-        (JSC::JSParser::parseTryStatement):
-        (JSC::JSParser::parseDebuggerStatement):
-        (JSC::JSParser::parseStatement):
-        (JSC::JSParser::parseFormalParameters):
-        (JSC::JSParser::parseFunctionInfo):
-        (JSC::JSParser::parseExpressionOrLabelStatement):
-        (JSC::JSParser::parseIfStatement):
-        (JSC::JSParser::parseExpression):
-        (JSC::JSParser::parseAssignmentExpression):
-        (JSC::JSParser::parseConditionalExpression):
-        (JSC::isUnaryOp):
-        (JSC::JSParser::isBinaryOperator):
-        (JSC::JSParser::parseBinaryExpression):
-        (JSC::JSParser::parseProperty):
-        (JSC::JSParser::parseObjectLiteral):
-        (JSC::JSParser::parseStrictObjectLiteral):
-        (JSC::JSParser::parseArrayLiteral):
-        (JSC::JSParser::parsePrimaryExpression):
-        (JSC::JSParser::parseArguments):
-        (JSC::JSParser::parseMemberExpression):
-        (JSC::JSParser::parseUnaryExpression):
-        * parser/JSParser.h:
-        (JSC::):
-        * parser/Lexer.cpp:
-        (JSC::):
-        (JSC::Lexer::lex):
-        * parser/Lexer.h:
+        * wtf/gobject/GOwnPtr.cpp: Remove GFile specialization.
+        * wtf/gobject/GOwnPtr.h: Ditto.
 
-2010-07-09  Gavin Barraclough  <barraclough@apple.com>
+2011-02-24  Patrick Gansterer  <paroga@webkit.org>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Eric Seidel.
 
-        Bug 42015 - Enable JSValue32_64 on ARMv7
+        Rename PLATFORM(SKIA) to USE(SKIA)
+        https://bugs.webkit.org/show_bug.cgi?id=55090
 
-        * Configurations/JavaScriptCore.xcconfig:
-        * jit/JIT.h:
-        * jit/JITStubs.cpp:
         * wtf/Platform.h:
 
-2010-07-09  Kenneth Russell  <kbr@google.com>
+2011-02-24  Patrick Gansterer  <paroga@webkit.org>
 
-        Reviewed by Dimitri Glazkov.
-
-        Assertion failure in String::utf8() for certain invalid UTF16 inputs
-        https://bugs.webkit.org/show_bug.cgi?id=41983
-
-        * wtf/text/WTFString.cpp:
-        (WebCore::String::utf8):
-         - Fixed assertion when sourceExhausted is returned from convertUTF16ToUTF8.
-
-2010-07-09  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Remove a couple of excess writes from the lexer
-        https://bugs.webkit.org/show_bug.cgi?id=41981
-
-        Remove a couple of fields from JSTokenInfo, and rename the remaining ones
-        to something more accurate
-
-        * parser/JSParser.cpp:
-        (JSC::JSParser::next):
-        (JSC::JSParser::tokenStart):
-        (JSC::JSParser::tokenLine):
-        (JSC::JSParser::tokenEnd):
-        * parser/JSParser.h:
-        (JSC::JSTokenInfo::JSTokenInfo):
-        * parser/Lexer.cpp:
-        (JSC::Lexer::lex):
+        Reviewed by Alexey Proskuryakov.
 
-2010-07-08  Oliver Hunt  <oliver@apple.com>
+        Remove pthreads dependecy for JSLock
+        https://bugs.webkit.org/show_bug.cgi?id=54832
 
-        Reviewed by Sam Weinig.
+        JSLock is only needed to support an obsolete execution model where JavaScriptCore
+        automatically protected against concurrent access from multiple threads.
+        So it's safe to disable it on non-mac platforms where we don't have native pthreads.
 
-        Property declarations in an object literal should not consider the prototype chain when being added to the new object
-        https://bugs.webkit.org/show_bug.cgi?id=41929
-
-        To fix this all we need to do is ensure that all new properties are
-        added with putDirect rather than a fully generic call to put.  This
-        is safe as an object literal is by definition going to produce a
-        completely normal object.
+        * runtime/JSLock.cpp:
 
-        Rather than duplicating all the put_by_id logic we add an additional
-        flag to op_put_by_id to indicate it should be using putDirect.  In
-        the interpreter this adds a runtime branch, but in the jit this is
-        essentially free as the branch is taken at compile time.  This does
-        actually improve object literal creation time even in the interpreter
-        as we no longer need to walk the prototype chain to verify that the
-        cached put is safe.
+2011-02-24  Chao-ying Fu  <fu@mips.com>
 
-        We still emit normal put_by_id code when emitting __proto__ as we want
-        to get the correct handling for changing the prototype.
+        Reviewed by Eric Seidel.
 
-        Sunspider claims this is a 0.7% speedup which is conceivably real due
-        to the performance improvement in object literals, but I suspect its
-        really just the result of code motion.
+        Fix MIPS build with new patchOffsetPut/GetByIdPropertyMapOffset1/2 values
+        https://bugs.webkit.org/show_bug.cgi?id=54997
 
-        * bytecode/Opcode.h:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitPutById):
-        (JSC::BytecodeGenerator::emitDirectPutById):
-        * bytecompiler/BytecodeGenerator.h:
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::PropertyListNode::emitBytecode):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
         * jit/JIT.h:
-        (JSC::JIT::compilePutByIdTransition):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::emit_op_put_by_id):
-        (JSC::JIT::emitSlow_op_put_by_id):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::patchPutByIdReplace):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::emitSlow_op_put_by_id):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::patchPutByIdReplace):
         * jit/JITStubs.cpp:
-        (JSC::JITThunks::tryCachePutByID):
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jit/JITStubs.h:
-        (JSC::):
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * runtime/JSObject.h:
-        (JSC::JSObject::putDirect):
-        (JSC::JSValue::putDirect):
-        * runtime/JSValue.h:
-
-2010-07-08  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        String.prototype methods should CheckObjectCoercible (test this is not null or undefined).
-
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncCharAt):
-        (JSC::stringProtoFuncCharCodeAt):
-        (JSC::stringProtoFuncConcat):
-        (JSC::stringProtoFuncIndexOf):
-        (JSC::stringProtoFuncLastIndexOf):
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
-        (JSC::stringProtoFuncSlice):
-        (JSC::stringProtoFuncSplit):
-        (JSC::stringProtoFuncSubstr):
-        (JSC::stringProtoFuncSubstring):
-        (JSC::stringProtoFuncToLowerCase):
-        (JSC::stringProtoFuncToUpperCase):
-        (JSC::stringProtoFuncLocaleCompare):
-        (JSC::trimString):
-
-2010-07-08  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Date.prototype.toJSON takes one argument, report this correctly.
-
-        * runtime/DatePrototype.cpp:
-
-2010-07-08  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        RegExp's prototype should be an object of type RegExp.
-
-        * runtime/RegExpPrototype.cpp:
-        (JSC::RegExpPrototype::RegExpPrototype):
-        * runtime/RegExpPrototype.h:
-
-2010-07-08  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        JavaScript parser violates ECMA automatic semicolon insertion rule
-        https://bugs.webkit.org/show_bug.cgi?id=41844
-
-        Remove (very) old and bogus logic that automatically inserted a semicolon
-        at the end of a script's source.
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::lex):
-
-2010-07-08  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Anders Carlson.
-
-        Tidy up the lexer
-
-        Remove some of the old yacc/lex-isms still present in the lexer
-
-        * parser/JSParser.h:
-        (JSC::):
-        * parser/Lexer.cpp:
-        (JSC::Lexer::parseString):
-        (JSC::Lexer::lex):
-        * parser/Lexer.h:
-
-2010-07-08  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Make object-literal parsing conformant with the spec.
-        https://bugs.webkit.org/show_bug.cgi?id=41892
-
-        Bring our parsing of object literals into conformance with the ES5 spec.
-        Basically disallow conflicting accessor vs. normal property definitions
-        The bulk of this patch is just fiddling to maintain performance.
-
-        * parser/ASTBuilder.h:
-        (JSC::ASTBuilder::createGetterOrSetterProperty):
-        (JSC::ASTBuilder::createProperty):
-        (JSC::ASTBuilder::getName):
-        (JSC::ASTBuilder::getType):
-        * parser/JSParser.cpp:
-        (JSC::jsParse):
-        (JSC::JSParser::JSParser):
-        (JSC::JSParser::parseProperty):
-        (JSC::JSParser::parseObjectLiteral):
-        (JSC::JSParser::parseStrictObjectLiteral):
-        * parser/JSParser.h:
-        * parser/Lexer.cpp:
-        (JSC::Lexer::clear):
-        * parser/Lexer.h:
-        (JSC::Lexer::currentOffset):
-        (JSC::Lexer::setOffset):
-          Add logic to allow us to roll the lexer back in the input stream.
-        * parser/Nodes.h:
-        (JSC::PropertyNode::):
-        (JSC::PropertyNode::type):
-        * parser/Parser.cpp:
-        (JSC::Parser::parse):
-        * parser/SourceProvider.h:
-        (JSC::SourceProvider::SourceProvider):
-        (JSC::SourceProvider::isValid):
-        (JSC::SourceProvider::setValid):
-          SourceProvider now records whether the input text
-          has already been validated.
-        * parser/SyntaxChecker.h:
-        (JSC::SyntaxChecker::SyntaxChecker):
-        (JSC::SyntaxChecker::Property::Property):
-        (JSC::SyntaxChecker::Property::operator!):
-        (JSC::SyntaxChecker::createProperty):
-        (JSC::SyntaxChecker::createPropertyList):
-        (JSC::SyntaxChecker::createGetterOrSetterProperty):
-          The SyntaxChecker mode now needs to maintain a bit more information
-          to ensure that we can validate object literals correctly.
-
-2010-07-08  Darin Adler  <darin@apple.com>
-
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::sharedInstance): Fix typo.
-
-2010-07-08  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix assertion seen on the Leopard buildbot.
-        The single shared instance of JSGlobalData was not being
-        adopted after creation.
-
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::sharedInstance): Do adoptRef and then leakRef.
-
-2010-07-08  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        BOMs are whitespace.
-
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::isStrWhiteSpace):
-
-2010-07-08  Martin Robinson  <mrobinson@igalia.com>
-
-        Unreviewed.
-
-        Try fix the GTK+ build by touching this file.
-
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-
-2010-07-08  Gavin Barraclough  <barraclough@apple.com>
-
-        GTK build fix take two.
-
-        * GNUmakefile.am:
-
-2010-07-08  Gavin Barraclough  <barraclough@apple.com>
-
-        GTK build fix.
-
-        * GNUmakefile.am:
-
-2010-07-08  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=41641
-
-        Update compile flags to allow use of ExecutableAllocatorFixedVMPool on platforms
-        other than x86-64 (this may be useful on 32-bit platforms, too).
-
-        Simplify ifdefs by dividing into thwo broad allocation strategies
-        (ENABLE_EXECUTABLE_ALLOCATOR_FIXED & ENABLE_EXECUTABLE_ALLOCATOR_DEMAND).
-
-        Rename constant used in the code to have names descriptive of their purpose,
-        rather than their specific value on a given platform.
-
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutableAllocator::reprotectRegion):
-        (JSC::ExecutableAllocator::cacheFlush):
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
-        (JSC::FixedVMPoolAllocator::free):
-        (JSC::ExecutablePool::systemAlloc):
-        * jit/ExecutableAllocatorPosix.cpp:
-        * jit/ExecutableAllocatorSymbian.cpp:
-        * jit/ExecutableAllocatorWin.cpp:
-        * wtf/Platform.h:
+        (JSC::JITThunks::JITThunks):
 
-2010-07-08  Xan Lopez  <xlopez@igalia.com>
+2011-02-24  Andras Becsi  <abecsi@webkit.org>
 
-        Reviewed by Gustavo Noronha.
+        Reviewed by Laszlo Gombos.
 
-        Silence a few noisy build rules.
+        [Qt] MinGW build fails to link
+        https://bugs.webkit.org/show_bug.cgi?id=55050
 
-        * GNUmakefile.am:
+        Prepend the libraries of subcomponents instead of appending them
+        to fix the library order according to the dependency of the libraries
 
-2010-07-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+        * JavaScriptCore.pri: rename addJavaScriptCore to prependJavaScriptCore
+        * jsc.pro: ditto
 
-        Unreviewed, rolling out r62765.
-        http://trac.webkit.org/changeset/62765
-        https://bugs.webkit.org/show_bug.cgi?id=41840
-
-        All jscore and layout tests crash on Qt bot (Requested by Ossy
-        on #webkit).
+2011-02-24  Eric Seidel  <eric@webkit.org>
 
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_PageHeap::initializeScavenger):
-        (WTF::TCMalloc_PageHeap::signalScavenger):
-        (WTF::TCMalloc_PageHeap::scavengerThread):
-
-2010-07-08  Andreas Kling  <andreas.kling@nokia.com>
+        Reviewed by Adam Barth.
 
-        Reviewed by Oliver Hunt.
+        Deque<T> should support inline capacity
+        https://bugs.webkit.org/show_bug.cgi?id=55032
 
-        Interpreter: Crash in op_load_varargs on 64-bit
-        https://bugs.webkit.org/show_bug.cgi?id=41795
+        The title says it all.  There are currently no places
+        which use this code yet, however it's been tested in conjunction
+        with code for bug 55005.
 
-        Added missing cast of argCount to int32_t in op_load_varargs.
+        This also adds an ASSERT that capacity is never 1.  If you were able
+        to set the capacity equal to 1, the Deque would just get confused
+        and happily append your item but still think it had size 0.
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
+        * wtf/Deque.h:
+        (WTF::DequeIterator::DequeIterator):
+        (WTF::DequeConstIterator::DequeConstIterator):
+        (WTF::DequeReverseIterator::DequeReverseIterator):
+        (WTF::DequeConstReverseIterator::DequeConstReverseIterator):
+        (WTF::::checkValidity):
+        (WTF::::checkIndexValidity):
+        (WTF::::invalidateIterators):
+        (WTF::::Deque):
+        (WTF::deleteAllValues):
+        (WTF::::operator):
+        (WTF::::destroyAll):
+        (WTF::::~Deque):
+        (WTF::::swap):
+        (WTF::::clear):
+        (WTF::::findIf):
+        (WTF::::expandCapacityIfNeeded):
+        (WTF::::expandCapacity):
+        (WTF::::takeFirst):
+        (WTF::::append):
+        (WTF::::prepend):
+        (WTF::::removeFirst):
+        (WTF::::remove):
+        (WTF::::addToIteratorsList):
+        (WTF::::removeFromIteratorsList):
+        (WTF::::DequeIteratorBase):
+        (WTF::::~DequeIteratorBase):
+        (WTF::::isEqual):
+        (WTF::::increment):
+        (WTF::::decrement):
+        (WTF::::after):
+        (WTF::::before):
+        * wtf/Vector.h:
 
-2010-07-08  Patrick Gansterer  <paroga@paroga.com>
+2011-02-22  Adam Barth  <abarth@webkit.org>
 
-        Reviewed by Geoffrey Garen.
+        Reviewed by Ojan Vafai. 
 
-        Make FastMalloc more portable.
-        https://bugs.webkit.org/show_bug.cgi?id=41790
+        Add missing files to JavaScriptCore.gypi 
+        https://bugs.webkit.org/show_bug.cgi?id=55020 
 
-        Use WTF::Mutex instead of pthread_mutex_t and
-        replace pthread_cond_t with WTF::ThreadCondition.
+        gypi files are supposed to list every file under the sun.  This patch 
+        adds some missing files and sorts the rest. 
 
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_PageHeap::initializeScavenger):
-        (WTF::TCMalloc_PageHeap::signalScavenger):
-        (WTF::TCMalloc_PageHeap::scavengerThread):
+        * JavaScriptCore.gypi: 
 
-2010-07-08  Patrick Gansterer  <paroga@paroga.com>
+2011-02-23  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Darin Adler.
 
-        Remove needless #include <fcntl.h> from TCSystemAlloc.cpp.
-        https://bugs.webkit.org/show_bug.cgi?id=41777
-
-        * wtf/TCSystemAlloc.cpp:
-
-2010-07-07  Darin Adler  <darin@apple.com>
-
-        Fixed build in configurations like PowerPC.
-
-        * runtime/RegExpConstructor.cpp: Added include of PassOwnPtr.h.
-        * runtime/RegExpObject.cpp: Ditto.
-        * wtf/SizeLimits.cpp: Changed compile time assertion to work
-        even on platforms where two bool members do not end up taking
-        the same size as one int member!
-
-2010-07-07  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Lazy mode of parser allows invalid syntax in object literals.
-        https://bugs.webkit.org/show_bug.cgi?id=41809
-
-        Make the parser itself validate getter and setter syntax rather
-        than offloading it to the AST builder.
-
-        * parser/ASTBuilder.h:
-        (JSC::ASTBuilder::createGetterOrSetterProperty):
-        * parser/JSParser.cpp:
-        (JSC::JSParser::parseProperty):
-
-2010-07-07  Dumitru Daniliuc  <dumi@chromium.org>
-
-        Reviewed by Adam Roben.
-
-        Revert r62689.
-        https://bugs.webkit.org/show_bug.cgi?id=41804
-
-        * runtime/Collector.cpp:
-        (JSC::Heap::freeBlocks):
-
-2010-07-07  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        Add reverseFind to Vector and deploy in HTML5 parser
-        https://bugs.webkit.org/show_bug.cgi?id=41778
-
-        This method seems generally useful.  I'm slightly surprised we don't
-        have it already.
-
-        * wtf/Vector.h:
-        (WTF::::reverseFind):
-
-2010-07-07  Darin Adler  <darin@apple.com>
-
-        Reviewed by Adam Barth.
-
-        Turn on adoptRef assertion for RefCounted
-        https://bugs.webkit.org/show_bug.cgi?id=41547
-
-        * wtf/CrossThreadRefCounted.h: Fixed include style. Includes of other
-        WTF headers should use "" includes; consistent in most WTF headers.
-        Added a call to relaxAdoptionRequirement.
-
-        * wtf/RefCounted.h: Fixed include style. Removed LOOSE_REF_COUNTED.
-        Added relaxAdoptionRequirement.
-
-2010-07-07  Anders Carlsson  <andersca@apple.com>
-
-        Try to fix the Windows build.
+        Refactored MarkedSpace to operate in terms of size classes
+        https://bugs.webkit.org/show_bug.cgi?id=55106
+        
+        SunSpider reports no change.
 
-        * runtime/Collector.cpp:
-        (JSC::Heap::freeBlocks):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedSpace::sizeClassFor):
+        (JSC::JSCell::MarkedSpace::allocate): Delegate allocation based on size
+        class. Since these functions are inline, the compiler can constant fold
+        them.
 
-2010-07-07  Darin Adler  <darin@apple.com>
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::cellSize):
+        (JSC::MarkedBlock::size): Factored out a cellSize() helper.
 
-        Reviewed by Adam Barth.
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::allocateFromSizeClass):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::SizeClass::SizeClass):
+        (JSC::MarkedSpace::SizeClass::reset): Changed to operate in terms of
+        abstract SizeClass objects, which are independent linked lists of blocks
+        of a certain size class, instead of a single m_heap object.
 
-        More OwnPtr work
-        https://bugs.webkit.org/show_bug.cgi?id=41727
+2011-02-23  Adam Barth  <abarth@webkit.org>
 
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObjectData::setPrivateProperty): Use adoptPtr.
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::JSCallbackObject::JSCallbackObject): Ditto.
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::CodeBlock): Ditto.
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::createRareDataIfNecessary): Ditto.
-        * parser/Nodes.cpp:
-        (JSC::ScopeNode::ScopeNode): Ditto.
-        * parser/ParserArena.cpp:
-        (JSC::ParserArena::ParserArena): Ditto.
-        * runtime/Arguments.h:
-        (JSC::Arguments::Arguments): Ditto.
-        * runtime/Executable.cpp:
-        (JSC::EvalExecutable::compile): Ditto.
-        (JSC::ProgramExecutable::compile): Ditto.
-        (JSC::FunctionExecutable::compileForCall): Ditto.
-        (JSC::FunctionExecutable::compileForConstruct): Ditto.
-        (JSC::FunctionExecutable::reparseExceptionInfo): Ditto.
-        (JSC::EvalExecutable::reparseExceptionInfo): Ditto.
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::sort): Ditto.
-        * runtime/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor): Ditto.
-        * runtime/RegExpObject.cpp:
-        (JSC::RegExpObject::RegExpObject): Ditto.
-        * runtime/SmallStrings.cpp:
-        (JSC::SmallStrings::createSingleCharacterString): Ditto.
-        (JSC::SmallStrings::singleCharacterStringRep): Ditto.
-
-        * wtf/unicode/icu/CollatorICU.cpp:
-        (WTF::Collator::userDefault): Use adoptPtr.
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::ByteCompiler::ByteCompiler): Ditto.
-        (JSC::Yarr::ByteCompiler::compile): Ditto.
-        (JSC::Yarr::ByteCompiler::regexBegin): Ditto.
-        (JSC::Yarr::byteCompileRegex): Ditto.
-        * yarr/RegexInterpreter.h:
-        (JSC::Yarr::BytecodePattern::BytecodePattern): Ditto.
+        Reviewed by James Robinson.
 
-2010-07-07  Darin Adler  <darin@apple.com>
+        [Chromium] Use WebKitClient for OSRandomSource instead of trying to talk to the file system in the sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=55093
 
-        Reviewed by Adam Barth.
+        Exclude OSRandomSource.cpp from the Chromium build.  This function is
+        implemented in WebKit/chromium/src instead.
 
-        Make clear set the pointer to 0 before deletion
-        https://bugs.webkit.org/show_bug.cgi?id=41727
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
 
-        * wtf/OwnArrayPtr.h: Changed code so we always set the pointer to its new
-        value before deleting the old one, including in the set function and the
-        clear function. This required changing safeDelete.
-        * wtf/OwnPtr.h: Ditto. Also removed some extra null checks.
-        * wtf/PassOwnPtr.h: Ditto.
+2011-02-23  Oliver Hunt  <oliver@apple.com>
 
-        * wtf/PassRefPtr.h: Changed code so we always set the pointer to its new
-        value before deref'ing the old one in the clear function. Also added a
-        leakRef function for NonNullPassRefPtr.
-        * wtf/RefPtr.h: Ditto.
+        Roll out r64156 as it introduces incorrect behaviour.
 
-        * wtf/gobject/GOwnPtr.h: More of the same.
-        * wtf/gobject/GRefPtr.h: Ditto.
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::setIndex):
 
-2010-07-07  Zoltan Herczeg  <zherczeg@webkit.org>
+2011-02-23  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Refactored string parsing inside the lexer
-        https://bugs.webkit.org/show_bug.cgi?id=41606
-
-        Does not use goto. Although the last sunspider
-        parse-only tests yields 1.044x speedup, I think the
-        patch can have a slight improvement at most.
-
-        * parser/Lexer.cpp:
-        (JSC::singleEscape):
-        (JSC::Lexer::parseString):
-        (JSC::Lexer::lex):
-        * parser/Lexer.h:
-
-2010-07-06  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Make it possible to have both the JIT and Interpreter available in a single build
-        https://bugs.webkit.org/show_bug.cgi?id=41722
-
-        Separate the concept of !ENABLE(JIT) and ENABLE(INTERPRETER) and make it possible
-        to have both JIT and INTERPRETER enabled at the same time.  This doesn't add
-        support for mix mode execution, but it does allow a single build to contain all
-        the code needed to use either the interpreter or the jit.
-
-        If both ENABLE(INTERPRETER) and ENABLE(JIT) are true then setting the environment
-        variable JSC_FORCE_INTERPRETER will force JSC to use the interpreter.
-
-        This patch basically consists of replacing !ENABLE(JIT) with ENABLE(INTERPRETER),
-        or converting #if ENABLE(JIT) ... #else ... into #if ENABLE(JIT) ... #endif
-        #if ENABLE(INTERPRETER), etc.  There are also a few functions that need to be
-        renamed to resolve return type ambiguity.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::~CodeBlock):
-        (JSC::CodeBlock::shrinkToFit):
-        * bytecode/CodeBlock.h:
-        * interpreter/CallFrame.h:
-        (JSC::ExecState::returnVPC):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::executeCall):
-        (JSC::Interpreter::executeConstruct):
-        (JSC::Interpreter::prepareForRepeatCall):
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::retrieveLastCaller):
-        * interpreter/Interpreter.h:
-        * runtime/ArrayPrototype.cpp:
-        (JSC::isNumericCompareFunction):
-        * runtime/Executable.cpp:
-        (JSC::EvalExecutable::generateJITCode):
-        (JSC::ProgramExecutable::generateJITCode):
-        (JSC::FunctionExecutable::generateJITCodeForCall):
-        (JSC::FunctionExecutable::generateJITCodeForConstruct):
-        (JSC::FunctionExecutable::reparseExceptionInfo):
-        (JSC::EvalExecutable::reparseExceptionInfo):
-        * runtime/JSFunction.cpp:
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * runtime/JSGlobalData.h:
-        (JSC::JSGlobalData::canUseJIT):
-        * wtf/Platform.h:
-
-2010-07-06  Darin Adler  <darin@apple.com>
-
-        Reviewed by Adam Barth.
-
-        Add adoptPtr and leakPtr functions for OwnPtr and PassOwnPtr
-        https://bugs.webkit.org/show_bug.cgi?id=41320
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary): Use assignment
-        instead of set since the result of reparseExceptionInfo is now a
-        PassOwnPtr.
-
-        * bytecode/CodeBlock.h: Change extractExceptionInfo to return a
-        PassOwnPtr instead of a raw pointer.
-
-        * runtime/Executable.cpp:
-        (JSC::FunctionExecutable::reparseExceptionInfo): Return a PassOwnPtr.
-        (JSC::EvalExecutable::reparseExceptionInfo): Ditto.
-        (JSC::ProgramExecutable::reparseExceptionInfo): Added. This was
-        in the header before, but it's better to not have it there to reduce
-        header dependencies. Return a PassOwnPtr.
-
-        * runtime/Executable.h: Made reparseExceptionInfo return a PassOwnPtr,
-        and put it in the private sections of classes other than the base class.
-
-        * wtf/MessageQueue.h:
-        (WTF::MessageQueue::append): Use leakPtr instead of release.
-        (WTF::MessageQueue::appendAndCheckEmpty): Ditto.
-        (WTF::MessageQueue::prepend): Ditto.
-
-        * wtf/OwnPtr.h: Tweaked formatting. Changed the release function to return
-        a PassOwnPtr rather than a raw pointer. Added a leakPtr function that
-        returns a raw pointer. Put the constructor that takes a raw pointer and
-        the set function into a section guarded by LOOSE_OWN_PTR. Adapted to the
-        new adoptPtr function from PassOwnPtr.h.
-
-        * wtf/PassOwnPtr.h: Tweaked formatting. Renamed the release function
-        to leakPtr. Added an adoptPtr function that creates a new PassOwnPtr.
-        Put the constructor and assignment operators that take a raw pointer
-        into a section guarded by LOOSE_PASS_OWN_PTR.
-
-2010-07-06  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler
-
-        Update comment in StringExtras.h to be more accurate.
-
-        * wtf/StringExtras.h:
+        Moved the "nextAtom" allocation pointer into MarkedBlock for better encapsulation
+        https://bugs.webkit.org/show_bug.cgi?id=55079
+        
+        SunSpider reports no change.
 
-2010-07-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset): Moved Zombie sweeping here, up from MarkedSpace,
+        since we want Heap to logically control MarkedSpace. MarkedSpace should
+        never choose to sweep itself.
 
-        Unreviewed, rolling out r62511.
-        http://trac.webkit.org/changeset/62511
-        https://bugs.webkit.org/show_bug.cgi?id=41686
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate): Updated for nextAtom becoming a
+        member of MarkedBlock. No need to reset nextAtom to firstAtom() when
+        we reach the end of a block, since there's now an explicit reset pass
+        during GC.
 
-        Breaks Linux/64bit compilation (Requested by xan_ on #webkit).
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::reset): Added the nextAtom data member, and reordered
+        some data members to improve cache locality.
 
-        * jit/ExecutableAllocator.cpp:
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
-        (JSC::FixedVMPoolAllocator::free):
-        (JSC::ExecutablePool::systemAlloc):
-        * jit/ExecutableAllocatorPosix.cpp:
-        (JSC::ExecutableAllocator::reprotectRegion):
-        (JSC::ExecutableAllocator::cacheFlush):
-        * jit/ExecutableAllocatorSymbian.cpp:
-        * jit/ExecutableAllocatorWin.cpp:
-        * wtf/Platform.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::CollectorHeap): Removed nextAtom, and added an
+        explicit reset pass.
 
-2010-07-05  Gavin Barraclough  <barraclough@apple.com>
+2011-02-23  James Robinson  <jamesr@chromium.org>
 
-        Reviewed by Sam Weinig.
+        Unreviewed, rolling out r79428.
+        http://trac.webkit.org/changeset/79428
+        https://bugs.webkit.org/show_bug.cgi?id=54714
 
-        https://bugs.webkit.org/show_bug.cgi?id=41641
+        Does not work in the Chromium sandbox
 
-        Update compile flags to allow use of ExecutableAllocatorFixedVMPool on platforms
-        other than x86-64 (this may be useful on 32-bit platforms, too).
+        * JavaScriptCore.exp:
 
-        Simplify ifdefs by dividing into thwo broad allocation strategies
-        (ENABLE_EXECUTABLE_ALLOCATOR_FIXED & ENABLE_EXECUTABLE_ALLOCATOR_DEMAND).
+2011-02-23  Adam Roben  <aroben@apple.com>
 
-        Rename constant used in the code to have names descriptive of their purpose,
-        rather than their specific value on a given platform.
+        Fix an off-by-one error in JSC::appendSourceToError
 
-        * jit/ExecutableAllocator.cpp:
-        (JSC::ExecutableAllocator::reprotectRegion):
-        (JSC::ExecutableAllocator::cacheFlush):
-        * jit/ExecutableAllocatorFixedVMPool.cpp:
-        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
-        (JSC::FixedVMPoolAllocator::free):
-        (JSC::ExecutablePool::systemAlloc):
-        * jit/ExecutableAllocatorPosix.cpp:
-        * jit/ExecutableAllocatorSymbian.cpp:
-        * jit/ExecutableAllocatorWin.cpp:
-        * wtf/Platform.h:
+        Looks like this bug has been around since the code was first added in r35245.
 
-2010-07-05  Steve Block  <steveblock@google.com>
+        Fixes <http://webkit.org/b/55052> <rdar://problem/9043512> Crash in JSC::appendSourceToError
+        when running fast/dom/objc-big-method-name.html on Windows with full page heap enabled
 
         Reviewed by Darin Adler.
 
-        ThreadingPthreads.cpp should use JNIUtility.h on Android, not outdated jni_utility.h
-        https://bugs.webkit.org/show_bug.cgi?id=41594
-
-        * wtf/ThreadingPthreads.cpp:
-
-2010-07-04  Mark Rowe  <mrowe@apple.com>
-
-        Build fix after r62456.
-
         * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute): Be slightly more consistent in using uint32_t to prevent
-        warnings about comparisons between signed and unsigned types, and attempts to call an overload
-        of std::min that doesn't exist.
-
-2010-07-02  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=41553
-        Make StringExtras.h versions of snprintf and vsnprintf match the unix versions.
-
-        - MSVC does not ensure the buffers are null terminated as the unix versions do.
-
-        * runtime/JSGlobalObjectFunctions.cpp: Cleanup includes.
-        * runtime/UString.cpp: Clean up includes.
-        (JSC::UString::from): Don't pass sizeof(buf) - 1, that is wrong.
-        * wtf/StringExtras.h:
-        (snprintf): Ensure null termination of buffer.
-        (vsnprintf): Ditto.
+        (JSC::appendSourceToError): When trimming whitespace off the end of the string, examine the
+        character at stop-1 rather than at stop. At this point in the code, stop represents the
+        index just past the end of the characters we care about, and can even be just past the end
+        of the entire data buffer.
 
-2010-07-03  Yong Li  <yoli@rim.com>
+2011-02-23  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Darin Adler.
-
-        Make Arguments::MaxArguments clamping work for numbers >= 0x80000000 in
-        the interpreter as well as the JIT.
-
-        https://bugs.webkit.org/show_bug.cgi?id=41351
-        rdar://problem/8142141
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute): Fix signed integer overflow problem
-        in op_load_varargs handling. 0xFFFFFFFF was read as -1.
-
-2010-06-26  Jeremy Orlow  <jorlow@chromium.org>
-
-        Reviewed by Dumitru Daniliuc.
-
-        Support for keys and in-memory storage for IndexedDB
-        https://bugs.webkit.org/show_bug.cgi?id=41252
-
-        Set the role to Private.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2010-07-02  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Move BOM handling out of the lexer and parser
-        https://bugs.webkit.org/show_bug.cgi?id=41539
-
-        Doing the BOM stripping in the lexer meant that we could
-        end up having to strip the BOMs from a source multiple times.
-        To deal with this we now require all strings provided by
-        a SourceProvider to already have had the BOMs stripped.
-        This also simplifies some of the lexer logic.
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::setCode):
-        (JSC::Lexer::sourceCode):
-        * parser/SourceProvider.h:
-        (JSC::SourceProvider::SourceProvider):
-        (JSC::UStringSourceProvider::create):
-        (JSC::UStringSourceProvider::getRange):
-        (JSC::UStringSourceProvider::UStringSourceProvider):
-        * wtf/text/StringImpl.h:
-        (WebCore::StringImpl::copyStringWithoutBOMs):
-
-2010-07-03  Patrick Gansterer  <paroga@paroga.com>
-
-        Reviewed by Kent Tamura.
-
-        [WINCE] Implement Unicode::isAlphanumeric and Unicode::isArabicChar.
-        https://bugs.webkit.org/show_bug.cgi?id=41411
-
-        * wtf/unicode/wince/UnicodeWince.cpp:
-        (WTF::Unicode::isAlphanumeric):
-        * wtf/unicode/wince/UnicodeWince.h:
-        (WTF::Unicode::isArabicChar):
-
-2010-07-03  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Kent Tamura.
-
-        [BREWMP] Change the CRASH() macro to print "WebKit CRASH" log.
-        https://bugs.webkit.org/show_bug.cgi?id=41524
-
-        Print "WebKit CRASH" before crashing.
-
-        * wtf/Assertions.h:
-
-2010-07-02  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 41565 - Repatching in ARMv7Assembler::repatchLoadPtrToLEA is broken
-
-        This method tried to repatch a LDR (T2) into an ADD (T3) - but it only
-        repatches the first instruction word.  The layout of the fields in the
-        second word is different, and also needs repatching.
-
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::repatchLoadPtrToLEA):
-
-2010-07-02  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Clamp the number of arguments supported by function.apply
-        https://bugs.webkit.org/show_bug.cgi?id=41351
-        <rdar://problem/8142141>
-
-        Add clamping logic to function.apply similar to that
-        enforced by firefox.  We have a smaller clamp than
-        firefox as our calling convention means that stack
-        usage is proportional to argument count -- the firefox
-        limit is larger than you could actually call.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * runtime/Arguments.h:
-        (JSC::Arguments::):
-
-2010-07-02  Chao-ying Fu  <fu@mips.com>
-
-        Reviewed by Oliver Hunt.
-
-        Re-enable JIT_OPTIMIZE_NATIVE_CALL on MIPS
-        https://bugs.webkit.org/show_bug.cgi?id=40179
-
-        Add the MIPS part to re-enable JIT_OPTIMIZE_NATIVE_CALL.
-
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTINativeCall):
-        * wtf/Platform.h:
-
-2010-07-02  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 41552 - Clean up ARMv7 vfp code generation
-        Emit separate opcode individually, remove magic numbers.
-
-        Also remove invalid assert from JSImmediate (number cells are not CELL_MASK aligned).
-
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMv7Assembler::):
-        (JSC::ARMv7Assembler::vadd_F64):
-        (JSC::ARMv7Assembler::vcmp_F64):
-        (JSC::ARMv7Assembler::vcvt_F64_S32):
-        (JSC::ARMv7Assembler::vcvtr_S32_F64):
-        (JSC::ARMv7Assembler::vdiv_F64):
-        (JSC::ARMv7Assembler::vldr):
-        (JSC::ARMv7Assembler::vmov_F64_0):
-        (JSC::ARMv7Assembler::vmov):
-        (JSC::ARMv7Assembler::vmrs):
-        (JSC::ARMv7Assembler::vmul_F64):
-        (JSC::ARMv7Assembler::vstr):
-        (JSC::ARMv7Assembler::vsub_F64):
-        (JSC::ARMv7Assembler::VFPOperand::VFPOperand):
-        (JSC::ARMv7Assembler::VFPOperand::bits1):
-        (JSC::ARMv7Assembler::VFPOperand::bits4):
-        (JSC::ARMv7Assembler::vcvtOp):
-        (JSC::ARMv7Assembler::ARMInstructionFormatter::vfpOp):
-        (JSC::ARMv7Assembler::ARMInstructionFormatter::vfpMemOp):
-        * assembler/MacroAssemblerARMv7.h:
-        (JSC::MacroAssemblerARMv7::branchDouble):
-        * runtime/JSImmediate.h:
-        (JSC::JSValue::isCell):
-
-2010-07-02  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r62410.
-        http://trac.webkit.org/changeset/62410
-        https://bugs.webkit.org/show_bug.cgi?id=41549
-
-        accursed last minute changes (Requested by olliej on #webkit).
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::setCode):
-        (JSC::Lexer::copyCodeWithoutBOMs):
-        (JSC::Lexer::sourceCode):
-        * parser/SourceProvider.h:
-        (JSC::):
-        (JSC::SourceProvider::SourceProvider):
-        (JSC::SourceProvider::hasBOMs):
-        (JSC::UStringSourceProvider::create):
-        (JSC::UStringSourceProvider::getRange):
-        (JSC::UStringSourceProvider::UStringSourceProvider):
-        * wtf/text/StringImpl.h:
-
-2010-07-02  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=41548
-        Use snprintf instead of sprintf everywhere in JavaScriptCore
-
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::encode):
-        (JSC::globalFuncEscape):
-        * runtime/UString.cpp:
-        (JSC::UString::from):
-
-2010-07-02  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Move BOM handling out of the lexer and parser
-        https://bugs.webkit.org/show_bug.cgi?id=41539
-
-        Doing the BOM stripping in the lexer meant that we could
-        end up having to strip the BOMs from a source multiple times.
-        To deal with this we now require all strings provided by
-        a SourceProvider to already have had the BOMs stripped.
-        This also simplifies some of the lexer logic.
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::setCode):
-        (JSC::Lexer::sourceCode):
-        * parser/SourceProvider.h:
-        (JSC::SourceProvider::SourceProvider):
-        (JSC::UStringSourceProvider::create):
-        (JSC::UStringSourceProvider::getRange):
-        (JSC::UStringSourceProvider::UStringSourceProvider):
-        * wtf/text/StringImpl.h:
-        (WebCore::StringImpl::copyStringWithoutBOMs):
-
-2010-07-02  Renata Hodovan  <reni@inf.u-szeged.hu>
-
-        Reviewed by Oliver Hunt.
         
-        [ Updated after rollout. ]
-
-        Merged RegExp constructor and RegExp::create methods.
-        Both functions are called with three parameters and check whether 
-        flags (the third param) is given or not.
-        Avoid extra hash lookups in RegExpCache::create by passing a pre-computed
-        iterator parameter.
-        https://bugs.webkit.org/show_bug.cgi?id=41055
-
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        * runtime/RegExp.h:
-        * runtime/RegExpCache.cpp:
-        (JSC::RegExpCache::lookupOrCreate):
-        (JSC::RegExpCache::create):
-        * runtime/RegExpCache.h:
-
-2010-07-02  Martin Robinson  <mrobinson@igalia.com>
-
-        Unreviewed. Build fix for GTK+.
-
-        Build Lexer.lut.h with the rest of the .lut.h files. Later these should
-        all probably be moved to DerivedSources.
-
-        * GNUmakefile.am:
-
-2010-06-23  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Gustavo Noronha Silva.
-
-        [GTK] Separate DerivedSources per-project
-        https://bugs.webkit.org/show_bug.cgi?id=41109
-
-        Generate JavaScriptCore derived sources in <builddir>/DerivedSources/JavaScriptCore.
-
-        * GNUmakefile.am:
-
-2010-07-02  Peter Varga  <pvarga@inf.u-szeged.hu>
-
-        Reviewed by Oliver Hunt.
-
-        The alternativeFrameLocation value is wrong in the emitDisjunction function in
-        case of PatternTerm::TypeParentheticalAssertion. This value needs to be
-        computed from term.frameLocation instead of term.inputPosition. This mistake caused glibc
-        memory corruption in some cases.
-        Layout test added for checking of TypeParentheticalAssertion case.
-        https://bugs.webkit.org/show_bug.cgi?id=41458
-
-        * yarr/RegexInterpreter.cpp:
-        (JSC::Yarr::ByteCompiler::emitDisjunction):
-
-2010-07-01  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Add a FixedArray template to encapsulate fixed length arrays
-        https://bugs.webkit.org/show_bug.cgi?id=41506
-
-        This new type is used in place of fixed length C arrays so
-        that debug builds can guard against attempts to go beyond
-        the end of the array.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * bytecode/Opcode.cpp:
-        (JSC::OpcodeStats::~OpcodeStats):
-        * pcre/pcre_compile.cpp:
-        (calculateCompiledPatternLength):
-        * runtime/Collector.cpp:
-        (JSC::Heap::allocateBlock):
-        (JSC::Heap::allocate):
-        * runtime/Collector.h:
-        (JSC::CollectorBitmap::clearAll):
-        * runtime/CollectorHeapIterator.h:
-        (JSC::CollectorHeapIterator::operator*):
-        * runtime/DateInstanceCache.h:
-        * runtime/JSString.cpp:
-        (JSC::JSString::replaceCharacter):
-        * runtime/JSString.h:
-        (JSC::RopeBuilder::JSStringFinalizerStruct::):
-        * runtime/NumericStrings.h:
-        * runtime/RegExpCache.h:
-        * runtime/SmallStrings.h:
-        (JSC::SmallStrings::singleCharacterStrings):
-        * wtf/AVLTree.h:
-        * wtf/FixedArray.h: Added.
-        (WTF::FixedArray::operator[]):
-        (WTF::FixedArray::data):
-
-2010-07-01  Zoltan Herczeg  <zherczeg@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Improve the main lexer switch by mapping input characters to their type
-        https://bugs.webkit.org/show_bug.cgi?id=41459
-
-        Sunsipder: no change (from 532.9ms to 531.5ms)
-        SunSpider --parse-only: 1.025x as fast (from 33.1ms to 32.3ms)
-
-        * parser/Lexer.cpp:
-        (JSC::):
-        (JSC::Lexer::lex):
-
-2010-07-01  Sam Weinig  <sam@webkit.org>
-
-        Rubber-stamped by Ander Carlsson.
-
-        Define HAVE_HOSTED_CORE_ANIMATION on Snow Leopard.
-
-        * wtf/Platform.h:
+        Rolled back in r79367 with SnowLeopard Release bot crash fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=54999
+        
+        The crash was caused by failure to update the "nextBlock" pointer when
+        removing a block from the list while shrinking. The fix is to update the
+        "nextBlock" pointer.
+        
+        This crash was very rare because it only happened in cases where the very
+        first block in the heap contained no marked cells.
 
-2010-07-01  Gavin Barraclough  <barraclough@apple.com>
+2011-02-23  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Gavin Barraclough.
 
-        Bug 41490 - Add missing operations to MacroAssemblerARMv7
-        Also, make single, double, quad register numbers in ARMv7Assembler distinct & strongly typed.
+        Include frame numbers in backtraces.
+        https://bugs.webkit.org/show_bug.cgi?id=55060
 
-        * assembler/ARMv7Assembler.h:
-        (JSC::ARMRegisters::):
-        (JSC::ARMRegisters::asSingle):
-        (JSC::ARMRegisters::asDouble):
-        (JSC::VFPImmediate::VFPImmediate):
-        (JSC::VFPImmediate::isValid):
-        (JSC::VFPImmediate::value):
-        (JSC::ARMv7Assembler::singleRegisterMask):
-        (JSC::ARMv7Assembler::doubleRegisterMask):
-        (JSC::ARMv7Assembler::):
-        (JSC::ARMv7Assembler::add_S):
-        (JSC::ARMv7Assembler::neg):
-        (JSC::ARMv7Assembler::orr_S):
-        (JSC::ARMv7Assembler::sub):
-        (JSC::ARMv7Assembler::sub_S):
-        (JSC::ARMv7Assembler::vadd_F64):
-        (JSC::ARMv7Assembler::vcmp_F64):
-        (JSC::ARMv7Assembler::vcvt_F64_S32):
-        (JSC::ARMv7Assembler::vcvtr_S32_F64):
-        (JSC::ARMv7Assembler::vdiv_F64):
-        (JSC::ARMv7Assembler::vldr):
-        (JSC::ARMv7Assembler::vmov_F64_0):
-        (JSC::ARMv7Assembler::vmov):
-        (JSC::ARMv7Assembler::vmul_F64):
-        (JSC::ARMv7Assembler::vstr):
-        (JSC::ARMv7Assembler::vsub_F64):
-        (JSC::ARMv7Assembler::vcvt):
-        (JSC::ARMv7Assembler::vmem):
-        * assembler/AbstractMacroAssembler.h:
-        * assembler/MacroAssemblerARM.h:
-        * assembler/MacroAssemblerARMv7.h:
-        (JSC::MacroAssemblerARMv7::fpTempRegisterAsSingle):
-        (JSC::MacroAssemblerARMv7::neg32):
-        (JSC::MacroAssemblerARMv7::loadDouble):
-        (JSC::MacroAssemblerARMv7::divDouble):
-        (JSC::MacroAssemblerARMv7::convertInt32ToDouble):
-        (JSC::MacroAssemblerARMv7::branchConvertDoubleToInt32):
-        (JSC::MacroAssemblerARMv7::zeroDouble):
-        (JSC::MacroAssemblerARMv7::branchOr32):
-        (JSC::MacroAssemblerARMv7::set32):
-        (JSC::MacroAssemblerARMv7::set8):
-        * assembler/MacroAssemblerMIPS.h:
-        * assembler/MacroAssemblerX86Common.h:
+        * wtf/Assertions.cpp:
 
-2010-07-01  Oliver Hunt  <oliver@apple.com>
+2011-02-23  Xan Lopez  <xlopez@igalia.com>
 
-        Reviewed by Geoff Garen.
+        Reviewed by Gavin Barraclough.
 
-        Improve reentrancy logic in polymorphic cache stubs
-        <https://bugs.webkit.org/show_bug.cgi?id=41482>
-        <rdar://problem/8094380>
+        latest jsc for armv7 crashes in sunspider tests
+        https://bugs.webkit.org/show_bug.cgi?id=54667
 
-        Make the polymorphic cache stubs handle reentrancy
-        better.
+        Update JIT offset values in ARMv7 after r78732. Fixes crashes in
+        SunSpider and JavaScript tests.
 
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        (JSC::getPolymorphicAccessStructureListSlot):
+        * jit/JIT.h: update values.
 
-2010-07-01  Antti Koivisto  <koivisto@iki.fi>
+2011-02-23  Sheriff Bot  <webkit.review.bot@gmail.com>
 
-        Revert accidental commit.
+        Unreviewed, rolling out r79418.
+        http://trac.webkit.org/changeset/79418
+        https://bugs.webkit.org/show_bug.cgi?id=55043
 
-        * runtime/Collector.cpp:
-        (JSC::Heap::allocateBlock):
+        "breaks shlib linux build" (Requested by morrita on #webkit).
 
-2010-06-30  Darin Adler  <darin@apple.com>
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
 
-        Reviewed by Adam Barth.
+2011-02-23  Patrick Gansterer  <paroga@webkit.org>
 
-        Add assertion, off by default, for when you forget to do adoptRef
-        https://bugs.webkit.org/show_bug.cgi?id=41422
+        Reviewed by Alexey Proskuryakov.
 
-        * wtf/PassRefPtr.h: Tweaked formatting. Added a new adopted
-        function, called on the pointer by adoptRef, with an empty inline
-        default version, meant to be overloaded. Unified the inlining
-        with a macro named REF_DEREF_INLINE to make it clearer what's
-        going on in the refIfNotNull/derefIfNotNull functions. Renamed
-        releaseRef to leakRef, but left the old name in for compatibility
-        for now.
+        Use DEFINE_STATIC_LOCAL for ignoreSetMutex in Structure.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=54831
 
-        * wtf/RefCounted.h: Added code to require adoption and assert if
-        you don't call adoptRef. For now, it is turned off because of the
-        LOOSE_REF_COUNTED define in this header. Later we can turn it on
-        once we get everything working without asserting.
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/Structure.cpp:
+        (JSC::ignoreSetMutex):
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::initializeThreading):
+        * runtime/Structure.h:
 
-2010-06-29  Michael Saboff  <msaboff@apple.com>
+2011-02-23  Patrick Gansterer  <paroga@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Bug 41238 - RegExp performance slow on Dromaeo benchmark
-
-        Other javascript engines appear to cache prior results of regular 
-        expression operations.
-
-        Suggest adding some sort of caching mechanism to regular expression 
-        processing.
-
-        Added a single entry cache of match() results to RegExp class.
-
-        Also added performance improvements to UString == operator.
-        First check the impls for equality.  Then get the length of
-        each of the non-null impls.  Next check the sizes for equality.
-        Then check the data for the case of different impls that point 
-        to the same data (most likely due to substrings from the beginning of
-        another string).  Lastly we check the underlying data for equality.
-
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::match):
-        * runtime/RegExp.h:
-        * runtime/UString.h:
-        (JSC::operator==):
-
-2010-06-29  Nathan Lawrence  <nlawrence@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        WTF::HashSet iterators are quasi-mutable.  Changing the value through
-        dereferencing an iterator will not change the behavior of methods like
-        contains or find, but will change the behavior of iterating.
-
-        * wtf/HashSet.h:
-        (WTF::::begin):
-        (WTF::::end):
-        (WTF::::find):
-        (WTF::::remove):
-        * wtf/HashTable.h:
-
-2010-06-29  Martin Robinson  <mrobinson@igalia.com>
-
-        Reviewed by Xan Lopez.
-
-        [GTK] Clean up the source lists in the GNUMakefile.am files
-        https://bugs.webkit.org/show_bug.cgi?id=41229
-
-        Clean up the GNUMakefile.am a little bit. Alphabetize and conglomerate
-        the source lists.
-
-        * GNUmakefile.am:
-
-2010-06-29  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Fix QtScript build after QScriptValuePrivate ctor changes
-        https://bugs.webkit.org/show_bug.cgi?id=41307
-
-        * qt/api/qscriptvalue_p.h:
-        (QScriptValuePrivate::prototype):
-        * qt/benchmarks/qscriptengine/qscriptengine.pro:
-
-2010-06-28  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] QScriptEngine API should contain a newArray function
-        https://bugs.webkit.org/show_bug.cgi?id=39115
-
-        * qt/api/qscriptengine.cpp:
-        (QScriptEngine::newArray):
-        * qt/api/qscriptengine.h:
-        * qt/api/qscriptengine_p.cpp:
-        (QScriptEnginePrivate::newArray):
-        * qt/api/qscriptengine_p.h:
-        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
-        (tst_QScriptEngine::newArray):
-
-2010-06-28  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        Install jsc as jsc-X where X is the major API version to allow
-        parallel installation of both GTK+ 2.x and 3.x versions.
+        Rename PLATFORM(CF) to USE(CF)
+        https://bugs.webkit.org/show_bug.cgi?id=53540
 
-        * GNUmakefile.am:
-
-2010-06-28  John Gregg  <johnnyg@google.com>
-
-        Reviewed by Kent Tamura.
-
-        add ENABLE_DIRECTORY_UPLOAD build support
-        https://bugs.webkit.org/show_bug.cgi?id=41100
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2010-06-28  Xan Lopez  <xlopez@igalia.com>
-
-        Revert to build jsc, since the tests expect this.
-
-        * GNUmakefile.am:
-
-2010-06-28  Zoltan Herczeg  <zherczeg@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Only one character lookahead should be enough for the lexer
-        https://bugs.webkit.org/show_bug.cgi?id=41213
-
-        The lexer had 4 character lookahead before, which required
-        a complex shifting mechanism. This can be improved by using
-        only one character lookahead for most decisions, and a
-        peek() function as a fallback when it is absolutely necessary.
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::currentCharacter):
-        (JSC::Lexer::currentOffset):
-        (JSC::Lexer::setCode):
-        (JSC::Lexer::shift):
-        (JSC::Lexer::peek):
-        (JSC::Lexer::getUnicodeCharacter):
-        (JSC::Lexer::shiftLineTerminator):
-        (JSC::Lexer::lastTokenWasRestrKeyword):
-        (JSC::Lexer::lex):
-        (JSC::Lexer::scanRegExp):
-        (JSC::Lexer::skipRegExp):
-        * parser/Lexer.h:
-
-2010-06-28  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
-
-        Unreviewed build fix.
-
-        [EFL] Build fix for latest version of Ecore library.
-        Ecore recently changed return type of callbacks from int to Eina_Bool.
-
-        * wtf/efl/MainThreadEfl.cpp:
-        (WTF::timeoutFired): Return Eina_Bool instead of int.
-
-2010-06-28  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] QScriptValue should have API for accessing object properties
-        https://bugs.webkit.org/show_bug.cgi?id=40903
-
-        Make possible to access properties inside QScriptValues. While this
-        still doesn't support the ResolveLocal parameter, it is already useful
-        for testing the API.
-
-        The tests from upstream QtScript weren't imported since most of them
-        depend on the setProperty() function as well. A simple test was created.
-
-        * qt/api/qscriptvalue.cpp:
-        (QScriptValue::property):
-        * qt/api/qscriptvalue.h:
-        (QScriptValue::):
-        * qt/api/qscriptvalue_p.h:
-        (QScriptValuePrivate::property):
-        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
-        (tst_QScriptValue::propertySimple):
-        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
-
-2010-06-28  Xan Lopez  <xlopez@igalia.com>
-
-        Reviewed by Gustavo Noronha.
-
-        [GTK] Add support for GTK+3
-        https://bugs.webkit.org/show_bug.cgi?id=41253
-
-        Suffix jsc with the API version of the library, so that
-        libwebkitgtk 1.x and 3.x can install jsc.
-
-        * GNUmakefile.am:
-
-2010-06-27  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Kent Tamura.
-
-        [BREWMP] Turn ENABLE(SINGLE_THREADED) on.
-        https://bugs.webkit.org/show_bug.cgi?id=41135
-
-        Brew MP does not support preemptive multi-threading.
-        Disable threading for Brew MP.
-
-        * wtf/Platform.h:
-
-2010-06-26  Tony Gentilcore  <tonyg@chromium.org>
-
-        Reviewed by Dimitri Glazkov.
-
-        Add an ENABLE_WEB_TIMING option for enabling Web Timing support.
-        https://bugs.webkit.org/show_bug.cgi?id=38924
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2010-06-25  Nathan Lawrence  <nlawrence@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        We assume in testapi.c that the value aHeapRef refers to will not be
-        moved.  When we have movable objects, this will not be the case.
-
-        * API/tests/testapi.c:
-        (main):
-
-2010-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r61924.
-        http://trac.webkit.org/changeset/61924
-        https://bugs.webkit.org/show_bug.cgi?id=41240
-
-        It was rolled out, but cq+ wasn't removed (Requested by Ossy_
-        on #webkit).
-
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::create):
-        * runtime/RegExp.h:
-        * runtime/RegExpCache.cpp:
-        (JSC::RegExpCache::lookupOrCreate):
-        (JSC::RegExpCache::create):
-        * runtime/RegExpCache.h:
-
-2010-06-25  Renata Hodovan  <reni@inf.u-szeged.hu>
-
-        Reviewed by Geoffrey Garen.
-
-        Merge RegExp constructor and RegExp::create methods into one.
-        Both of function are called with tree parameters and check whether 
-        flags (the third param) is given or not.
-        Simplify hash lookups in RegExpCache::create with giving them an extra 
-        iterator parameter.
-        https://bugs.webkit.org/show_bug.cgi?id=41055
-
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        * runtime/RegExp.h:
-        * runtime/RegExpCache.cpp:
-        (JSC::RegExpCache::lookupOrCreate):
-        (JSC::RegExpCache::create):
-        * runtime/RegExpCache.h:
-
-2010-06-25  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Introduce QtScript benchmarks.
-
-        The QtScript performance should be tested regularly. The patch introduces
-        micro benchmarks for existing API.
-
-        [Qt] Performance of the QtScript API is not tested.
-        https://bugs.webkit.org/show_bug.cgi?id=40911
-
-        * qt/benchmarks/benchmarks.pri: Copied from JavaScriptCore/qt/tests/tests.pri.
-        * qt/benchmarks/benchmarks.pro: Added.
-        * qt/benchmarks/qscriptengine/qscriptengine.pro: Added.
-        * qt/benchmarks/qscriptengine/tst_qscriptengine.cpp: Added.
-        (tst_QScriptEngine::checkSyntax_data):
-        (tst_QScriptEngine::checkSyntax):
-        (tst_QScriptEngine::constructor):
-        (tst_QScriptEngine::evaluateString_data):
-        (tst_QScriptEngine::evaluateString):
-        (tst_QScriptEngine::evaluateProgram_data):
-        (tst_QScriptEngine::evaluateProgram):
-        (tst_QScriptEngine::newObject):
-        (tst_QScriptEngine::nullValue):
-        (tst_QScriptEngine::undefinedValue):
-        (tst_QScriptEngine::globalObject):
-        (tst_QScriptEngine::toStringHandle):
-        * qt/benchmarks/qscriptvalue/qscriptvalue.pro: Added.
-        * qt/benchmarks/qscriptvalue/tst_qscriptvalue.cpp: Added.
-        (tst_QScriptValue::tst_QScriptValue):
-        (tst_QScriptValue::~tst_QScriptValue):
-        (tst_QScriptValue::values_data):
-        (tst_QScriptValue::ctorBool):
-        (tst_QScriptValue::ctorReal):
-        (tst_QScriptValue::ctorNumber):
-        (tst_QScriptValue::ctorQString):
-        (tst_QScriptValue::ctorCString):
-        (tst_QScriptValue::ctorSpecial):
-        (tst_QScriptValue::ctorQScriptValue):
-        (tst_QScriptValue::isValid_data):
-        (tst_QScriptValue::isValid):
-        (tst_QScriptValue::isBool_data):
-        (tst_QScriptValue::isBool):
-        (tst_QScriptValue::isNumber_data):
-        (tst_QScriptValue::isNumber):
-        (tst_QScriptValue::isFunction_data):
-        (tst_QScriptValue::isFunction):
-        (tst_QScriptValue::isNull_data):
-        (tst_QScriptValue::isNull):
-        (tst_QScriptValue::isString_data):
-        (tst_QScriptValue::isString):
-        (tst_QScriptValue::isUndefined_data):
-        (tst_QScriptValue::isUndefined):
-        (tst_QScriptValue::isObject_data):
-        (tst_QScriptValue::isObject):
-        (tst_QScriptValue::isError_data):
-        (tst_QScriptValue::isError):
-        (tst_QScriptValue::toString_data):
-        (tst_QScriptValue::toString):
-        (tst_QScriptValue::toNumber_data):
-        (tst_QScriptValue::toNumber):
-        (tst_QScriptValue::toBool_data):
-        (tst_QScriptValue::toBool):
-        (tst_QScriptValue::toInteger_data):
-        (tst_QScriptValue::toInteger):
-        (tst_QScriptValue::toInt32_data):
-        (tst_QScriptValue::toInt32):
-        (tst_QScriptValue::toUInt32_data):
-        (tst_QScriptValue::toUInt32):
-        (tst_QScriptValue::toUInt16_data):
-        (tst_QScriptValue::toUInt16):
-        (tst_QScriptValue::toObject_data):
-        (tst_QScriptValue::toObject):
-        (tst_QScriptValue::equals_data):
-        (tst_QScriptValue::equals):
-        (tst_QScriptValue::strictlyEquals_data):
-        (tst_QScriptValue::strictlyEquals):
-        (tst_QScriptValue::instanceOf_data):
-        (tst_QScriptValue::instanceOf):
-
-2010-06-25  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Remove old js parser
-        https://bugs.webkit.org/show_bug.cgi?id=41222
-
-        Remove the old yacc parser, this also solves the tiger problem.  Which
-        was a conflict between yacc generated token values and those in the
-        custom parser
-
-        * Android.mk:
-        * CMakeLists.txt:
-        * DerivedSources.make:
-        * DerivedSources.pro:
-        * GNUmakefile.am:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * parser/Grammar.y: Removed.
-        * parser/JSParser.cpp:
-        * parser/JSParser.h:
-        * parser/Lexer.cpp:
-        * parser/NodeConstructors.h:
-        (JSC::Node::Node):
-        * parser/Parser.cpp:
-        (JSC::Parser::parse):
+        * runtime/DatePrototype.cpp:
+        * runtime/GCActivityCallbackCF.cpp:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * wtf/CurrentTime.cpp:
         * wtf/Platform.h:
+        * wtf/text/AtomicString.h:
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::computeHash):
+        * wtf/text/WTFString.h:
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault):
 
-2010-06-25  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        New QtScript API; setPrototype() and prototype().
-
-        This patch implements QScriptValue's prototype accessors.
-
-        [Qt] QScriptValue should have accessors to a prototype.
-        https://bugs.webkit.org/show_bug.cgi?id=39356
-
-        * qt/api/qscriptvalue.cpp:
-        (QScriptValue::prototype):
-        (QScriptValue::setPrototype):
-        * qt/api/qscriptvalue.h:
-        * qt/api/qscriptvalue_p.h:
-        (QScriptValuePrivate::prototype):
-        (QScriptValuePrivate::setPrototype):
-        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
-        (tst_QScriptValue::getSetPrototype):
-        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
-
-2010-06-25  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [CMake] Add option to enable JIT.
-        JIT is disabled by default, but now it's possible to enable it through
-        an option to CMake: -DENABLE_JIT will enable it.
-        https://bugs.webkit.org/show_bug.cgi?id=40936
-
-        * CMakeLists.txt: Add missing files and re-sort.
-
-2010-06-25  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
-
-        Reviewed by Gustavo Noronha Silva.
-
-        [CMake] Remove unused variable in EFL build system. It was previously
-        being used to set the flags of each port but it was superseded by
-        other flags.
-        https://bugs.webkit.org/show_bug.cgi?id=40931
-
-        * jsc/CMakeLists.txt:
-
-2010-06-25  Nathan Lawrence  <nlawrence@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Aligning AssemblerBuffer to 128 bytes gives a 0.4% speedup on
-        sunspider.
-
-        * assembler/AssemblerBuffer.h:
-        (JSC::AssemblerBuffer::AssemblerBuffer):
-
-2010-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r61842.
-        http://trac.webkit.org/changeset/61842
-        https://bugs.webkit.org/show_bug.cgi?id=41208
-
-        It broke Windows build (Requested by Ossy_ on #webkit).
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * wtf/OwnPtrCommon.h:
-        * wtf/brew/OwnPtrBrew.h: Removed.
-        * wtf/win/OwnPtrWin.h: Removed.
-
-2010-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+2011-02-23  Fumitoshi Ukai  <ukai@chromium.org>
 
-        Unreviewed, rolling out r61833.
-        http://trac.webkit.org/changeset/61833
-        https://bugs.webkit.org/show_bug.cgi?id=41205
+        Unreviewed build fix for Windows.
 
-        It broke Leopard and GTK (Requested by Ossy_ on #webkit).
+        WebSocket uses insecure random numbers
+        https://bugs.webkit.org/show_bug.cgi?id=54714
 
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::create):
-        * runtime/RegExp.h:
-        * runtime/RegExpCache.cpp:
-        (JSC::RegExpCache::lookupOrCreate):
-        (JSC::RegExpCache::create):
-        * runtime/RegExpCache.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export WTF::cryptographicallyRandomNumber()
 
-2010-06-25  Kwang Yul Seo  <skyul@company100.net>
+2011-02-23  Fumitoshi Ukai  <ukai@chromium.org>
 
         Reviewed by Adam Barth.
 
-        Change OwnPtrCommon to include platform-specific headers
-        https://bugs.webkit.org/show_bug.cgi?id=40279
-
-        Adding new type to OwnPtrCommon needlessly causes all ports to do full rebuilds.
-        Change OwnPtrCommon to include platform-specific headers to avoid all ports rebuilds.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * wtf/OwnPtrCommon.h:
-        * wtf/brew/OwnPtrBrew.h: Added.
-        * wtf/win/OwnPtrWin.h: Added.
-
-2010-06-25  Patrick Gansterer  <paroga@paroga.com>
-
-        Reviewed by Darin Adler.
-
-        Add the possibility for a head and footer section to create_jit_stubs.
-        https://bugs.webkit.org/show_bug.cgi?id=36050
-
-        * create_jit_stubs:
-
-2010-06-24  Renata Hodovan  <reni@inf.u-szeged.hu>
-
-        Reviewed by Geoffrey Garen.
-
-        Merge RegExp constructor and RegExp::create methods into one.
-        Both of function are called with tree parameters and check whether 
-        flags (the third param) is given or not.
-        Simplify hash lookups in RegExpCache::create with giving them an extra 
-        iterator parameter.
-        https://bugs.webkit.org/show_bug.cgi?id=41055
-
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        * runtime/RegExp.h:
-        * runtime/RegExpCache.cpp:
-        (JSC::RegExpCache::lookupOrCreate):
-        (JSC::RegExpCache::create):
-        * runtime/RegExpCache.h:
-
-2010-06-24  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Incorrect use of '+ 4' and 0 instead of tag and payload offsets in JSValue32_64
-        https://bugs.webkit.org/show_bug.cgi?id=41193
-
-        I noticed a use of '+ 4' in some of the 32_64 code paths and realised there
-        were a few places where endianness was being hardcoded.  This patch fixes
-        the errors i could find through code inspection.
-
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::emit_op_resolve_global):
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::emit_op_get_by_val):
-        (JSC::JIT::emit_op_put_by_val):
-        (JSC::JIT::compileGetDirectOffset):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::patchGetByIdSelf):
-        (JSC::JIT::patchPutByIdReplace):
-
-2010-06-24  Oliver Hunt  <oliver@apple.com>
-
-        Build fix
-
-        Temporarily get the tiger bot working again by disabling the
-        new JS parser.  GCC on tiger is miscompiling the parser and
-        I don't have access to a tiger machine right now.
-
-        * wtf/Platform.h:
+        WebSocket uses insecure random numbers
+        https://bugs.webkit.org/show_bug.cgi?id=54714
 
- 2010-06-21  Nathan Lawrence  <nlawrence@apple.com>
-
-         Reviewed by Geoff Garen.
-
-         https://bugs.webkit.org/show_bug.cgi?id=40128
-         Fixed broken debug functionality.
-
-         * interpreter/Interpreter.cpp:
-         (JSC::Interpreter::dumpRegisters):
-             Fixed to work with updated call frame.
-         * runtime/JSImmediate.h:
-         (JSC::JSValue::isCell):
-             Added assert for aligned cell.
-         * runtime/JSValue.cpp:
-         (JSC::JSValue::description):
-             Fixed to work with current JSValue implementation.
-         * runtime/JSZombie.cpp:
-         (JSC::JSZombie::leakedZombieStructure):
-             JSombies compile again.
-
-2010-06-24  Leandro Pereira  <leandro@profusion.mobi>
-
-        Unreviewed build fix.
-
-        * CMakeLists.txt: Add JSParser.cpp.
-
-2010-06-24  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
+        * JavaScriptCore.exp: Export WTF::cryptographicallyRandomNumber()
 
-        Single character string replacement may replace too many characters
-        https://bugs.webkit.org/show_bug.cgi?id=41138
-        <rdar://problem/8097496>
+2011-02-22  Adam Barth  <abarth@webkit.org>
 
-        Simple fix to stop the rope path of single character replacement
-        once the first replacement occurs.
-
-        * runtime/JSString.cpp:
-        (JSC::JSString::replaceCharacter):
-
-2010-06-24  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        Fix the length of instruction stream controlled by constant pool
-        https://bugs.webkit.org/show_bug.cgi?id=40293
-
-        The initial/maximum length of instruction stream (m_maxDistance) should
-        be set when the first constant arrives to the constant pool. Otherwise
-        the constant pool could be placed into an uninterrupted sequence.
-
-        * assembler/AssemblerBufferWithConstantPool.h:
-        (JSC::):
-
-2010-06-24  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        We assume bytecodeOffset will always return a value > 1,
-        so we adjust the failure case to return 1 instead of 0.
-
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::bytecodeOffset):
+        Reviewed by Ojan Vafai.
 
-2010-06-23  Oliver Hunt  <oliver@apple.com>
+        Add missing files to JavaScriptCore.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=55020
 
-        Reviewed by Gavin Barraclough.
+        gypi files are supposed to list every file under the sun.  This patch
+        adds some missing files and sorts the rest.
 
-        Custom-written JavaScript parser
-        https://bugs.webkit.org/show_bug.cgi?id=34019
+        * JavaScriptCore.gypi:
 
-        Implement a recursive descent parser similar to that used by V8 and
-        SpiderMonkey.  Greater than 2x improvement in SunSpider parsing tests.
+2011-02-22  Sheriff Bot  <webkit.review.bot@gmail.com>
 
-        The parser consists of a JSParser class that uses a TreeBuilder to actually
-        build the AST.  There are currently two builders -- the ASTBuilder and
-        SyntaxChecker which separate the job of building an AST for code generation
-        and simply checking syntactic correctness.
+        Unreviewed, rolling out r79367.
+        http://trac.webkit.org/changeset/79367
+        https://bugs.webkit.org/show_bug.cgi?id=55012
 
-        There's still some less than ideal code remaining in the parser to allow
-        us to retain the existing lexing code with minimal changes.  We'll tidy
-        this up at a later date.
+        all layout tests are crashing on Snow Leopard (Requested by
+        rniwa on #webkit).
 
         * GNUmakefile.am:
         * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
         * JavaScriptCore.xcodeproj/project.pbxproj:
-        * parser/ASTBuilder.h: Added.
-        (JSC::ASTBuilder::BinaryOpInfo::BinaryOpInfo):
-        (JSC::ASTBuilder::AssignmentInfo::AssignmentInfo):
-        (JSC::ASTBuilder::ASTBuilder):
-        (JSC::ASTBuilder::createSourceElements):
-        (JSC::ASTBuilder::varDeclarations):
-        (JSC::ASTBuilder::funcDeclarations):
-        (JSC::ASTBuilder::features):
-        (JSC::ASTBuilder::numConstants):
-        (JSC::ASTBuilder::appendToComma):
-        (JSC::ASTBuilder::createCommaExpr):
-        (JSC::ASTBuilder::createLogicalNot):
-        (JSC::ASTBuilder::createUnaryPlus):
-        (JSC::ASTBuilder::createVoid):
-        (JSC::ASTBuilder::thisExpr):
-        (JSC::ASTBuilder::createResolve):
-        (JSC::ASTBuilder::createObjectLiteral):
-        (JSC::ASTBuilder::createArray):
-        (JSC::ASTBuilder::createNumberExpr):
-        (JSC::ASTBuilder::createString):
-        (JSC::ASTBuilder::createBoolean):
-        (JSC::ASTBuilder::createNull):
-        (JSC::ASTBuilder::createBracketAccess):
-        (JSC::ASTBuilder::createDotAccess):
-        (JSC::ASTBuilder::createRegex):
-        (JSC::ASTBuilder::createNewExpr):
-        (JSC::ASTBuilder::createConditionalExpr):
-        (JSC::ASTBuilder::createAssignResolve):
-        (JSC::ASTBuilder::createFunctionExpr):
-        (JSC::ASTBuilder::createFunctionBody):
-        (JSC::ASTBuilder::createGetterOrSetterProperty):
-        (JSC::ASTBuilder::createArguments):
-        (JSC::ASTBuilder::createArgumentsList):
-        (JSC::ASTBuilder::createProperty):
-        (JSC::ASTBuilder::createPropertyList):
-        (JSC::ASTBuilder::createElementList):
-        (JSC::ASTBuilder::createFormalParameterList):
-        (JSC::ASTBuilder::createClause):
-        (JSC::ASTBuilder::createClauseList):
-        (JSC::ASTBuilder::setUsesArguments):
-        (JSC::ASTBuilder::createFuncDeclStatement):
-        (JSC::ASTBuilder::createBlockStatement):
-        (JSC::ASTBuilder::createExprStatement):
-        (JSC::ASTBuilder::createIfStatement):
-        (JSC::ASTBuilder::createForLoop):
-        (JSC::ASTBuilder::createForInLoop):
-        (JSC::ASTBuilder::createEmptyStatement):
-        (JSC::ASTBuilder::createVarStatement):
-        (JSC::ASTBuilder::createReturnStatement):
-        (JSC::ASTBuilder::createBreakStatement):
-        (JSC::ASTBuilder::createContinueStatement):
-        (JSC::ASTBuilder::createTryStatement):
-        (JSC::ASTBuilder::createSwitchStatement):
-        (JSC::ASTBuilder::createWhileStatement):
-        (JSC::ASTBuilder::createDoWhileStatement):
-        (JSC::ASTBuilder::createLabelStatement):
-        (JSC::ASTBuilder::createWithStatement):
-        (JSC::ASTBuilder::createThrowStatement):
-        (JSC::ASTBuilder::createDebugger):
-        (JSC::ASTBuilder::createConstStatement):
-        (JSC::ASTBuilder::appendConstDecl):
-        (JSC::ASTBuilder::appendStatement):
-        (JSC::ASTBuilder::addVar):
-        (JSC::ASTBuilder::combineCommaNodes):
-        (JSC::ASTBuilder::evalCount):
-        (JSC::ASTBuilder::appendBinaryExpressionInfo):
-        (JSC::ASTBuilder::operatorStackPop):
-        (JSC::ASTBuilder::operatorStackHasHigherPrecedence):
-        (JSC::ASTBuilder::getFromOperandStack):
-        (JSC::ASTBuilder::shrinkOperandStackBy):
-        (JSC::ASTBuilder::appendBinaryOperation):
-        (JSC::ASTBuilder::operatorStackAppend):
-        (JSC::ASTBuilder::popOperandStack):
-        (JSC::ASTBuilder::appendUnaryToken):
-        (JSC::ASTBuilder::unaryTokenStackLastType):
-        (JSC::ASTBuilder::unaryTokenStackLastStart):
-        (JSC::ASTBuilder::unaryTokenStackRemoveLast):
-        (JSC::ASTBuilder::assignmentStackAppend):
-        (JSC::ASTBuilder::createAssignment):
-        (JSC::ASTBuilder::Scope::Scope):
-        (JSC::ASTBuilder::setExceptionLocation):
-        (JSC::ASTBuilder::incConstants):
-        (JSC::ASTBuilder::usesThis):
-        (JSC::ASTBuilder::usesCatch):
-        (JSC::ASTBuilder::usesClosures):
-        (JSC::ASTBuilder::usesArguments):
-        (JSC::ASTBuilder::usesAssignment):
-        (JSC::ASTBuilder::usesWith):
-        (JSC::ASTBuilder::usesEval):
-        (JSC::ASTBuilder::createNumber):
-        (JSC::ASTBuilder::makeTypeOfNode):
-        (JSC::ASTBuilder::makeDeleteNode):
-        (JSC::ASTBuilder::makeNegateNode):
-        (JSC::ASTBuilder::makeBitwiseNotNode):
-        (JSC::ASTBuilder::makeMultNode):
-        (JSC::ASTBuilder::makeDivNode):
-        (JSC::ASTBuilder::makeAddNode):
-        (JSC::ASTBuilder::makeSubNode):
-        (JSC::ASTBuilder::makeLeftShiftNode):
-        (JSC::ASTBuilder::makeRightShiftNode):
-        (JSC::ASTBuilder::makeFunctionCallNode):
-        (JSC::ASTBuilder::makeBinaryNode):
-        (JSC::ASTBuilder::makeAssignNode):
-        (JSC::ASTBuilder::makePrefixNode):
-        (JSC::ASTBuilder::makePostfixNode):
-        * parser/JSParser.cpp: Added.
-        (JSC::JSParser::AllowInOverride::AllowInOverride):
-        (JSC::JSParser::AllowInOverride::~AllowInOverride):
-        (JSC::JSParser::token):
-        (JSC::JSParser::next):
-        (JSC::JSParser::consume):
-        (JSC::JSParser::match):
-        (JSC::JSParser::tokenStart):
-        (JSC::JSParser::tokenLine):
-        (JSC::JSParser::tokenEnd):
-        (JSC::JSParser::):
-        (JSC::JSParser::autoSemiColon):
-        (JSC::JSParser::canRecurse):
-        (JSC::JSParser::lastTokenEnd):
-        (JSC::jsParse):
-        (JSC::JSParser::JSParser):
-        (JSC::JSParser::parseProgram):
-        (JSC::JSParser::allowAutomaticSemicolon):
-        (JSC::JSParser::parseSourceElements):
-        (JSC::JSParser::parseVarDeclaration):
-        (JSC::JSParser::parseConstDeclaration):
-        (JSC::JSParser::parseDoWhileStatement):
-        (JSC::JSParser::parseWhileStatement):
-        (JSC::JSParser::parseVarDeclarationList):
-        (JSC::JSParser::parseConstDeclarationList):
-        (JSC::JSParser::parseForStatement):
-        (JSC::JSParser::parseBreakStatement):
-        (JSC::JSParser::parseContinueStatement):
-        (JSC::JSParser::parseReturnStatement):
-        (JSC::JSParser::parseThrowStatement):
-        (JSC::JSParser::parseWithStatement):
-        (JSC::JSParser::parseSwitchStatement):
-        (JSC::JSParser::parseSwitchClauses):
-        (JSC::JSParser::parseSwitchDefaultClause):
-        (JSC::JSParser::parseTryStatement):
-        (JSC::JSParser::parseDebuggerStatement):
-        (JSC::JSParser::parseBlockStatement):
-        (JSC::JSParser::parseStatement):
-        (JSC::JSParser::parseFormalParameters):
-        (JSC::JSParser::parseFunctionBody):
-        (JSC::JSParser::parseFunctionInfo):
-        (JSC::JSParser::parseFunctionDeclaration):
-        (JSC::JSParser::parseExpressionOrLabelStatement):
-        (JSC::JSParser::parseExpressionStatement):
-        (JSC::JSParser::parseIfStatement):
-        (JSC::JSParser::parseExpression):
-        (JSC::JSParser::parseAssignmentExpression):
-        (JSC::JSParser::parseConditionalExpression):
-        (JSC::isUnaryOp):
-        (JSC::JSParser::isBinaryOperator):
-        (JSC::JSParser::parseBinaryExpression):
-        (JSC::JSParser::parseProperty):
-        (JSC::JSParser::parseObjectLiteral):
-        (JSC::JSParser::parseArrayLiteral):
-        (JSC::JSParser::parsePrimaryExpression):
-        (JSC::JSParser::parseArguments):
-        (JSC::JSParser::parseMemberExpression):
-        (JSC::JSParser::parseUnaryExpression):
-        * parser/JSParser.h: Added.
-        (JSC::):
-        (JSC::JSTokenInfo::JSTokenInfo):
-        * parser/Lexer.cpp:
-        (JSC::Lexer::lex):
-        * parser/Lexer.h:
-        (JSC::Lexer::setLastLineNumber):
-        (JSC::Lexer::lastLineNumber):
-        * parser/NodeConstructors.h:
-        (JSC::Node::Node):
-        * parser/Parser.cpp:
-        (JSC::Parser::parse):
-        * parser/SyntaxChecker.h: Added.
-        (JSC::SyntaxChecker::SyntaxChecker):
-        (JSC::SyntaxChecker::createSourceElements):
-        (JSC::SyntaxChecker::makeFunctionCallNode):
-        (JSC::SyntaxChecker::appendToComma):
-        (JSC::SyntaxChecker::createCommaExpr):
-        (JSC::SyntaxChecker::makeAssignNode):
-        (JSC::SyntaxChecker::makePrefixNode):
-        (JSC::SyntaxChecker::makePostfixNode):
-        (JSC::SyntaxChecker::makeTypeOfNode):
-        (JSC::SyntaxChecker::makeDeleteNode):
-        (JSC::SyntaxChecker::makeNegateNode):
-        (JSC::SyntaxChecker::makeBitwiseNotNode):
-        (JSC::SyntaxChecker::createLogicalNot):
-        (JSC::SyntaxChecker::createUnaryPlus):
-        (JSC::SyntaxChecker::createVoid):
-        (JSC::SyntaxChecker::thisExpr):
-        (JSC::SyntaxChecker::createResolve):
-        (JSC::SyntaxChecker::createObjectLiteral):
-        (JSC::SyntaxChecker::createArray):
-        (JSC::SyntaxChecker::createNumberExpr):
-        (JSC::SyntaxChecker::createString):
-        (JSC::SyntaxChecker::createBoolean):
-        (JSC::SyntaxChecker::createNull):
-        (JSC::SyntaxChecker::createBracketAccess):
-        (JSC::SyntaxChecker::createDotAccess):
-        (JSC::SyntaxChecker::createRegex):
-        (JSC::SyntaxChecker::createNewExpr):
-        (JSC::SyntaxChecker::createConditionalExpr):
-        (JSC::SyntaxChecker::createAssignResolve):
-        (JSC::SyntaxChecker::createFunctionExpr):
-        (JSC::SyntaxChecker::createFunctionBody):
-        (JSC::SyntaxChecker::createArguments):
-        (JSC::SyntaxChecker::createArgumentsList):
-        (JSC::SyntaxChecker::createProperty):
-        (JSC::SyntaxChecker::createPropertyList):
-        (JSC::SyntaxChecker::createElementList):
-        (JSC::SyntaxChecker::createFormalParameterList):
-        (JSC::SyntaxChecker::createClause):
-        (JSC::SyntaxChecker::createClauseList):
-        (JSC::SyntaxChecker::setUsesArguments):
-        (JSC::SyntaxChecker::createFuncDeclStatement):
-        (JSC::SyntaxChecker::createBlockStatement):
-        (JSC::SyntaxChecker::createExprStatement):
-        (JSC::SyntaxChecker::createIfStatement):
-        (JSC::SyntaxChecker::createForLoop):
-        (JSC::SyntaxChecker::createForInLoop):
-        (JSC::SyntaxChecker::createEmptyStatement):
-        (JSC::SyntaxChecker::createVarStatement):
-        (JSC::SyntaxChecker::createReturnStatement):
-        (JSC::SyntaxChecker::createBreakStatement):
-        (JSC::SyntaxChecker::createContinueStatement):
-        (JSC::SyntaxChecker::createTryStatement):
-        (JSC::SyntaxChecker::createSwitchStatement):
-        (JSC::SyntaxChecker::createWhileStatement):
-        (JSC::SyntaxChecker::createWithStatement):
-        (JSC::SyntaxChecker::createDoWhileStatement):
-        (JSC::SyntaxChecker::createLabelStatement):
-        (JSC::SyntaxChecker::createThrowStatement):
-        (JSC::SyntaxChecker::createDebugger):
-        (JSC::SyntaxChecker::createConstStatement):
-        (JSC::SyntaxChecker::appendConstDecl):
-        (JSC::SyntaxChecker::createGetterOrSetterProperty):
-        (JSC::SyntaxChecker::appendStatement):
-        (JSC::SyntaxChecker::addVar):
-        (JSC::SyntaxChecker::combineCommaNodes):
-        (JSC::SyntaxChecker::evalCount):
-        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
-        (JSC::SyntaxChecker::operatorStackPop):
-        * runtime/JSGlobalData.h:
-        * wtf/Platform.h:
-        * wtf/ThreadSpecific.h:
-        (WTF::T):
-
-2010-06-23  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Optimization of the QScriptValuePrivate.
-
-        Patch change only internals of the QScriptValuePrivate.
-        Most of the QScriptValuePrivate's attributes were moved
-        into an union.
-
-        [Qt] Optimization of the QScriptVAluePrivate.
-        https://bugs.webkit.org/show_bug.cgi?id=40415
-
-        * qt/api/qscriptengine_p.cpp:
-        (QScriptEnginePrivate::globalObject):
-        * qt/api/qscriptvalue_p.h:
-        (QScriptValuePrivate::):
-        (QScriptValuePrivate::~QScriptValuePrivate):
-        (QScriptValuePrivate::QScriptValuePrivate):
-        (QScriptValuePrivate::toString):
-        (QScriptValuePrivate::toNumber):
-        (QScriptValuePrivate::toBool):
-        (QScriptValuePrivate::toObject):
-        (QScriptValuePrivate::equals):
-        (QScriptValuePrivate::strictlyEquals):
-        (QScriptValuePrivate::assignEngine):
-        (QScriptValuePrivate::operator JSValueRef):
-        (QScriptValuePrivate::operator JSObjectRef):
-        (QScriptValuePrivate::refinedJSValue):
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * runtime/MarkedBlock.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::collectorBlock):
+        * wtf/CMakeLists.txt:
+        * wtf/DoublyLinkedList.h: Removed.
 
-2010-06-23  Kwang Yul Seo  <skyul@company100.net>
+2011-02-22  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        [GTK] Implement ThreadSpecific with glib
-        https://bugs.webkit.org/show_bug.cgi?id=39829
-
-        Implement ThreadSpecific with glib's GStaticPrivate.
-        This patch makes it possible to build GTK port without pthread.
-
-        * wtf/ThreadSpecific.h:
-        (WTF::::ThreadSpecific):
-        (WTF::::~ThreadSpecific):
-        (WTF::::get):
-        (WTF::::set):
-        (WTF::::destroy):
-
-2010-06-23  Leandro Pereira  <leandro@profusion.mobi>
-
-        Unreviewed build fix.
-
-        * CMakeLists.txt: Add runtime/RegExpCache.cpp.
-
-2010-06-22  Renata Hodovan  <hodovan@inf.u-szeged.hu>
-
-        Reviewed by Geoffrey Garen.
-
-        Adding regular expression caching to JavaScriptCore
-        https://bugs.webkit.org/show_bug.cgi?id=38142
-
-        The cache is based on Round Robin eviction policy, and
-        can cache at most 256 character long regular expressions,
-        and at most 256 of them. These values can be changed at compile time.
+        Manage MarkedBlocks in a linked list instead of a vector, so arbitrary removal is O(1)
+        https://bugs.webkit.org/show_bug.cgi?id=54999
+        
+        SunSpider reports no change.
 
         * GNUmakefile.am:
         * JavaScriptCore.gypi:
-        * JavaScriptCore.pro:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::RegExpNode::emitBytecode):
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        (JSC::JSGlobalData::~JSGlobalData):
-        * runtime/JSGlobalData.h:
-        (JSC::JSGlobalData::regExpCache):
-        * runtime/RegExpCache.cpp: Added.
-        (JSC::RegExpCache::lookupOrCreate):
-        (JSC::RegExpCache::create):
-        (JSC::RegExpCache::RegExpCache):
-        * runtime/RegExpCache.h: Added.
-        * runtime/RegExpConstructor.cpp:
-        (JSC::constructRegExp):
-        * runtime/RegExpKey.h: Added.
-        (JSC::RegExpKey::RegExpKey):
-        (JSC::RegExpKey::getFlagsValue):
-        (WTF::operator==):
-        (WTF::):
-        * runtime/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncCompile):
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
-
-2010-06-22  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Add native call support for ARM and Thumb-2 JIT.
-        https://bugs.webkit.org/show_bug.cgi?id=40231
-
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTINativeCall):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTINativeCall):
-        * wtf/Platform.h:
-
-2010-06-21  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Make JSC more resilient in the face of parse failures
-        https://bugs.webkit.org/show_bug.cgi?id=40951
-
-        A number of recent bugs have occurred due to issues like miscounting
-        BOMs, etc which lead to interesting crashes later on.  Adding this
-        logic hardens JSC in the face of these errors, and has no impact on
-        performance (32bit jit actually gets 0.7% faster but I put that down
-        to cache effects).
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
-        (JSC::CodeBlock::lineNumberForBytecodeOffset):
-        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
-        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::bytecodeOffset):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::executeCall):
-        (JSC::Interpreter::executeConstruct):
-        (JSC::Interpreter::prepareForRepeatCall):
-        (JSC::Interpreter::privateExecute):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::isNumericCompareFunction):
-        * runtime/Executable.cpp:
-        (JSC::FunctionExecutable::compileForCall):
-        (JSC::FunctionExecutable::compileForConstruct):
-        (JSC::FunctionExecutable::generateJITCodeForCall):
-        (JSC::FunctionExecutable::generateJITCodeForConstruct):
-        (JSC::FunctionExecutable::reparseExceptionInfo):
-        (JSC::EvalExecutable::reparseExceptionInfo):
-        * runtime/Executable.h:
-        (JSC::FunctionExecutable::bytecodeForCall):
-        (JSC::FunctionExecutable::bytecodeForConstruct):
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::numericCompareFunction):
-
-2010-06-21  John Sullivan  <sullivan@apple.com>
-
-        Reviewed by Adam Roben.
-
-        RetainPtr can't be used in HashMaps or HashSets
-        <https://bugs.webkit.org/show_bug.cgi?id=40938>
-        
-        Added hashing knowledge similar to that in COMPtr.h.
-
-        * wtf/RetainPtr.h:
-        (WTF::RetainPtr::RetainPtr):
-        New function, copied from COMPtr.h but for the type change.
-        (WTF::RetainPtr::isHashTableDeletedValue):
-        Ditto.
-        (WTF::RetainPtr::hashTableDeletedValue):
-        Ditto.
-        Added template code for HashTraits and PtrHash copied from COMPtr.h but for the type change.
-        The only difference is that constructDeletedValue() matches the RefPtr implementation (in HashTraits.h)
-        rather than the COMPtr implementation.
-
-2010-06-19  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Need to ensure that we grow the RegisterFile when creating a callframe for host code
-        https://bugs.webkit.org/show_bug.cgi?id=40858
-        <rdar://problem/8108986>
-
-        In the past the use of the callframe in hostcode was much more
-        limited.  Now that we expect the callframe to always be valid
-        we need to grow the RegisterFile so that this is actually the
-        case.  In this particular case the problem was failing to grow
-        the registerfile could lead to a callframe that extended beyond
-        RegisterFiler::end(), so vm re-entry would clobber the callframe
-        other scenarios could also lead to badness.
-
-        I was unable to construct a simple testcase to trigger badness,
-        and any such testcase would be so dependent on exact vm stack
-        layout that it would be unlikely to work as a testcase following
-        any callframe or register allocation changes anyway.
-
-        Thankfully the new assertion I added should help to catch these
-        failures in future, and triggers on a couple of tests currently.
-
-        * interpreter/CallFrame.cpp:
-        (JSC::CallFrame::registerFile):
-        * interpreter/CallFrame.h:
-        (JSC::ExecState::init):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-
-2010-06-21  Satish Sampath  <satish@chromium.org>
-
-        Reviewed by Steve Block.
-
-        Speech Input Patch 0: Added compilation argument to conditionally compile pending patches.
-        https://bugs.webkit.org/show_bug.cgi?id=40878
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2010-06-21  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Kent Tamura.
-
-        [BREWMP] Use global new/delete operator overloading with USE_SYSTEM_MALLOC=1
-        https://bugs.webkit.org/show_bug.cgi?id=40653
-
-        Currently, other ports do not use global new/delete operator overloading
-        when USE_SYSTEM_MALLOC=1. Brew MP uses system malloc, but it needs to enable
-        "global fastMalloc new" because the default new/delete causes crash on device.
-        We need to replace them with Brew MP's MALLOC/FREE.
-
-        * wtf/FastMalloc.h:
-
-2010-06-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Work around a build problem with libjscore on Symbian.
-        https://bugs.webkit.org/show_bug.cgi?id=40840
-
-        Sbsv2 sometimes have problems with debug/release configuration
-        determination causing QtWebKit in release to try linking with the debug
-        JavaScriptCore static library. This patch limit the jscore/jscored
-        r58306 fix necessary for mac builds only to the mac platform to prevent the
-        different name problem.
-
-        The real fix would be to fix qmake or the toolchain, this patch might
-        help meanwhile.
-
-        * JavaScriptCore.pri:
-
-2010-06-21  Patrick Gansterer  <paroga@paroga.com>
-
-        Reviewed by Kent Tamura.
-
-        Buildfix after r61338.
-        https://bugs.webkit.org/show_bug.cgi?id=40888
-
-        roundUpAllocationSize is needed in RegisterFile.h.
-
-        * jit/ExecutableAllocator.h:
-
-2010-06-19  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Darin Adler.
-
-        Include <string.h> in StringExtras.h
-        https://bugs.webkit.org/show_bug.cgi?id=40808
-
-        Without string.h, RVCT 2.2 can't compile StringExtras.h.
-        It can't find strlen and strncmp.
-
-        * wtf/StringExtras.h:
-
-2010-06-19  Thiago Macieira <thiago.macieira@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        Don't use __attribute__((may_alias)) with the Intel compiler,
-        as it doesn't understand it.
-
-        * wtf/Vector.h:
-
-2010-06-19  Thiago Macieira <thiago.macieira@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        Fix compilation with the Intel C++ compiler (11.1.072).
-
-        Like RVCT, label pointers must be void*, not const void*.
-
-        * bytecode/Opcode.h:
-
-2010-06-19  Thiago Macieira <thiago.macieira@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        Add the WTF_COMPILER_INTEL for when the Intel compiler is used
-        for building. Usually, the Intel compiler masquerades as
-        another compiler in the system and gets away with it, but some
-        times specific fixes are required (such as when using language
-        extensions).
-
-        * wtf/Platform.h:
-
-2010-06-18  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Incorrect handling of multiple BOMs scattered through a file.
-        https://bugs.webkit.org/show_bug.cgi?id=40865
-
-        When determining the offset of open and close braces in a source
-        with BOMs we were finishing our count early as we failed to account
-        for BOMs prior to the open/close brace positions effecting those
-        positions.
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::sourceCode):
-
-2010-06-17  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Don't throw away exception information for functions that use exceptions
-        https://bugs.webkit.org/show_bug.cgi?id=40786
-
-        Simple patch to stop JSC from throwing away the exception information
-        of a function that uses "exceptiony" features like try and throw.  This
-        is a speed up for catching expressions but it's difficult to quantify as
-        the old cost of reparsing is amortised over all exceptions caught in the
-        effected function.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::generate):
-        (JSC::BytecodeGenerator::emitCatch):
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::emitThrow):
-
-2010-06-18  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Add PlatformStrategies and PluginStrategy classes.
-        https://bugs.webkit.org/show_bug.cgi?id=40850
-
-        * wtf/Platform.h:
-
-2010-06-18  Leandro Pereira  <leandro@profusion.mobi>
-
-        [EFL] Unreviewed build fix.
-
-        * wtf/CMakeLists.txt: Add MD5.cpp.
-
-2010-06-17  Shu Chang  <chang.shu@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        [Qt] Fix the link error on symbian with ENABLE_JIT=0.
-        1. Add "#if ENABLE(JIT)" in the header file;
-        2. Put feature enable/disable logic to a common.pri so
-        that both JavaScriptCore.pri and WebCore.pri can share.
-
-        https://bugs.webkit.org/show_bug.cgi?id=40780
-
-        * JavaScriptCore.pri:
-        * jit/ExecutableAllocator.h:
-
-2010-06-17  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Use adoptRef and create functions in more code paths
-        https://bugs.webkit.org/show_bug.cgi?id=40760
-
-        * API/JSClassRef.h: Removed unneeded include of RefCounted.h.
-        * API/JSWeakObjectMapRefPrivate.cpp: Ditto.
-
-        * bytecode/CodeBlock.h:
-        (JSC::FunctionCodeBlock::FunctionCodeBlock): Use the
-        SharedSymbolTable::create function instead of calling new directly.
-
-        * runtime/SymbolTable.h: Added a create function to the SharedSymbolTable
-        class and made the constructor private.
-
-2010-06-17  Mark Brand  <mabrand@mabrand.nl>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] use "win32-g++*" scope to match all MinGW makespecs
-
-        The scope "win32-g++" comes from the name of the makespec. However, it
-        is frequently used to check for MinGW. This works fine as long as
-        win32-g++ is the only makespec for MinGW. Now we need the wildcard
-        to cover "win32-g++-cross" as well.
-
-        * JavaScriptCore.pro:
-
-2010-06-16  Darin Adler  <darin@apple.com>
-
-        Reviewed by David Levin.
-
-        Deploy adoptRef in more places, including all HTML and MathML elements
-        https://bugs.webkit.org/show_bug.cgi?id=39941
-
-        * wtf/ThreadSafeShared.h: Made the constructor protected and removed the
-        unneeded support for initial reference counts other than 1.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: So many build systems, so little time.
+        * wtf/CMakeLists.txt:
 
-2010-06-16  Peter Varga  <pvarga@inf.u-szeged.hu>
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::setPrev):
+        (JSC::MarkedBlock::setNext):
+        (JSC::MarkedBlock::prev):
+        (JSC::MarkedBlock::next): Added linked list data members and accessors.
 
-        Reviewed by Geoffrey Garen.
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy):
+        (JSC::MarkedSpace::allocateBlock): Stop using vector, since it doesn't exist anymore.
 
-        Store matchBegin directly in the array of output instead of the stack.
-        https://bugs.webkit.org/show_bug.cgi?id=38988
+        (JSC::MarkedSpace::freeBlocks): New helper function for updating relevant
+        data structures when freeing blocks.
 
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::generateDisjunction):
-        (JSC::Yarr::RegexGenerator::generate):
+        (JSC::MarkedSpace::allocate): Updated for nextBlock being a pointer and
+        not a vector index.
 
-2010-06-15  Anders Carlsson  <andersca@apple.com>
+        (JSC::MarkedSpace::shrink): Construct a temporary list of empties and
+        then free them, to avoid modifying our hash table while iterating it.
+        This wasn't a concern before because we were using indirect array
+        indexing, not direct pointer indexing.
 
-        Reviewed by Sam Weinig.
+        (JSC::MarkedSpace::reset): Updated for nextBlock being a pointer and
+        not a vector index.
 
-        Make JavaScriptCore build with clang++.
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::CollectorHeap): Changed data type from vector to linked list.
 
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::emitPutVirtualRegister):
-        Explicitly cast to an int.
+        * wtf/DoublyLinkedList.h: Added. New linked list class.
+        (WTF::::DoublyLinkedList):
+        (WTF::::isEmpty):
+        (WTF::::head):
+        (WTF::::append):
+        (WTF::::remove):
 
-        * yarr/RegexCompiler.cpp:
-        (JSC::Yarr::compileRegex):
-        Return 0 instead of false.
+2011-02-22  Gavin Barraclough  <barraclough@apple.com>
 
-2010-06-15  Adam Roben  <aroben@apple.com>
+        Windows build fix.
 
-        Make WebCore's and JavaScriptCore's DerivedSources available for debugging in production builds
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        Fixes <http://webkit.org/b/40626> <rdar://problem/8094205>.
+2011-02-22  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Sam Weinig.
 
-        * JavaScriptCore.vcproj/JavaScriptCore.make: Copy the contents of
-        JavaScriptCore's DerivedSources directory to
-        AppleInternal/Sources/JavaScriptCore.
-
-2010-06-15  Gabor Loki  <loki@webkit.org>
-
-        Rubber-stamped by Eric Seidel.
-
-        Fix invalid access to non-static data member warning in JITPropertyAccess32_64 on ARM
-        https://bugs.webkit.org/show_bug.cgi?id=40423
-
-        Using OBJECT_OFFSETOF macro instead of objectof to bypass access to
-        non-static data member warning.
-
-        * jit/JITPropertyAccess32_64.cpp:
-        (JSC::JIT::privateCompilePutByIdTransition):
-
-2010-06-11  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Barth.
-
-        Rename the rest of the *Tokenizer classes to *DocumentParser
-        https://bugs.webkit.org/show_bug.cgi?id=40507
-
-        * wtf/Platform.h:
-         - fixed a comment to match new names.
-
-2010-06-11  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Explicit conversions from QtScript types to JSC opaque types were removed.
-        https://bugs.webkit.org/show_bug.cgi?id=40412
-
-        Conversion between a JSC C types and a QtScript private types, takes
-        main part of the source code. In most cases a mapping between the types
-        is one to one. New cast operators were added to simplify the code.
-
-        The QScriptValuePrivate could be casted to the JSValueRef and the JSObjectRef.
-        The QScriptEnginePrivate could be casted to the JSGlobalContext.
-        The QScriptProgramPrivate could be casted to the JSStringRef.
-
-        * qt/api/qscriptengine_p.cpp:
-        (QScriptEnginePrivate::evaluate):
-        (QScriptEnginePrivate::newObject):
-        (QScriptEnginePrivate::globalObject):
-        * qt/api/qscriptengine_p.h:
-        (QScriptEnginePrivate::operator JSGlobalContextRef):
-        * qt/api/qscriptprogram_p.h:
-        (QScriptProgramPrivate::operator JSStringRef):
-        * qt/api/qscriptsyntaxcheckresult.cpp:
-        (QScriptSyntaxCheckResultPrivate::~QScriptSyntaxCheckResultPrivate):
-        (QScriptSyntaxCheckResultPrivate::errorMessage):
-        (QScriptSyntaxCheckResultPrivate::errorLineNumber):
-        * qt/api/qscriptvalue_p.h:
-        (QScriptValuePrivate::~QScriptValuePrivate):
-        (QScriptValuePrivate::QScriptValuePrivate):
-        (QScriptValuePrivate::isBool):
-        (QScriptValuePrivate::isNumber):
-        (QScriptValuePrivate::isNull):
-        (QScriptValuePrivate::isString):
-        (QScriptValuePrivate::isUndefined):
-        (QScriptValuePrivate::isFunction):
-        (QScriptValuePrivate::toString):
-        (QScriptValuePrivate::toNumber):
-        (QScriptValuePrivate::toBool):
-        (QScriptValuePrivate::toObject):
-        (QScriptValuePrivate::equals):
-        (QScriptValuePrivate::strictlyEquals):
-        (QScriptValuePrivate::instanceOf):
-        (QScriptValuePrivate::call):
-        (QScriptValuePrivate::operator JSValueRef):
-        (QScriptValuePrivate::operator JSObjectRef):
-        (QScriptValuePrivate::setValue):
-        (QScriptValuePrivate::inherits):
-        (QScriptValuePrivate::refinedJSValue):
-
-2010-05-31  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Implement the simple text code path.
-        https://bugs.webkit.org/show_bug.cgi?id=40077
-
-        Remove the FONT_FAST_PATH macro and use the Qt's
-        fast text implementation instead of the one of WebKit.
-
-        The Qt::TextBypassShaping flag is used to tell Qt to
-        only use the glyph advances.
-
-        Qt 4.7 is needed to get this flag thus the complex path is always
-        used if QtWebKit is compiled against an earlier version.
-
-        Contrary to the WebKit's implementation, the complex code path
-        is taken if the text is RightToLeft, justified or is formatted
-        with non-zero letter or word spacing.
-
-        * wtf/Platform.h:
-
-2010-06-11  Luiz Agostini  <luiz.agostini@openbossa.org>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        add codePointCompare to JavaScriptCore.exp
-        https://bugs.webkit.org/show_bug.cgi?id=40426
+        Bug 54988 - Re-create StructureTransitionTable class, encapsulate transition table
+
+        The Structure class keeps a table of transitions to derived Structure types. Since
+        this table commonly contains a single entry we employ an optimization where instead
+        of holding a map, we may hold a pointer directly to a single instance of the mapped
+        type. We use an additional bit of data to flag whether the pointer is currently
+        pointing to a table of transitions, or a singleton transition. Previously we had
+        commonly used a pattern of storing data in the low bits of pointers, but had moved
+        away from this since it causes false leaks to be reported by the leaks tool. However
+        in this case, the entries in the map are weak links - this pointer will never be
+        responsible for keeping an object alive.  As such we can use this approach provided
+        that the bit is set when a table is not in use (otherwise the table would appear to
+        be leaked).
+
+        Additionally, the transition table currently allows two entries to exist for a given
+        key - one specialized to a particular value, and one not specialized. This is
+        unnecessary, wasteful, and a little inconsistent. (If you create an entry for a
+        specialized value, then a non-specialized entry, both will exist.  If you create an
+        entry for a non-specialized value, then try to create a specialized entry, only a
+        non-specialized form will be allowed.)
+
+        This shows a small progression on v8.
 
         * JavaScriptCore.exp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
+        (JSC::Structure::dumpStatistics):
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::Hash::hash):
+        (JSC::StructureTransitionTable::Hash::equal):
+        (JSC::StructureTransitionTable::HashTraits::emptyValue):
+        (JSC::StructureTransitionTable::HashTraits::constructDeletedValue):
+        (JSC::StructureTransitionTable::HashTraits::isDeletedValue):
+        (JSC::StructureTransitionTable::StructureTransitionTable):
+        (JSC::StructureTransitionTable::~StructureTransitionTable):
+        (JSC::StructureTransitionTable::isUsingSingleSlot):
+        (JSC::StructureTransitionTable::map):
+        (JSC::StructureTransitionTable::setMap):
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::setSingleTransition):
+
+2011-02-22  Andras Becsi  <abecsi@webkit.org>
 
-2010-06-10  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Math Javascript Bug on Safari 5 (webkit 533.16) under "32bit" mode
-        https://bugs.webkit.org/show_bug.cgi?id=40367
-
-        If we're in the slow case of right shift we must write the type tag as
-        the only reason we hit this code path is because we know we're working
-        with a double.  eg. we are guaranteed that the tag cannot be reused.
-
-        * jit/JITArithmetic32_64.cpp:
-        (JSC::JIT::emitRightShiftSlowCase):
-
-2010-06-10  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
-
-        Remove weakRandomNumber
-        https://bugs.webkit.org/show_bug.cgi?id=40291
-
-        weakRandomNumber is used nowhere. Currently, WeakRandom is used instead.
-
-        * wtf/RandomNumber.cpp:
-        * wtf/RandomNumber.h:
-
-2010-06-09  Alexey Proskuryakov  <ap@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        Export StringImpl::ascii(). It might be not very useful, but it's a public function.
-
-        * JavaScriptCore.exp:
-
-2010-06-09  Leandro Pereira  <leandro@profusion.mobi>
-
-        Reviewed by Adam Treat.
-
-        [EFL] Allow building core libraries as shared objects to speed up
-        linking time on machines with small amounts of memory.
-        http://webkit.org/b/39899
-
-        * CMakeLists.txt: If building with shared core, install the lib.
-        * jsc/CMakeListsEfl.txt: Needs Glib and Ecore to link dynamically.
-        * wtf/CMakeLists.txt: If building with shared core, install the lib.
-
-2010-06-09  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by David Levin.
-
-        Remove some unused variable warnings from JITOpcodes
-        https://bugs.webkit.org/show_bug.cgi?id=40298
-
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTINativeCall):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTINativeCall):
-
-2010-05-18  Yuzo Fujishima  <yuzo@google.com>
-
-        Reviewed by Shinichiro Hamaji.
-
-        Fix for Bug 34529 -  [CSSOM] issues with cssText and selectorText
-        Add U16_LENGTH that is needed to implement CSS character serialization.
-        https://bugs.webkit.org/show_bug.cgi?id=34529
-
-        * wtf/unicode/qt4/UnicodeQt4.h:
-        * wtf/unicode/wince/UnicodeWince.h:
-
-2010-06-08  Sheriff Bot  <webkit.review.bot@gmail.com>
-
-        Unreviewed, rolling out r60830.
-        http://trac.webkit.org/changeset/60830
-        https://bugs.webkit.org/show_bug.cgi?id=40305
-
-        Broke the Windows build (Requested by abarth on #webkit).
-
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * wtf/OwnPtrCommon.h:
-        * wtf/brew/OwnPtrBrew.h: Removed.
-        * wtf/win/OwnPtrWin.h: Removed.
-
-2010-06-08  MORITA Hajime  <morrita@google.com>
-
-        Unreviewed. An attempt to fix test break.
-
-        * Configurations/FeatureDefines.xcconfig:
-
-2010-06-08  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Adam Barth.
-
-        Change OwnPtrCommon to include platform-specific headers
-        https://bugs.webkit.org/show_bug.cgi?id=40279
-
-        Adding new type to OwnPtrCommon needlessly causes all ports to do full rebuilds.
-        Change OwnPtrCommon to include platform-specific headers to avoid all ports rebuilds.
-
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * wtf/OwnPtrCommon.h:
-        * wtf/brew/OwnPtrBrew.h: Added.
-        * wtf/win/OwnPtrWin.h: Added.
+        Reviewed by Laszlo Gombos.
 
-2010-06-07  MORITA Hajime  <morrita@google.com>
-        
-        Reviewed by Kent Tamura.
+        [Qt] Redesign the build system
+        https://bugs.webkit.org/show_bug.cgi?id=51339
 
-        https://bugs.webkit.org/show_bug.cgi?id=40219
-        [Mac] ENABLE_METER_TAG should be enabled
-        
-        Added ENABLE_METER_TAG.
+        Part 2.
 
-        * Configurations/FeatureDefines.xcconfig:
+        Build WebCore as a static library, compile the WebKit API and WebKit2 API
+        in a final step and link to WebKit2, WebCore and JSC libraries to fix
+        linking issues resulting from stripped away symbols.
 
-2010-06-07  Kwang Yul Seo  <skyul@company100.net>
+        * JavaScriptCore.pri: Remove the workaround.
 
-        Reviewed by Eric Seidel.
+2011-02-21  Adam Roben  <aroben@apple.com>
 
-        [BREWMP] Add more types to OwnPtr
-        https://bugs.webkit.org/show_bug.cgi?id=39667
+        Fix linker warning on Windows
 
-        Add ISSL and ISocket to the list of OwnPtr-ed type.
+        r79135 tried to export JSObject::s_info by adding it to JavaScriptCore.def. This is the
+        obvious way (since it's how we export functions), but unfortunately it doesn't work correct.
+        r79222 made us export it the right way (using the JS_EXPORTDATA macro), but forgot to remove
+        it from JavaScriptCore.def. This caused us to get linker warnings about exporting the symbol
+        multiple times.
 
-        * wtf/OwnPtrCommon.h:
-        * wtf/brew/OwnPtrBrew.cpp:
-        (WTF::deleteOwnedPtr):
+        Rubber-stamped by Anders Carlsson.
 
-2010-06-07  Benjamin Poulain  <benjamin.poulain@nokia.com>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed JSObject::s_info.
 
-        Reviewed by Simon Hausmann.
+2011-02-21  Brian Weinstein  <bweinstein@apple.com>
 
-        [Qt] Crash when compiling on Snow Leopard and running on Leopard
-        https://bugs.webkit.org/show_bug.cgi?id=31403
+        Reviewed by Adam Roben.
 
-        Disable the use of pthread_setname_np and other symbols
-        when targetting Leopard.
+        WebResourceCacheManager should be responsible for managing the CFURLCache as well
+        as the WebCore memory cache.
+        https://bugs.webkit.org/show_bug.cgi?id=54886
+        Part of <rdar://problem/8971738>
 
-        Use the defines TARGETING_XX instead of BUILDING_ON_XX 
-        for features that cannot be used before Snow Leopard.
+        Add a new use flag for using the CFURLCache.
 
         * wtf/Platform.h:
 
-2010-06-07  Gabor Loki  <loki@webkit.org>
-
-        Reviewed by NOBODY (JSVALUE32_64 build fix).
+2011-02-21  Xan Lopez  <xlopez@igalia.com>
 
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTINativeCall):
+        Reviewed by Gavin Barraclough.
 
-2010-06-06  Gavin Barraclough  <barraclough@apple.com>
+        Use ASSERT_JIT_OFFSET in JITPropertyAccess32_64.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=54901
 
-        Reviewed by NOBODY (windows build fix pt 2).
+        * jit/JIT.h: swap actual and expected values in message, they were
+        reversed.
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall): use ASSERT_JIT_OFFSET instead of
+        a simple ASSERT.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_method_check): ditto.
+        (JSC::JIT::compileGetByIdHotPath): ditto.
+        (JSC::JIT::compileGetByIdSlowCase): ditto.
+        (JSC::JIT::emit_op_put_by_id): ditto.
 
-        * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+2011-02-21  Gavin Barraclough  <barraclough@apple.com>
 
-2010-06-06  Gavin Barraclough  <barraclough@apple.com>
+        Ruber stamped by Sam Weinig
 
-        Reviewed by NOBODY (windows build fix pt 1).
+        Bug 54899 - Math.LOG10E should be 0.4342944819032518
+        This value is quoted in section 15.8.1.5 of the spec.
 
-        * JavaScriptCore.exp:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
 
-2010-06-06  Gavin Barraclough  <barraclough@apple.com>
+2011-02-21  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Bug 40214 - Clean up error construction / throwing in JSC.
-        
-        The one egregious insanity here is that creating an error requires
-        a VM-entry-esqe-host call (the string argument is wrapped as a JS
-        object & pushed on the RegisterFile, then unwrapped back to a
-        UString).  Changing this also means you only require a global
-        object, not an ExecState, to create an error.
-
-        The methods to create error objects are also parameterized
-        requiring a switch on the type, which can be made cleaner and
-        faster by moving to a separate method per error type.  Code to add
-        divot information to error had been duplicated, and is coalesced
-        back into a single function.
-
-        Convenience methods added to create & throw type & syntax error
-        with a default error message, since this is a common case.
-
-        Also, errors are currently thrown either using
-        "throwError(exec, error)" or "exec->setException(error)" - unify
-        on the former, since this is more commonly used.  Add
-        "throwVMError(exec, error)" equivalents, as a convenience for
-        cases where the result was being wrapped in "JSValue::encode(...)".
+        Bug 54894 - Make inheritance structure described by ClassInfo match C++ class hierarchy.
+
+        The ClassInfo objects describe an inheritance hierarchy, with each ClassInfo instance
+        containing a pointer to its parent class. These links should reflect the inheritance
+        hierarchy of C++ classes below JSObject. For the large part it does, but in some cases
+        entries in the C++ hierarchy are skipped over. This presently likely doesn't matter,
+        since intervening C++ classes may not have ClassInfo - but would be a potential bug
+        were ClassInfo were to be added.
 
         * API/JSCallbackConstructor.cpp:
-        (JSC::constructJSCallback):
         * API/JSCallbackFunction.cpp:
-        (JSC::JSCallbackFunction::call):
         * API/JSCallbackObjectFunctions.h:
-        (JSC::::getOwnPropertySlot):
-        (JSC::::put):
-        (JSC::::deleteProperty):
-        (JSC::::construct):
-        (JSC::::hasInstance):
-        (JSC::::call):
-        (JSC::::toNumber):
-        (JSC::::toString):
-        (JSC::::staticValueGetter):
-        (JSC::::staticFunctionGetter):
-        (JSC::::callbackGetter):
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeError):
-        * JavaScriptCore.exp:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitNewError):
-        (JSC::BytecodeGenerator::emitThrowExpressionTooDeepException):
-        * bytecompiler/BytecodeGenerator.h:
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::ThrowableExpressionData::emitThrowError):
-        (JSC::RegExpNode::emitBytecode):
-        (JSC::PostfixErrorNode::emitBytecode):
-        (JSC::PrefixErrorNode::emitBytecode):
-        (JSC::AssignErrorNode::emitBytecode):
-        (JSC::ForInNode::emitBytecode):
-        (JSC::ContinueNode::emitBytecode):
-        (JSC::BreakNode::emitBytecode):
-        (JSC::ReturnNode::emitBytecode):
-        (JSC::LabelNode::emitBytecode):
-        * interpreter/CallFrame.h:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::privateExecute):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jsc.cpp:
-        (functionRun):
-        (functionLoad):
-        (functionCheckSyntax):
-        * parser/Nodes.h:
-        * runtime/ArrayConstructor.cpp:
-        (JSC::constructArrayWithSizeQuirk):
+        * runtime/Arguments.h:
         * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncToString):
-        (JSC::arrayProtoFuncToLocaleString):
-        (JSC::arrayProtoFuncJoin):
-        (JSC::arrayProtoFuncFilter):
-        (JSC::arrayProtoFuncMap):
-        (JSC::arrayProtoFuncEvery):
-        (JSC::arrayProtoFuncForEach):
-        (JSC::arrayProtoFuncSome):
-        (JSC::arrayProtoFuncReduce):
-        (JSC::arrayProtoFuncReduceRight):
-        * runtime/BooleanPrototype.cpp:
-        (JSC::booleanProtoFuncToString):
-        (JSC::booleanProtoFuncValueOf):
+        * runtime/BooleanObject.cpp:
+        * runtime/DateInstance.cpp:
         * runtime/DatePrototype.cpp:
-        (JSC::dateProtoFuncToString):
-        (JSC::dateProtoFuncToUTCString):
-        (JSC::dateProtoFuncToISOString):
-        (JSC::dateProtoFuncToDateString):
-        (JSC::dateProtoFuncToTimeString):
-        (JSC::dateProtoFuncToLocaleString):
-        (JSC::dateProtoFuncToLocaleDateString):
-        (JSC::dateProtoFuncToLocaleTimeString):
-        (JSC::dateProtoFuncGetTime):
-        (JSC::dateProtoFuncGetFullYear):
-        (JSC::dateProtoFuncGetUTCFullYear):
-        (JSC::dateProtoFuncToGMTString):
-        (JSC::dateProtoFuncGetMonth):
-        (JSC::dateProtoFuncGetUTCMonth):
-        (JSC::dateProtoFuncGetDate):
-        (JSC::dateProtoFuncGetUTCDate):
-        (JSC::dateProtoFuncGetDay):
-        (JSC::dateProtoFuncGetUTCDay):
-        (JSC::dateProtoFuncGetHours):
-        (JSC::dateProtoFuncGetUTCHours):
-        (JSC::dateProtoFuncGetMinutes):
-        (JSC::dateProtoFuncGetUTCMinutes):
-        (JSC::dateProtoFuncGetSeconds):
-        (JSC::dateProtoFuncGetUTCSeconds):
-        (JSC::dateProtoFuncGetMilliSeconds):
-        (JSC::dateProtoFuncGetUTCMilliseconds):
-        (JSC::dateProtoFuncGetTimezoneOffset):
-        (JSC::dateProtoFuncSetTime):
-        (JSC::setNewValueFromTimeArgs):
-        (JSC::setNewValueFromDateArgs):
-        (JSC::dateProtoFuncSetMilliSeconds):
-        (JSC::dateProtoFuncSetUTCMilliseconds):
-        (JSC::dateProtoFuncSetSeconds):
-        (JSC::dateProtoFuncSetUTCSeconds):
-        (JSC::dateProtoFuncSetMinutes):
-        (JSC::dateProtoFuncSetUTCMinutes):
-        (JSC::dateProtoFuncSetHours):
-        (JSC::dateProtoFuncSetUTCHours):
-        (JSC::dateProtoFuncSetDate):
-        (JSC::dateProtoFuncSetUTCDate):
-        (JSC::dateProtoFuncSetMonth):
-        (JSC::dateProtoFuncSetUTCMonth):
-        (JSC::dateProtoFuncSetFullYear):
-        (JSC::dateProtoFuncSetUTCFullYear):
-        (JSC::dateProtoFuncSetYear):
-        (JSC::dateProtoFuncGetYear):
-        (JSC::dateProtoFuncToJSON):
-        * runtime/Error.cpp:
-        (JSC::createError):
-        (JSC::createEvalError):
-        (JSC::createRangeError):
-        (JSC::createReferenceError):
-        (JSC::createSyntaxError):
-        (JSC::createTypeError):
-        (JSC::createURIError):
-        (JSC::addErrorSourceInfo):
-        (JSC::addErrorDivotInfo):
-        (JSC::addErrorInfo):
-        (JSC::hasErrorInfo):
-        (JSC::throwError):
-        (JSC::throwTypeError):
-        (JSC::throwSyntaxError):
-        * runtime/Error.h:
-        (JSC::throwVMError):
-        (JSC::throwVMTypeError):
-        * runtime/ErrorConstructor.cpp:
-        (JSC::constructWithErrorConstructor):
-        (JSC::callErrorConstructor):
-        * runtime/ErrorConstructor.h:
         * runtime/ErrorInstance.cpp:
-        (JSC::ErrorInstance::ErrorInstance):
-        (JSC::ErrorInstance::create):
-        * runtime/ErrorInstance.h:
-        * runtime/ErrorPrototype.cpp:
-        (JSC::ErrorPrototype::ErrorPrototype):
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createStackOverflowError):
-        (JSC::createUndefinedVariableError):
-        (JSC::createInvalidParamError):
-        (JSC::createNotAConstructorError):
-        (JSC::createNotAFunctionError):
-        (JSC::createNotAnObjectError):
-        (JSC::throwOutOfMemoryError):
-        * runtime/ExceptionHelpers.h:
-        * runtime/Executable.cpp:
-        (JSC::EvalExecutable::compile):
-        (JSC::ProgramExecutable::checkSyntax):
-        (JSC::ProgramExecutable::compile):
-        * runtime/FunctionConstructor.cpp:
-        (JSC::constructFunction):
-        * runtime/FunctionPrototype.cpp:
-        (JSC::functionProtoFuncToString):
-        (JSC::functionProtoFuncApply):
-        (JSC::functionProtoFuncCall):
-        * runtime/Identifier.cpp:
-        (JSC::Identifier::from):
-        * runtime/Identifier.h:
+        * runtime/InternalFunction.cpp:
+        * runtime/JSActivation.cpp:
         * runtime/JSArray.cpp:
-        (JSC::JSArray::put):
         * runtime/JSFunction.cpp:
-        (JSC::callHostFunctionAsConstructor):
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::encode):
-        (JSC::decode):
-        (JSC::globalFuncEval):
         * runtime/JSONObject.cpp:
-        (JSC::Stringifier::appendStringifiedValue):
-        (JSC::Walker::walk):
-        (JSC::JSONProtoFuncParse):
-        (JSC::JSONProtoFuncStringify):
-        * runtime/JSObject.cpp:
-        (JSC::throwSetterError):
-        (JSC::JSObject::put):
-        (JSC::JSObject::putWithAttributes):
-        (JSC::JSObject::defaultValue):
-        (JSC::JSObject::hasInstance):
-        (JSC::JSObject::defineOwnProperty):
         * runtime/JSObject.h:
-        * runtime/JSValue.cpp:
-        (JSC::JSValue::toObjectSlowCase):
-        (JSC::JSValue::synthesizeObject):
-        (JSC::JSValue::synthesizePrototype):
+        * runtime/JSZombie.h:
+        * runtime/MathObject.cpp:
         * runtime/NativeErrorConstructor.cpp:
-        (JSC::constructWithNativeErrorConstructor):
-        (JSC::callNativeErrorConstructor):
-        * runtime/NativeErrorConstructor.h:
-        * runtime/NumberPrototype.cpp:
-        (JSC::numberProtoFuncToString):
-        (JSC::numberProtoFuncToLocaleString):
-        (JSC::numberProtoFuncValueOf):
-        (JSC::numberProtoFuncToFixed):
-        (JSC::numberProtoFuncToExponential):
-        (JSC::numberProtoFuncToPrecision):
-        * runtime/ObjectConstructor.cpp:
-        (JSC::objectConstructorGetPrototypeOf):
-        (JSC::objectConstructorGetOwnPropertyDescriptor):
-        (JSC::objectConstructorGetOwnPropertyNames):
-        (JSC::objectConstructorKeys):
-        (JSC::toPropertyDescriptor):
-        (JSC::objectConstructorDefineProperty):
-        (JSC::objectConstructorDefineProperties):
-        (JSC::objectConstructorCreate):
-        * runtime/ObjectPrototype.cpp:
-        (JSC::objectProtoFuncDefineGetter):
-        (JSC::objectProtoFuncDefineSetter):
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberObject.cpp:
         * runtime/RegExpConstructor.cpp:
-        (JSC::constructRegExp):
         * runtime/RegExpObject.cpp:
-        (JSC::RegExpObject::match):
-        * runtime/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncTest):
-        (JSC::regExpProtoFuncExec):
-        (JSC::regExpProtoFuncCompile):
-        (JSC::regExpProtoFuncToString):
+        * runtime/StringObject.cpp:
         * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncToString):
-
-2010-06-05  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Eric Seidel.
 
-        [BREWMP] Add PLATFORM(BREWMP) guard for using std::xxx
-        https://bugs.webkit.org/show_bug.cgi?id=39710
+2011-02-21  Adam Roben  <aroben@apple.com>
 
-        Build fix for BREW MP.
-
-        * wtf/MathExtras.h:
-
-2010-06-04  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Adler.
+        Export JSObject::s_info from JavaScriptCore.dll
 
-        HTML5 parser should be within 1% of old parser performance
-        https://bugs.webkit.org/show_bug.cgi?id=40172
+        This matches what we do for all other ClassInfo objects that WebCore needs access to.
 
-        Fix cast in this operator= to allow for assignment between vectors with
-        different inline capacities (as clearly intended by its author).
+        Fixes <http://webkit.org/b/54881> REGRESSION (r79132): Lots of tests crashing in
+        JSCell::inherits on Windows
 
-        * wtf/Vector.h:
-        (WTF::::operator):
+        Reviewed by Sam Weinig.
 
-2010-06-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+        * runtime/JSObject.h: Added JS_EXPORTDATA to s_info.
 
-        Reviewed by Kenneth Rohde Christiansen.
+2011-02-21  Kristian Amlie  <kristian.amlie@nokia.com>
 
-        New QtScript API; QScriptValue::instanceOf.
+        Reviewed by Andreas Kling.
 
-        New function create an easy way to check value's prototype hierarchy.
+        Switched to compiler based detection, where the error actually is.
 
-        [Qt] QScriptValue should have an instanceOf method
-        https://bugs.webkit.org/show_bug.cgi?id=40120
+        It is not the platform that needs the workaround, it is the compiler.
 
-        * qt/api/qscriptvalue.cpp:
-        (QScriptValue::instanceOf):
-        * qt/api/qscriptvalue.h:
-        * qt/api/qscriptvalue_p.h:
-        (QScriptValuePrivate::instanceOf):
-        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
-        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_comparison.cpp:
-        (tst_QScriptValue::instanceOf_initData):
-        (tst_QScriptValue::instanceOf_makeData):
-        (tst_QScriptValue::instanceOf_test):
+        QtWebKit fails to compile on Windows XP with msvc-2008
+        https://bugs.webkit.org/show_bug.cgi?id=54746
 
-2010-06-04  Gavin Barraclough  <barraclough@apple.com>
+        * bytecode/CodeBlock.h:
+        * runtime/RegExpObject.h:
 
-        Reviewed by NOBODY (interpreter build fix).
+2011-02-20  Gavin Barraclough  <barraclough@apple.com>
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
+        Reviewed by Oliver Hunt.
 
-2010-06-04  Mark Rowe  <mrowe@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=54839
+        Remove PrototypeFunction, NativeFunctionWrapper, and GlobalEvalFunction.
 
-        Silence some warnings seen on the build bot.
+        Historically, Native functions used to be represented by PrototypeFunctions, however
+        since introducing call optimizations to the JIT this has used JSFunctions for host
+        calls too. At the point this change was made, the interpreter continued to use
+        PrototypeFunctions, however since fallback from the JIT to interpreter was introduced
+        the interpreter has had to be able to run using host functions represented using
+        JSFunctions - leading to an unnecessary and redundant divergence in behaviour between 
+        interpreter only builds, and situations where the JIT has fallen back to interpreting.
 
-        * JavaScriptCore.JSVALUE32_64only.exp: Add a trailing newline.
-        * JavaScriptCore.JSVALUE32only.exp: Ditto.
-        * JavaScriptCore.JSVALUE64only.exp: Ditto.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Remove the .exp files from all targets so that Xcode doesn't
-        complain about not knowing how to compile them.
+        NativeFunctionWrapper only existed to select between PrototypeFunction and JSFunction
+        for wrappers for host functions, and as such can also be removed.
 
-2010-06-04  Gavin Barraclough  <barraclough@apple.com>
+        GlobalEvalFunction is a redundant wrapper that happens to be derived from
+        PrototypeFunction. It existed to hold a reference to the global object - but since all
+        functions how derive from JSObjectWithGlobalObject, this no longer requires an
+        additional class to provide this functionality.
 
-        Reviewed by Oliver Hunt.
+        * JavaScriptCore.JSVALUE32_64only.exp:
+        * JavaScriptCore.JSVALUE64only.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            Removed symbols / references to files.
 
-        Bug 40187 - Change function signature of NativeConstructor to match NativeFunction
+        * runtime/GlobalEvalFunction.cpp: Removed.
+        * runtime/GlobalEvalFunction.h: Removed.
+        * runtime/NativeFunctionWrapper.h: Removed.
+        * runtime/PrototypeFunction.cpp: Removed.
+        * runtime/PrototypeFunction.h: Removed.
+            Removed.
 
-        Mostly for consistency, but constructor & args arguments are redundant,
-        and this will help if we wish to be able to JIT calls to more constructors.
+        * runtime/Executable.cpp:
+        (JSC::NativeExecutable::~NativeExecutable):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::JSFunction::nativeFunction):
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getCallData):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::getCTIStub):
+            Added interpreter-friendly constructors for NativeExecutables.
 
-        * API/JSCallbackConstructor.cpp:
-        (JSC::constructJSCallback):
-        * API/JSCallbackObject.h:
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::construct):
+        * bytecompiler/BytecodeGenerator.cpp:
         * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::executeConstruct):
-        * interpreter/Interpreter.h:
         * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
         * runtime/ArrayConstructor.cpp:
-        (JSC::constructWithArrayConstructor):
-        * runtime/BooleanConstructor.cpp:
-        (JSC::constructWithBooleanConstructor):
-        * runtime/ConstructData.cpp:
-        (JSC::construct):
-        * runtime/ConstructData.h:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/BooleanPrototype.h:
+        * runtime/CallData.h:
         * runtime/DateConstructor.cpp:
-        (JSC::constructWithDateConstructor):
-        * runtime/Error.cpp:
-        (JSC::constructNativeError):
-        (JSC::Error::create):
-        * runtime/ErrorConstructor.cpp:
-        (JSC::constructWithErrorConstructor):
-        * runtime/FunctionConstructor.cpp:
-        (JSC::constructWithFunctionConstructor):
-        * runtime/NativeErrorConstructor.cpp:
-        (JSC::constructWithNativeErrorConstructor):
-        * runtime/NativeErrorConstructor.h:
-        (JSC::NativeErrorConstructor::errorStructure):
-        * runtime/NumberConstructor.cpp:
-        (JSC::constructWithNumberConstructor):
+        * runtime/DateConstructor.h:
+        * runtime/ErrorPrototype.cpp:
+        * runtime/ErrorPrototype.h:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/FunctionPrototype.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/Lookup.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/NumberPrototype.h:
         * runtime/ObjectConstructor.cpp:
-        (JSC::constructWithObjectConstructor):
-        * runtime/RegExpConstructor.cpp:
-        (JSC::constructWithRegExpConstructor):
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/RegExpPrototype.h:
+        * runtime/SmallStrings.h:
         * runtime/StringConstructor.cpp:
-        (JSC::constructWithStringConstructor):
-
-2010-06-04  Tony Gentilcore  <tonyg@chromium.org>
-
-        Reviewed by Adam Barth.
+        * runtime/StringConstructor.h:
+            Removed use of redundant classes.
 
-        Add a takeFirst() method to Deque and use it where appropriate.
-        https://bugs.webkit.org/show_bug.cgi?id=40089
+2011-02-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        * wtf/Deque.h:
-        (WTF::::takeFirst):
-        * wtf/MainThread.cpp:
-        (WTF::dispatchFunctionsFromMainThread):
-        * wtf/MessageQueue.h:
-        (WTF::::tryGetMessage):
+        Unreviewed build fix for Symbian.
 
-2010-06-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
+        [Symbian] Revert the removal of linking 
+        against hal after r79126.
 
-        Remove a QEXPECT_FAIL flag from an autotest.
+        Dependency on the hal library can not be removed 
+        as it is still used (e.g. in MarkStackSymbian.cpp).
 
-        Test tst_QScriptEngine::globalObject pass after 36600 bug
-        fix have been applied.
-
-        [Qt] Expected fail in the tst_QScriptEngine::globalObject should be removed.
-        https://bugs.webkit.org/show_bug.cgi?id=40114
-
-        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
-        (tst_QScriptEngine::globalObject):
-
-2010-06-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
-
-        Reviewed by Kenneth Rohde Christiansen.
-
-        Fix QScriptValue::equals.
-
-        Handling for a few edge cases were added. Now comparison between
-        NaN, an invalid objects should works as supposed.
-
-        [Qt] QScriptValue::equals problems
-        https://bugs.webkit.org/show_bug.cgi?id=40110
-
-        * qt/api/qscriptvalue.cpp:
-        (QScriptValue::equals):
-        * qt/api/qscriptvalue_p.h:
-        (QScriptValuePrivate::equals):
-        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
-        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_comparison.cpp:
-        (tst_QScriptValue::equals_initData):
-        (tst_QScriptValue::equals_makeData):
-        (tst_QScriptValue::equals_test):
+        * JavaScriptCore.pri:
 
-2010-06-03  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+2011-02-19  Gavin Barraclough  <barraclough@apple.com>
 
-        Reviewed by Kenneth Rohde Christiansen.
-
-        New states in QScriptValuePrivate.
+        Interpreter build fix.
 
-        The CSpecial state was divided into CNull and CUndefined. It simplify
-        the QScriptValue code by avoiding a few "cast" and "if".
-        Moreover the MSVS compiler didn't like casting between a double and an
-        enum which is avoided now.
+        * runtime/ArrayConstructor.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/ErrorPrototype.cpp:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/Lookup.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/StringConstructor.cpp:
 
-        [Qt] The QScriptValuePrivate::CSpecial is too generic.
-        https://bugs.webkit.org/show_bug.cgi?id=40067
+2011-02-19  Gavin Barraclough  <barraclough@apple.com>
 
-        * qt/api/qscriptvalue_p.h:
-        (QScriptValuePrivate::):
-        (QScriptValuePrivate::QScriptValuePrivate):
-        (QScriptValuePrivate::isNull):
-        (QScriptValuePrivate::isUndefined):
-        (QScriptValuePrivate::toString):
-        (QScriptValuePrivate::toNumber):
-        (QScriptValuePrivate::toBool):
-        (QScriptValuePrivate::toObject):
-        (QScriptValuePrivate::assignEngine):
-        (QScriptValuePrivate::isNumberBased):
+        Build fix!!
 
-2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+        * JavaScriptCore.exp:
 
-        Reviewed by NOBODY (Qt build fix).
+2011-02-19  Gavin Barraclough  <barraclough@apple.com>
 
-        * wtf/Platform.h:
+        Windows build fix!!
 
-2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 
-        Reviewed by Mark Rowe.
+2011-02-19  Gavin Barraclough  <barraclough@apple.com>
 
-        Bug 40150 - ENABLE_JIT_OPTIMIZE_NATIVE_CALL on all x86/x86_64 platforms
-        This was fixed in bug #40094.
+        Windows build fix!
 
         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-        * wtf/Platform.h:
-
-2010-06-03  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by NOBODY (Interpreter build fix).
 
-        * JavaScriptCore.JSVALUE32_64only.exp:
-        * JavaScriptCore.JSVALUE32only.exp:
-        * JavaScriptCore.JSVALUE64only.exp:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
+2011-02-19  Gavin Barraclough  <barraclough@apple.com>
 
-2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+        Build fix!
 
-        Reviewed by NOBODY (windows build fix II).
+        * JavaScriptCore.exp:
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+2011-02-18  Gavin Barraclough  <barraclough@apple.com>
 
-2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+        Reviewed by Sam Weinig.
 
-        Reviewed by NOBODY (windows build fix).
+        Bug 54786 - Devirtualize JSCell::classInfo()
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Instead of making a virtual function call, add a pointer to the ClassInfo
+        onto Structure.
 
-2010-06-02  Gavin Barraclough  <barraclough@apple.com>
+        This removes a virtual function call, and paves the way towards removing all
+        the createStructure methods, and StructureFlags/AnonymousSlotCount properties
+        (these should be able to move onto ClassInfo).
 
-        Reviewed by Oliver Hunt.
+        Calls to Structure::create must now pass a pointer to the ClassInfo for the
+        structure. All objects now have a ClassInfo pointer, non-object cell types
+        still do not.
 
-        Bug 40094 - The return type of NativeFunction should be EncodedJSValue
-        On Windows & Linux, using JSVALUE32_64, EncodedJSValue is returned in registers, but JSValue is not.
+        Changes are most mechanical, involving three steps:
+            * Remove virtual classInfo() methods.
+            * Add &s_info parameter to calls to Structure::create.
+            * Rename ClassInfo static members on classes from 'info' to 's_info',
+              for consistency.
 
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
         * API/JSCallbackFunction.cpp:
-        (JSC::JSCallbackFunction::call):
         * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.cpp:
         * API/JSCallbackObject.h:
         * API/JSCallbackObjectFunctions.h:
-        (JSC::::call):
+        * API/JSObjectRef.cpp:
+        * API/JSValueRef.cpp:
+        * API/JSWeakObjectMapRefPrivate.cpp:
         * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
         * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::executeCall):
+        * jit/JITCall32_64.cpp:
+        * jit/JITOpcodes.cpp:
         * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jit/JITStubs.h:
-        * jsc.cpp:
-        (functionPrint):
-        (functionDebug):
-        (functionGC):
-        (functionVersion):
-        (functionRun):
-        (functionLoad):
-        (functionCheckSyntax):
-        (functionSetSamplingFlags):
-        (functionClearSamplingFlags):
-        (functionReadline):
-        (functionQuit):
+        * profiler/Profiler.cpp:
+        * runtime/Arguments.cpp:
+        * runtime/Arguments.h:
         * runtime/ArrayConstructor.cpp:
-        (JSC::callArrayConstructor):
-        (JSC::arrayConstructorIsArray):
         * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncToString):
-        (JSC::arrayProtoFuncToLocaleString):
-        (JSC::arrayProtoFuncJoin):
-        (JSC::arrayProtoFuncConcat):
-        (JSC::arrayProtoFuncPop):
-        (JSC::arrayProtoFuncPush):
-        (JSC::arrayProtoFuncReverse):
-        (JSC::arrayProtoFuncShift):
-        (JSC::arrayProtoFuncSlice):
-        (JSC::arrayProtoFuncSort):
-        (JSC::arrayProtoFuncSplice):
-        (JSC::arrayProtoFuncUnShift):
-        (JSC::arrayProtoFuncFilter):
-        (JSC::arrayProtoFuncMap):
-        (JSC::arrayProtoFuncEvery):
-        (JSC::arrayProtoFuncForEach):
-        (JSC::arrayProtoFuncSome):
-        (JSC::arrayProtoFuncReduce):
-        (JSC::arrayProtoFuncReduceRight):
-        (JSC::arrayProtoFuncIndexOf):
-        (JSC::arrayProtoFuncLastIndexOf):
-        * runtime/BooleanConstructor.cpp:
-        (JSC::callBooleanConstructor):
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanObject.cpp:
+        * runtime/BooleanObject.h:
         * runtime/BooleanPrototype.cpp:
-        (JSC::booleanProtoFuncToString):
-        (JSC::booleanProtoFuncValueOf):
-        * runtime/CallData.h:
         * runtime/DateConstructor.cpp:
-        (JSC::callDate):
-        (JSC::dateParse):
-        (JSC::dateNow):
-        (JSC::dateUTC):
+        * runtime/DateInstance.cpp:
+        * runtime/DateInstance.h:
         * runtime/DatePrototype.cpp:
-        (JSC::dateProtoFuncToString):
-        (JSC::dateProtoFuncToUTCString):
-        (JSC::dateProtoFuncToISOString):
-        (JSC::dateProtoFuncToDateString):
-        (JSC::dateProtoFuncToTimeString):
-        (JSC::dateProtoFuncToLocaleString):
-        (JSC::dateProtoFuncToLocaleDateString):
-        (JSC::dateProtoFuncToLocaleTimeString):
-        (JSC::dateProtoFuncGetTime):
-        (JSC::dateProtoFuncGetFullYear):
-        (JSC::dateProtoFuncGetUTCFullYear):
-        (JSC::dateProtoFuncToGMTString):
-        (JSC::dateProtoFuncGetMonth):
-        (JSC::dateProtoFuncGetUTCMonth):
-        (JSC::dateProtoFuncGetDate):
-        (JSC::dateProtoFuncGetUTCDate):
-        (JSC::dateProtoFuncGetDay):
-        (JSC::dateProtoFuncGetUTCDay):
-        (JSC::dateProtoFuncGetHours):
-        (JSC::dateProtoFuncGetUTCHours):
-        (JSC::dateProtoFuncGetMinutes):
-        (JSC::dateProtoFuncGetUTCMinutes):
-        (JSC::dateProtoFuncGetSeconds):
-        (JSC::dateProtoFuncGetUTCSeconds):
-        (JSC::dateProtoFuncGetMilliSeconds):
-        (JSC::dateProtoFuncGetUTCMilliseconds):
-        (JSC::dateProtoFuncGetTimezoneOffset):
-        (JSC::dateProtoFuncSetTime):
-        (JSC::dateProtoFuncSetMilliSeconds):
-        (JSC::dateProtoFuncSetUTCMilliseconds):
-        (JSC::dateProtoFuncSetSeconds):
-        (JSC::dateProtoFuncSetUTCSeconds):
-        (JSC::dateProtoFuncSetMinutes):
-        (JSC::dateProtoFuncSetUTCMinutes):
-        (JSC::dateProtoFuncSetHours):
-        (JSC::dateProtoFuncSetUTCHours):
-        (JSC::dateProtoFuncSetDate):
-        (JSC::dateProtoFuncSetUTCDate):
-        (JSC::dateProtoFuncSetMonth):
-        (JSC::dateProtoFuncSetUTCMonth):
-        (JSC::dateProtoFuncSetFullYear):
-        (JSC::dateProtoFuncSetUTCFullYear):
-        (JSC::dateProtoFuncSetYear):
-        (JSC::dateProtoFuncGetYear):
-        (JSC::dateProtoFuncToJSON):
-        * runtime/ErrorConstructor.cpp:
-        (JSC::callErrorConstructor):
+        * runtime/DatePrototype.h:
+        * runtime/ErrorInstance.cpp:
+        * runtime/ErrorInstance.h:
         * runtime/ErrorPrototype.cpp:
-        (JSC::errorProtoFuncToString):
-        * runtime/FunctionConstructor.cpp:
-        (JSC::callFunctionConstructor):
         * runtime/FunctionPrototype.cpp:
-        (JSC::callFunctionPrototype):
-        (JSC::functionProtoFuncToString):
-        (JSC::functionProtoFuncApply):
-        (JSC::functionProtoFuncCall):
+        * runtime/FunctionPrototype.h:
+        * runtime/GetterSetter.h:
+        * runtime/GlobalEvalFunction.h:
+        * runtime/InternalFunction.cpp:
+        * runtime/InternalFunction.h:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.cpp:
         * runtime/JSCell.h:
-        (JSC::getCallData):
-        (JSC::getConstructData):
         * runtime/JSFunction.cpp:
-        (JSC::callHostFunctionAsConstructor):
         * runtime/JSFunction.h:
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncEval):
-        (JSC::globalFuncParseInt):
-        (JSC::globalFuncParseFloat):
-        (JSC::globalFuncIsNaN):
-        (JSC::globalFuncIsFinite):
-        (JSC::globalFuncDecodeURI):
-        (JSC::globalFuncDecodeURIComponent):
-        (JSC::globalFuncEncodeURI):
-        (JSC::globalFuncEncodeURIComponent):
-        (JSC::globalFuncEscape):
-        (JSC::globalFuncUnescape):
-        (JSC::globalFuncJSCPrint):
-        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.h:
         * runtime/JSONObject.cpp:
-        (JSC::JSONProtoFuncParse):
-        (JSC::JSONProtoFuncStringify):
+        * runtime/JSONObject.h:
         * runtime/JSObject.cpp:
-        (JSC::callDefaultValueFunction):
-        * runtime/JSValue.h:
+        * runtime/JSObject.h:
+        * runtime/JSObjectWithGlobalObject.h:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSString.h:
+        * runtime/JSVariableObject.h:
+        * runtime/JSWrapperObject.h:
+        * runtime/JSZombie.cpp:
+        * runtime/JSZombie.h:
+        * runtime/Lookup.cpp:
         * runtime/MathObject.cpp:
-        (JSC::mathProtoFuncAbs):
-        (JSC::mathProtoFuncACos):
-        (JSC::mathProtoFuncASin):
-        (JSC::mathProtoFuncATan):
-        (JSC::mathProtoFuncATan2):
-        (JSC::mathProtoFuncCeil):
-        (JSC::mathProtoFuncCos):
-        (JSC::mathProtoFuncExp):
-        (JSC::mathProtoFuncFloor):
-        (JSC::mathProtoFuncLog):
-        (JSC::mathProtoFuncMax):
-        (JSC::mathProtoFuncMin):
-        (JSC::mathProtoFuncPow):
-        (JSC::mathProtoFuncRandom):
-        (JSC::mathProtoFuncRound):
-        (JSC::mathProtoFuncSin):
-        (JSC::mathProtoFuncSqrt):
-        (JSC::mathProtoFuncTan):
+        * runtime/MathObject.h:
         * runtime/NativeErrorConstructor.cpp:
-        (JSC::callNativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
         * runtime/NumberConstructor.cpp:
-        (JSC::callNumberConstructor):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberObject.cpp:
+        * runtime/NumberObject.h:
         * runtime/NumberPrototype.cpp:
-        (JSC::numberProtoFuncToString):
-        (JSC::numberProtoFuncToLocaleString):
-        (JSC::numberProtoFuncValueOf):
-        (JSC::numberProtoFuncToFixed):
-        (JSC::numberProtoFuncToExponential):
-        (JSC::numberProtoFuncToPrecision):
         * runtime/ObjectConstructor.cpp:
-        (JSC::callObjectConstructor):
-        (JSC::objectConstructorGetPrototypeOf):
-        (JSC::objectConstructorGetOwnPropertyDescriptor):
-        (JSC::objectConstructorGetOwnPropertyNames):
-        (JSC::objectConstructorKeys):
-        (JSC::toPropertyDescriptor):
-        (JSC::objectConstructorDefineProperty):
-        (JSC::objectConstructorDefineProperties):
-        (JSC::objectConstructorCreate):
         * runtime/ObjectPrototype.cpp:
-        (JSC::objectProtoFuncValueOf):
-        (JSC::objectProtoFuncHasOwnProperty):
-        (JSC::objectProtoFuncIsPrototypeOf):
-        (JSC::objectProtoFuncDefineGetter):
-        (JSC::objectProtoFuncDefineSetter):
-        (JSC::objectProtoFuncLookupGetter):
-        (JSC::objectProtoFuncLookupSetter):
-        (JSC::objectProtoFuncPropertyIsEnumerable):
-        (JSC::objectProtoFuncToLocaleString):
-        (JSC::objectProtoFuncToString):
-        * runtime/ObjectPrototype.h:
         * runtime/RegExpConstructor.cpp:
-        (JSC::callRegExpConstructor):
+        * runtime/RegExpConstructor.h:
         * runtime/RegExpObject.cpp:
-        (JSC::callRegExpObject):
+        * runtime/RegExpObject.h:
         * runtime/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncTest):
-        (JSC::regExpProtoFuncExec):
-        (JSC::regExpProtoFuncCompile):
-        (JSC::regExpProtoFuncToString):
+        * runtime/ScopeChain.cpp:
         * runtime/StringConstructor.cpp:
-        (JSC::stringFromCharCode):
-        (JSC::callStringConstructor):
+        * runtime/StringObject.cpp:
+        * runtime/StringObject.h:
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
         * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncReplace):
-        (JSC::stringProtoFuncToString):
-        (JSC::stringProtoFuncCharAt):
-        (JSC::stringProtoFuncCharCodeAt):
-        (JSC::stringProtoFuncConcat):
-        (JSC::stringProtoFuncIndexOf):
-        (JSC::stringProtoFuncLastIndexOf):
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
-        (JSC::stringProtoFuncSlice):
-        (JSC::stringProtoFuncSplit):
-        (JSC::stringProtoFuncSubstr):
-        (JSC::stringProtoFuncSubstring):
-        (JSC::stringProtoFuncToLowerCase):
-        (JSC::stringProtoFuncToUpperCase):
-        (JSC::stringProtoFuncLocaleCompare):
-        (JSC::stringProtoFuncBig):
-        (JSC::stringProtoFuncSmall):
-        (JSC::stringProtoFuncBlink):
-        (JSC::stringProtoFuncBold):
-        (JSC::stringProtoFuncFixed):
-        (JSC::stringProtoFuncItalics):
-        (JSC::stringProtoFuncStrike):
-        (JSC::stringProtoFuncSub):
-        (JSC::stringProtoFuncSup):
-        (JSC::stringProtoFuncFontcolor):
-        (JSC::stringProtoFuncFontsize):
-        (JSC::stringProtoFuncAnchor):
-        (JSC::stringProtoFuncLink):
-        (JSC::stringProtoFuncTrim):
-        (JSC::stringProtoFuncTrimLeft):
-        (JSC::stringProtoFuncTrimRight):
-
-2010-06-02  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        Add value-representation specific sections to the mac export file.
+        * runtime/StringPrototype.h:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
 
-        * Configurations/JavaScriptCore.xcconfig:
-        * DerivedSources.make:
-        * JavaScriptCore.JSVALUE32_64only.exp: Added.
-        * JavaScriptCore.JSVALUE32only.exp: Added.
-        * JavaScriptCore.JSVALUE64only.exp: Added.
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+2011-02-19  David Kilzer  <ddkilzer@apple.com>
 
-2010-06-02  Mark Rowe  <mrowe@apple.com>
+        <http://webkit.org/b/54808> Change jsc target to build directly into JavaScriptCore.framework/Resources/jsc
 
-        Reviewed by Gavin Barraclough.
+        Reviewed by Dan Bernstein.
 
-        <rdar://problem/8054988> Work around an LLVM GCC code generation bug that results in crashes inside PCRE.
+        * Configurations/Base.xcconfig: Added
+        JAVASCRIPTCORE_FRAMEWORKS_DIR variable.
+        * Configurations/JavaScriptCore.xcconfig: Used
+        JAVASCRIPTCORE_FRAMEWORKS_DIR to define INSTALL_PATH.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Set the INSTALL_PATH
+        for Production configuration of jsc target.
+        (Copy Into Framework): Removed old build phase.
+        (Fix Framework Reference): Renamed build phase to "Copy Into
+        Framework".  Added "set -x" call to make the script print the
+        commands it is running.  Added code to exit early for Production
+        builds since this was never intended for them.  Added code to
+        copy jsc into the JavaScriptCore.framework/Resources directory.
+
+2011-02-19  Siddharth Mathur  <siddharth.mathur@nokia.com>
 
-        * pcre/pcre_exec.cpp:
-        (repeatInformationFromInstructionOffset): Change the type of instructionOffset to int.  There's no good
-        reason for it to be a short, and using int prevents this code from triggering the LLVM GCC bug.
+        Reviewed by Laszlo Gombos.
 
-2010-06-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+        [Symbian] OSAllocator implementation for Symbian OS. 
+        Manages both data and code region requests. V8 and Sunspider tested
+        OK with interpreter. Not tested with JSC JIT yet as it has unrelated
+        failures. Also no thread safety yet.
+        https://bugs.webkit.org/show_bug.cgi?id=51128
 
-        Reviewed by Kenneth Rohde Christiansen.
+        * JavaScriptCore.pri: removed HAL linkage
+        * wtf/Bitmap.h:
+        (WTF::::findRunOfZeros): find run of zeros in a bitmap. quick n dirty
+        * wtf/OSAllocator.h:
+        (WTF::OSAllocator::decommitAndRelease): decommit explicitly 
+        * wtf/OSAllocatorSymbian.cpp: Impl. of OSAllocator interface 
+        (WTF::allocateCodeChunk): utility for code chunks
+        (WTF::deallocateCodeChunk): utility for code chunks
+        (WTF::dataAllocatorInstance): getter for data allocator instance
+        (WTF::OSAllocator::reserveUncommitted):
+        (WTF::OSAllocator::releaseDecommitted):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::PageAllocatorSymbian::PageAllocatorSymbian): maps requests 
+        to one underlying Symbian chunk
+        (WTF::PageAllocatorSymbian::~PageAllocatorSymbian):
+        (WTF::PageAllocatorSymbian::reserve):
+        (WTF::PageAllocatorSymbian::release):
+        (WTF::PageAllocatorSymbian::commit):
+        (WTF::PageAllocatorSymbian::decommit):
+        (WTF::PageAllocatorSymbian::contains):
+        * wtf/PageAllocatorSymbian.h: Added.
+        (WTF::SymbianChunk::SymbianChunk): wrapper around RChunk  
+        (WTF::SymbianChunk::~SymbianChunk):
+        (WTF::SymbianChunk::contains):
+        
+2011-02-19  Yong Li  <yoli@rim.com>
 
-        Fix the QScriptValue::strictlyEquals function.
+        Reviewed by Eric Seidel.
 
-        Handling for a few edge cases was added.
+        https://bugs.webkit.org/show_bug.cgi?id=54687
+        When being built with armcc, "int" bit fields are treated as
+        unsigned integers, which will fail the comparisons like "m_offset == -1".
+        Using "signed" fixes the problem.
 
-        New autotest that covers the QScriptValue::strictlyEquals function.
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
 
-        [Qt] QScriptValue::strictlyEquals is broken
-        https://bugs.webkit.org/show_bug.cgi?id=36600
+2011-02-18  Geoffrey Garen  <ggaren@apple.com>
 
-        * qt/api/qscriptvalue.cpp:
-        (QScriptValue::strictlyEquals):
-        * qt/api/qscriptvalue_p.h:
-        (QScriptValuePrivate::strictlyEquals):
-        * qt/tests/qscriptvalue/qscriptvalue.pro:
-        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
-        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_comparison.cpp: Added.
-        (tst_QScriptValue::strictlyEquals_initData):
-        (tst_QScriptValue::strictlyEquals_makeData):
-        (tst_QScriptValue::strictlyEquals_test):
+        Reviewed by Sam Weinig.
 
-2010-06-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+        Made MarkedSpace block iteration size-class agnostic
+        https://bugs.webkit.org/show_bug.cgi?id=54792
+        
+        SunSpider reports no change.
 
-        Reviewed by Kenneth Rohde Christiansen.
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::clearMarks):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::size):
+        (JSC::MarkedSpace::capacity):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::forEach): Iterate blocks in hashing order instead of
+        size class list order. This is a much simpler convention in a world
+        of many different size classes.
 
-        New function QScriptEngine::newObject.
+2011-02-18  Kristian Amlie  <kristian.amlie@nokia.com>
 
-        The function creates a object of class Object and returns it
-        as a QScriptValue.
+        Reviewed by Andreas Kling.
 
-        [Qt] QScriptEngine API should contain a newObject function
-        https://bugs.webkit.org/show_bug.cgi?id=39114
+        Added friend exception to Qt platform, which also compiles Windows.
 
-        * qt/api/qscriptengine.cpp:
-        (QScriptEngine::newObject):
-        * qt/api/qscriptengine.h:
-        * qt/api/qscriptengine_p.cpp:
-        (QScriptEnginePrivate::newObject):
-        * qt/api/qscriptengine_p.h:
-        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
-        (tst_QScriptEngine::newObject):
+        QtWebKit fails to compile on Windows XP with msvc-2008
+        https://bugs.webkit.org/show_bug.cgi?id=54746
 
-2010-06-02  Gabor Loki  <loki@webkit.org>
+        * bytecode/CodeBlock.h:
+        * runtime/RegExpObject.h:
 
-        Reviewed by Gavin Barraclough.
-        https://bugs.webkit.org/show_bug.cgi?id=40011
+2011-02-18  Geoffrey Garen  <ggaren@apple.com>
 
-        Thumb-2 build fix: The offset parameter of ldrh should be encoded as an
-        imm12 immediate constant in load16. If it is not fit in the instruction
-        a temporary register has to be used.
+        (Rolled back in r79022 with crash fixed.)
 
-        * assembler/MacroAssemblerARMv7.h:
-        (JSC::MacroAssemblerARMv7::load16):
+        Reviewed by Sam Weinig.
 
-2010-06-02  Sterling Swigart  <sswigart@google.com>
+        Use hashing instead of linear search in the conservative pointer test
+        https://bugs.webkit.org/show_bug.cgi?id=54767
+        
+        SunSpider reports no change.
 
-        Reviewed by David Levin.
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy): No need to explicitly clear the blocks array,
+        since freeBlock removes items for us.
 
-        Image Resizer Patch 0: Added compilation argument to conditionally compile pending patches.
-        https://bugs.webkit.org/show_bug.cgi?id=39906
+        (JSC::MarkedSpace::freeBlock): Fixed a typo that always removed the last
+        block from the block set instead of the block being freed. Changed to
+        remove a block from our data structures before deallocating it, since
+        this is slightly cleaner.
 
-        * Configurations/FeatureDefines.xcconfig:
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::contains): Variable-sized objects will use more,
+        smaller blocks, so it's important for the contains check not to be O(n)
+        in the number of blocks.
 
-2010-06-01  Gavin Barraclough  <barraclough@apple.com>
+2011-02-18  chris reiss  <christopher.reiss@nokia.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Andreas Kling.
 
-        Bug 40021 - Refactor bytecode generation for calls so that register for this & args are allocated together
+        REGRESSION: Date.parse("Tue Nov 23 20:40:05 2010 GMT") returns NaN
+        https://bugs.webkit.org/show_bug.cgi?id=49989
 
-        This is a useful stepping stone towards reversing argument order.
+        updated test fast/js/script-tests/date-parse-test.js
 
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::addParameter):
-        (JSC::BytecodeGenerator::emitCall):
-        (JSC::BytecodeGenerator::emitCallEval):
-        (JSC::BytecodeGenerator::emitConstruct):
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::CallArguments::thisRegister):
-        (JSC::CallArguments::argumentRegister):
-        (JSC::CallArguments::callFrame):
-        (JSC::CallArguments::count):
-        (JSC::BytecodeGenerator::shouldEmitProfileHooks):
-        * bytecompiler/NodesCodegen.cpp:
-        (JSC::NewExprNode::emitBytecode):
-        (JSC::CallArguments::CallArguments):
-        (JSC::EvalFunctionCallNode::emitBytecode):
-        (JSC::FunctionCallValueNode::emitBytecode):
-        (JSC::FunctionCallResolveNode::emitBytecode):
-        (JSC::FunctionCallBracketNode::emitBytecode):
-        (JSC::FunctionCallDotNode::emitBytecode):
-        (JSC::CallFunctionCallDotNode::emitBytecode):
-        (JSC::ApplyFunctionCallDotNode::emitBytecode):
-
-2010-06-01  Yong Li  <yoli@rim.com>
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
 
-        Reviewed by Darin Adler.
+2011-02-18  Sheriff Bot  <webkit.review.bot@gmail.com>
 
-        Explicitly use PTHREAD_MUTEX_NORMAL to create pthread mutex.
-        https://bugs.webkit.org/show_bug.cgi?id=39893
+        Unreviewed, rolling out r79022.
+        http://trac.webkit.org/changeset/79022
+        https://bugs.webkit.org/show_bug.cgi?id=54775
 
-        * wtf/ThreadingPthreads.cpp:
-        (WTF::Mutex::Mutex):
+        It broke the whole world (Requested by Ossy on #webkit).
 
-2010-06-01  Kwang Yul Seo  <skyul@company100.net>
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::contains):
 
-        Reviewed by Xan Lopez.
+2011-02-18  Yael Aharon  <yael.aharon@nokia.com>
 
-        [GTK] Use DEFINE_STATIC_LOCAL for threadMapMutex and threadMap
-        https://bugs.webkit.org/show_bug.cgi?id=39831
+        Reviewed by Dave Hyatt.
 
-        Use DEFINE_STATIC_LOCAL for static local variables.
+        Add support for dir=auto
+        https://bugs.webkit.org/show_bug.cgi?id=50916
 
-        * wtf/gtk/ThreadingGtk.cpp:
-        (WTF::threadMapMutex):
-        (WTF::threadMap):
-        (WTF::identifierByGthreadHandle):
+        Change defaultWritingDirection() to return if the writing direction
+        was determined from a letter with strong directionality or not.
 
-2010-06-01  Kent Tamura  <tkent@chromium.org>
+        * JavaScriptCore.exp:
+        * JavaScriptCore.order:
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::defaultWritingDirection):
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.h:
+        (WTF::String::defaultWritingDirection):
 
-        Reviewed by Shinichiro Hamaji.
+2011-02-18  Geoffrey Garen  <ggaren@apple.com>
 
-        Fix style errors of dtoa
-        https://bugs.webkit.org/show_bug.cgi?id=39972
+        Reviewed by Sam Weinig.
 
-        Fix all errors reported by check-webkit-style.
+        Use hashing instead of linear search in the conservative pointer test
+        https://bugs.webkit.org/show_bug.cgi?id=54767
+        
+        SunSpider reports no change.
 
-        * wtf/dtoa.cpp:
-        * wtf/dtoa.h:
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::contains): Variable-sized objects will use more,
+        smaller blocks, so it's important for the contains check not to be O(n)
+        in the number of blocks.
 
-2010-05-30  Darin Adler  <darin@apple.com>
+2011-02-18  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
 
-        * wtf/OwnArrayPtr.h:
-        (WTF::OwnArrayPtr::set): Fix the assertion in here to match the one in OwnPtr.
-        At some point someone fixed the "asserts when assigning to 0 and the pointer is
-        already 0" issue in OwnPtr but forgot to do it here.
-
-2010-05-29  Geoffrey Garen  <ggaren@apple.com>
-
-        Windows build fix: Updated exported symbols.
+        Tightened some usage accounting code in MarkedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=54761
         
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
-
-2010-05-29  Geoffrey Garen  <ggaren@apple.com>
-
-        Disabled ENABLE_JIT_OPTIMIZE_NATIVE_CALL on Windows for now, until I
-        can figure out why it's crashing.
-
-        * wtf/Platform.h:
+        SunSpider reports no change.
 
-2010-05-29  Geoffrey Garen  <ggaren@apple.com>
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap): Initialize the marked space high water mark on
+        construction, instead of relying on some implicit subtleties to make
+        not initializing it work out OK.
 
-        Fixed Windows crash seen on buildbot.
+        * runtime/Heap.h: Fixed up includes.
 
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTINativeCall): __fastcall puts the first
-        argument in ecx.
+        * runtime/MarkedBlock.h: Made firstAtom() static so clients can call it
+        even without having allocated a block.
 
-2010-05-28  Geoffrey Garen  <ggaren@apple.com>
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace): Don't pre-allocate a block, since this
+        would be prohibitively expensive with multiple size classes.
 
-        Windows build fix: Updated exported symbols.
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlock): Track allocated blocks in a hash set,
+        since linear search in the contains check will be prohibitively
+        expensive once we're using lots of smaller blocks.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        (JSC::MarkedSpace::allocate): Don't assume that we always have a block
+        allocated, since we don't anymore. (See above.)
 
-2010-05-28  Geoffrey Garen  <ggaren@apple.com>
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h: Updated for changes mentioned above.
 
-        Qt build fix: disable a little more stuff when JIT_OPTIMIZE_NATIVE_CALL
-        is disabled.
+2011-02-17  Geoffrey Garen  <ggaren@apple.com>
 
-        * runtime/Lookup.cpp:
-        (JSC::setUpStaticFunctionSlot):
-        * runtime/Lookup.h:
-        * wtf/Platform.h:
+        Reviewed by Sam Weinig.
 
-2010-05-28  Geoffrey Garen  <ggaren@apple.com>
+        Made object allocation secretly variable-sized (Shhhh!)
+        https://bugs.webkit.org/show_bug.cgi?id=54721
+        
+        SunSpider reports no change.
+        
+        Internally, MarkedBlock now makes variable-sized allocations, even
+        though MarkedSpace doesn't take advantage of this yet.
 
-        Windows build fix: Updated exported symbols.
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock): No need to ASSERT that allocations are
+        fixed-sized.
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/MarkedBlock.h: Shrunk the atom size so we can allocate things
+        that are not multiples of 64 bytes.
 
-2010-05-28  Geoffrey Garen  <ggaren@apple.com>
+2011-02-17  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Sam Weinig, Gavin Barraclough, Oliver Hunt.
+        Reviewed by Sam Weinig.
 
-        Simplified the host calling convention.
+        Fixed some math errors when when using variable-sized cells
+        https://bugs.webkit.org/show_bug.cgi?id=54717
         
-        22.5% speedup on 32-bit host function calls. 9.5% speedup on 64-bit host
-        function calls.
-        
-        No change on SunSpider.
-        
-        All JS calls (but not constructs, yet) now go through the normal JS
-        calling convention via the RegisterFile. As a result, the host calling
-        convention, which used to be this
-
-            JSValue (JSC_HOST_CALL *NativeFunction)(ExecState*, JSObject*, JSValue thisValue, const ArgList&)
-            
-        is now this
-
-            JSValue (JSC_HOST_CALL *NativeFunction)(ExecState*)
-            
-        Callee, 'this', and argument access all hapen relative to the ExecState*,
-        which is a pointer into the RegisterFile.
-        
-        This patch comes in two parts.
-        
-        PART ONE: Functional code changes.
+        SunSpider reports no change.
         
-        * wtf/Platform.h: Disabled optimized calls on platforms I didn't test.
-        We can re-enable once we verify that host calls on these platforms are
-        correct.
-
-        * debugger/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::functionName):
-        (JSC::DebuggerCallFrame::calculatedFunctionName): Updated for change to
-        ExecState::callee().
-
-        (JSC::DebuggerCallFrame::thisObject): Updated for removal of ExecState::thisValue().
-
-        * interpreter/CallFrame.cpp:
-        * interpreter/CallFrame.h:
-        (JSC::ExecState::callee):
-        (JSC::ExecState::scopeChain):
-        (JSC::ExecState::init): Changed callee() to be JSObject* instead of
-        JSFunction* -- now, it might be some other callable host object.
-
-        (JSC::ExecState::hostThisRegister):
-        (JSC::ExecState::hostThisValue):
-        (JSC::ExecState::argumentCount):
-        (JSC::ExecState::argumentCountIncludingThis):
-        (JSC::ExecState::argument):
-        (JSC::ExecState::setArgumentCountIncludingThis):
-        (JSC::ExecState::setCallee): Added convenient accessors for arguments
-        from within a host function. Removed thisValue() because it was too
-        tempting to use incorrectly, and it only had one or two clients, anyway.
+        Computer Science Barbie says, "Math is not so hard afterall!"
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::callEval): Updated for removal of ExecState::thisValue().
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate): Round up when calculating the
+        minimum number of atoms required for a cell, since rounding down
+        will get you splinched.
 
-        (JSC::Interpreter::throwException): Be sure to shrink the register file
-        before invoking the exception handler, to reduce the chances that the
-        handler will re-throw in the case of stack overflow. (Re-throwing is now
-        more likely than it used to be, since standardizing the calling convention
-        implicitly added stack overflow checks to some places where they used to be missing.)
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep):
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::forEach): Changed a bunch of != tests to < tests
+        because m_endAtom is actually a fuzzy end -- iterating from firstAtom()
+        may not hit m_endAtom exactly.
 
-        (JSC::Interpreter::execute): Clarified the scope of DynamicGlobalObjectScope.
-        Updated for CallFrame::init API change.
+2011-02-17  Geoffrey Garen  <ggaren@apple.com>
 
-        (JSC::Interpreter::executeCall): Clarified scope of DynamicGlobalObjectScope.
-        Updated for CallFrame::init API change. Added support for calling a host
-        function.
+        Reviewed by Sam Weinig.
 
-        (JSC::Interpreter::executeConstruct): Clarified scope of DynamicGlobalObjectScope.
-        Updated for CallFrame::init API change. 
+        A little more abstraction for MarkedSpace::contains
+        https://bugs.webkit.org/show_bug.cgi?id=54715
 
-        (JSC::Interpreter::prepareForRepeatCall): Updated for CallFrame::init API change. 
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::contains): Added a contains function, so MarkedSpace
+        doesn't have to know how MarkedBlock tracks containment internally.
 
-        (JSC::Interpreter::privateExecute): Updated for CallFrame::init API change.
-        Added some explicit JSValue(JSObject*) initialization, since relaxing
-        the JSFunction* restriction on callee has made register types more ambiguous.
-        Removed toThisObject() conversion, since all callees do it themselves now.
-        Updated host function call for new host function signature. Updated for
-        change to ExecState::argumentCount() API.
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::contains): Call through to MarkedBlock to figure out
+        if a cell that seems to be in a block is valid.
 
-        * interpreter/Register.h:
-        (JSC::Register::):
-        (JSC::Register::operator=):
-        (JSC::Register::function): Changed callee() to be JSObject* instead of
-        JSFunction* -- now, it might be some other callable host object.
+2011-02-17  Geoffrey Garen  <ggaren@apple.com>
 
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTINativeCall):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTINativeCall): Deleted a bunch of code that
-        set up the arguments to host functions -- all but one of the arguments
-        are gone now. This is the actual optimization.
+        Reviewed by Sam Weinig.
 
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION): Updated for ExecState and Register API
-        changes noted above. Removed toThisObject() conversion, since all callees
-        do it themselves now.
+        Removed the invariant that the last cell in a block is always marked
+        https://bugs.webkit.org/show_bug.cgi?id=54713
         
-        * runtime/ArgList.h:
-        (JSC::ArgList::ArgList): ArgList is getting close to unused. Added a
-        temporary shim for converting from ExecState* to ArgList where it's still
-        necessary.
-
-        * runtime/Arguments.h:
-        (JSC::Arguments::getArgumentsData):
-        (JSC::Arguments::Arguments): Updated for ExecState and Register API
-        changes noted above. 
-
-        * runtime/CallData.cpp:
-        (JSC::call): Changed call always to call Interpreter::executeCall, even
-        for host functions. This ensures that the normal calling convention is
-        set up in the RegsiterFile when calling from C++ to host function.
-
-        * runtime/CallData.h: Changed host function signature as described above.
-
-        * runtime/ConstructData.cpp:
-        (JSC::construct): Moved JSFunction::construct code here so I could nix
-        JSFunction::call and JSFunction::call. We want a JSFunction-agnostic
-        way to call and construct, so that everything works naturally for non-
-        JSFunction objects. 
-
-        * runtime/JSFunction.cpp:
-        (JSC::callHostFunctionAsConstructor):
-        * runtime/JSFunction.h: Updated for ExecState and Register API changes
-        noted above. Nixed JSFunction::call and JSFunction::construct, noted above.
- 
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init): Ditto.
-
-        PART TWO: Global search and replace.
+        SunSpider reports no change.
         
-        In the areas below, I used global search-and-replace to change
-            (ExecState*, JSObject*, JSValue, const ArgList&) => (ExecState*)
-            args.size() => exec->argumentCount()
-            args.at(i) => exec->argument(i)
+        This adds one branch to allocation, but simplifies the mark invariant,
+        especially in a world of variable-sized cells. Now, it really is true
+        that any cell whose mark bit is set is a valid, live cell whose
+        constructor has run and whose destructor has not run.
 
-        * API/JSCallbackFunction.cpp:
-        (JSC::JSCallbackFunction::call):
-        * API/JSCallbackFunction.h:
-        * API/JSCallbackObject.h:
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::call):
-        * JavaScriptCore.exp:
-        * jsc.cpp:
-        (functionPrint):
-        (functionDebug):
-        (functionGC):
-        (functionVersion):
-        (functionRun):
-        (functionLoad):
-        (functionCheckSyntax):
-        (functionSetSamplingFlags):
-        (functionClearSamplingFlags):
-        (functionReadline):
-        (functionQuit):
-        * runtime/ArrayConstructor.cpp:
-        (JSC::callArrayConstructor):
-        (JSC::arrayConstructorIsArray):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncToString):
-        (JSC::arrayProtoFuncToLocaleString):
-        (JSC::arrayProtoFuncJoin):
-        (JSC::arrayProtoFuncConcat):
-        (JSC::arrayProtoFuncPop):
-        (JSC::arrayProtoFuncPush):
-        (JSC::arrayProtoFuncReverse):
-        (JSC::arrayProtoFuncShift):
-        (JSC::arrayProtoFuncSlice):
-        (JSC::arrayProtoFuncSort):
-        (JSC::arrayProtoFuncSplice):
-        (JSC::arrayProtoFuncUnShift):
-        (JSC::arrayProtoFuncFilter):
-        (JSC::arrayProtoFuncMap):
-        (JSC::arrayProtoFuncEvery):
-        (JSC::arrayProtoFuncForEach):
-        (JSC::arrayProtoFuncSome):
-        (JSC::arrayProtoFuncReduce):
-        (JSC::arrayProtoFuncReduceRight):
-        (JSC::arrayProtoFuncIndexOf):
-        (JSC::arrayProtoFuncLastIndexOf):
-        * runtime/BooleanConstructor.cpp:
-        (JSC::callBooleanConstructor):
-        * runtime/BooleanPrototype.cpp:
-        (JSC::booleanProtoFuncToString):
-        (JSC::booleanProtoFuncValueOf):
-        * runtime/DateConstructor.cpp:
-        (JSC::callDate):
-        (JSC::dateParse):
-        (JSC::dateNow):
-        (JSC::dateUTC):
-        * runtime/DatePrototype.cpp:
-        (JSC::formatLocaleDate):
-        (JSC::fillStructuresUsingTimeArgs):
-        (JSC::fillStructuresUsingDateArgs):
-        (JSC::dateProtoFuncToString):
-        (JSC::dateProtoFuncToUTCString):
-        (JSC::dateProtoFuncToISOString):
-        (JSC::dateProtoFuncToDateString):
-        (JSC::dateProtoFuncToTimeString):
-        (JSC::dateProtoFuncToLocaleString):
-        (JSC::dateProtoFuncToLocaleDateString):
-        (JSC::dateProtoFuncToLocaleTimeString):
-        (JSC::dateProtoFuncGetTime):
-        (JSC::dateProtoFuncGetFullYear):
-        (JSC::dateProtoFuncGetUTCFullYear):
-        (JSC::dateProtoFuncToGMTString):
-        (JSC::dateProtoFuncGetMonth):
-        (JSC::dateProtoFuncGetUTCMonth):
-        (JSC::dateProtoFuncGetDate):
-        (JSC::dateProtoFuncGetUTCDate):
-        (JSC::dateProtoFuncGetDay):
-        (JSC::dateProtoFuncGetUTCDay):
-        (JSC::dateProtoFuncGetHours):
-        (JSC::dateProtoFuncGetUTCHours):
-        (JSC::dateProtoFuncGetMinutes):
-        (JSC::dateProtoFuncGetUTCMinutes):
-        (JSC::dateProtoFuncGetSeconds):
-        (JSC::dateProtoFuncGetUTCSeconds):
-        (JSC::dateProtoFuncGetMilliSeconds):
-        (JSC::dateProtoFuncGetUTCMilliseconds):
-        (JSC::dateProtoFuncGetTimezoneOffset):
-        (JSC::dateProtoFuncSetTime):
-        (JSC::setNewValueFromTimeArgs):
-        (JSC::setNewValueFromDateArgs):
-        (JSC::dateProtoFuncSetMilliSeconds):
-        (JSC::dateProtoFuncSetUTCMilliseconds):
-        (JSC::dateProtoFuncSetSeconds):
-        (JSC::dateProtoFuncSetUTCSeconds):
-        (JSC::dateProtoFuncSetMinutes):
-        (JSC::dateProtoFuncSetUTCMinutes):
-        (JSC::dateProtoFuncSetHours):
-        (JSC::dateProtoFuncSetUTCHours):
-        (JSC::dateProtoFuncSetDate):
-        (JSC::dateProtoFuncSetUTCDate):
-        (JSC::dateProtoFuncSetMonth):
-        (JSC::dateProtoFuncSetUTCMonth):
-        (JSC::dateProtoFuncSetFullYear):
-        (JSC::dateProtoFuncSetUTCFullYear):
-        (JSC::dateProtoFuncSetYear):
-        (JSC::dateProtoFuncGetYear):
-        (JSC::dateProtoFuncToJSON):
-        * runtime/ErrorConstructor.cpp:
-        (JSC::callErrorConstructor):
-        * runtime/ErrorPrototype.cpp:
-        (JSC::errorProtoFuncToString):
-        * runtime/FunctionConstructor.cpp:
-        (JSC::callFunctionConstructor):
-        * runtime/FunctionPrototype.cpp:
-        (JSC::callFunctionPrototype):
-        (JSC::functionProtoFuncToString):
-        (JSC::functionProtoFuncApply):
-        (JSC::functionProtoFuncCall):
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::encode):
-        (JSC::decode):
-        (JSC::globalFuncEval):
-        (JSC::globalFuncParseInt):
-        (JSC::globalFuncParseFloat):
-        (JSC::globalFuncIsNaN):
-        (JSC::globalFuncIsFinite):
-        (JSC::globalFuncDecodeURI):
-        (JSC::globalFuncDecodeURIComponent):
-        (JSC::globalFuncEncodeURI):
-        (JSC::globalFuncEncodeURIComponent):
-        (JSC::globalFuncEscape):
-        (JSC::globalFuncUnescape):
-        (JSC::globalFuncJSCPrint):
-        * runtime/JSGlobalObjectFunctions.h:
-        * runtime/JSONObject.cpp:
-        (JSC::JSONProtoFuncParse):
-        (JSC::JSONProtoFuncStringify):
-        * runtime/JSString.h:
-        * runtime/MathObject.cpp:
-        (JSC::mathProtoFuncAbs):
-        (JSC::mathProtoFuncACos):
-        (JSC::mathProtoFuncASin):
-        (JSC::mathProtoFuncATan):
-        (JSC::mathProtoFuncATan2):
-        (JSC::mathProtoFuncCeil):
-        (JSC::mathProtoFuncCos):
-        (JSC::mathProtoFuncExp):
-        (JSC::mathProtoFuncFloor):
-        (JSC::mathProtoFuncLog):
-        (JSC::mathProtoFuncMax):
-        (JSC::mathProtoFuncMin):
-        (JSC::mathProtoFuncPow):
-        (JSC::mathProtoFuncRandom):
-        (JSC::mathProtoFuncRound):
-        (JSC::mathProtoFuncSin):
-        (JSC::mathProtoFuncSqrt):
-        (JSC::mathProtoFuncTan):
-        * runtime/NativeErrorConstructor.cpp:
-        (JSC::callNativeErrorConstructor):
-        * runtime/NumberConstructor.cpp:
-        (JSC::callNumberConstructor):
-        * runtime/NumberPrototype.cpp:
-        (JSC::numberProtoFuncToString):
-        (JSC::numberProtoFuncToLocaleString):
-        (JSC::numberProtoFuncValueOf):
-        (JSC::numberProtoFuncToFixed):
-        (JSC::numberProtoFuncToExponential):
-        (JSC::numberProtoFuncToPrecision):
-        * runtime/ObjectConstructor.cpp:
-        (JSC::callObjectConstructor):
-        (JSC::objectConstructorGetPrototypeOf):
-        (JSC::objectConstructorGetOwnPropertyDescriptor):
-        (JSC::objectConstructorGetOwnPropertyNames):
-        (JSC::objectConstructorKeys):
-        (JSC::objectConstructorDefineProperty):
-        (JSC::objectConstructorDefineProperties):
-        (JSC::objectConstructorCreate):
-        * runtime/ObjectPrototype.cpp:
-        (JSC::objectProtoFuncValueOf):
-        (JSC::objectProtoFuncHasOwnProperty):
-        (JSC::objectProtoFuncIsPrototypeOf):
-        (JSC::objectProtoFuncDefineGetter):
-        (JSC::objectProtoFuncDefineSetter):
-        (JSC::objectProtoFuncLookupGetter):
-        (JSC::objectProtoFuncLookupSetter):
-        (JSC::objectProtoFuncPropertyIsEnumerable):
-        (JSC::objectProtoFuncToLocaleString):
-        (JSC::objectProtoFuncToString):
-        * runtime/ObjectPrototype.h:
-        * runtime/Operations.h:
-        (JSC::jsString):
-        * runtime/RegExpConstructor.cpp:
-        (JSC::callRegExpConstructor):
-        * runtime/RegExpObject.cpp:
-        (JSC::RegExpObject::test):
-        (JSC::RegExpObject::exec):
-        (JSC::callRegExpObject):
-        (JSC::RegExpObject::match):
-        * runtime/RegExpObject.h:
-        * runtime/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncTest):
-        (JSC::regExpProtoFuncExec):
-        (JSC::regExpProtoFuncCompile):
-        (JSC::regExpProtoFuncToString):
-        * runtime/StringConstructor.cpp:
-        (JSC::stringFromCharCodeSlowCase):
-        (JSC::stringFromCharCode):
-        (JSC::callStringConstructor):
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncReplace):
-        (JSC::stringProtoFuncToString):
-        (JSC::stringProtoFuncCharAt):
-        (JSC::stringProtoFuncCharCodeAt):
-        (JSC::stringProtoFuncConcat):
-        (JSC::stringProtoFuncIndexOf):
-        (JSC::stringProtoFuncLastIndexOf):
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
-        (JSC::stringProtoFuncSlice):
-        (JSC::stringProtoFuncSplit):
-        (JSC::stringProtoFuncSubstr):
-        (JSC::stringProtoFuncSubstring):
-        (JSC::stringProtoFuncToLowerCase):
-        (JSC::stringProtoFuncToUpperCase):
-        (JSC::stringProtoFuncLocaleCompare):
-        (JSC::stringProtoFuncBig):
-        (JSC::stringProtoFuncSmall):
-        (JSC::stringProtoFuncBlink):
-        (JSC::stringProtoFuncBold):
-        (JSC::stringProtoFuncFixed):
-        (JSC::stringProtoFuncItalics):
-        (JSC::stringProtoFuncStrike):
-        (JSC::stringProtoFuncSub):
-        (JSC::stringProtoFuncSup):
-        (JSC::stringProtoFuncFontcolor):
-        (JSC::stringProtoFuncFontsize):
-        (JSC::stringProtoFuncAnchor):
-        (JSC::stringProtoFuncLink):
-        (JSC::stringProtoFuncTrim):
-        (JSC::stringProtoFuncTrimLeft):
-        (JSC::stringProtoFuncTrimRight):
-
-2010-05-28  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+        * runtime/JSCell.h: 
+        (JSC::JSCell::MarkedBlock::allocate): Changed this do-while into a while
+        since we can no longer rely on a set mark bit to break out of this loop
+        before it reaches the end of the block.
 
-        Reviewed by Geoffrey Garen.
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep): 
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::markCount):
+        (JSC::MarkedBlock::forEach): No need to set a special last mark bit.
 
-        Fix the JSObjectSetPrototype function.
+2011-02-17  Sheriff Bot  <webkit.review.bot@gmail.com>
 
-        A cycle in a prototype chain can cause an application hang or
-        even crash.
-        A check for a prototype chain cycles was added to
-        the JSObjectSetPrototype.
+        Unreviewed, rolling out r78856 and r78907.
+        http://trac.webkit.org/changeset/78856
+        http://trac.webkit.org/changeset/78907
+        https://bugs.webkit.org/show_bug.cgi?id=54705
 
-        JSObjectSetPrototype doesn't check for cycle in prototype chain.
-        https://bugs.webkit.org/show_bug.cgi?id=39360
+        These seem to break tests on 32-bit builds. (Requested by
+        aroben on #webkit).
 
-        * API/JSObjectRef.cpp:
-        (JSObjectSetPrototype):
-        * API/tests/testapi.c:
-        (assertTrue):
-        (checkForCycleInPrototypeChain):
-        (main):
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::put):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * collector/handles/Global.h:
+        (JSC::Global::internalSet):
+        * collector/handles/Handle.h:
+        (JSC::HandleTypes::getFromSlot):
+        (JSC::HandleTypes::toJSValue):
+        (JSC::HandleTypes::validateUpcast):
+        (JSC::HandleConverter::operator->):
+        (JSC::HandleConverter::operator*):
+        (JSC::Handle::Handle):
+        (JSC::Handle::get):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sortNumeric):
         * runtime/JSObject.h:
-        (JSC::JSObject::setPrototypeWithCycleCheck):
-
-2010-05-28  Chao-ying Fu  <fu@mips.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix MIPS JIT DoubleGreaterThanOrEqual Operands
-        https://bugs.webkit.org/show_bug.cgi?id=39504
-
-        Swapped two operands of left and right for DoubleGreaterThanOrEqual.
-        This patch fixed two layout tests as follows.
-        fast/js/comparison-operators-greater.html
-        fast/js/comparison-operators-less.html
-
-        * assembler/MacroAssemblerMIPS.h:
-        (JSC::MacroAssemblerMIPS::branchDouble):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        * runtime/SlotAccessor.h: Removed.
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::internalSet):
+        * runtime/WriteBarrier.h:
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::clear):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+        (JSC::WriteBarrier::WriteBarrier):
 
-2010-05-28  Gavin Barraclough  <barraclough@apple.com>
+2011-02-17  Csaba Osztrogonác  <ossy@webkit.org>
 
-        Reviewed by Geoff Garen.
+        Unreviewed.
 
-        Move jit compilation from linking thunks into cti_vm_lazyLink methods.
+        [Qt] Buildfix.
 
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
+        * wtf/RetainPtr.h: Add missing PLATFORM(CF) guard.
 
-2010-05-28  Gavin Barraclough  <barraclough@apple.com>
+2011-02-17  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Oliver Hunt.
 
-        Bug 39898 - Move arity check into callee.
+        Made MarkedBlock variable-sized
+        https://bugs.webkit.org/show_bug.cgi?id=54692
         
-        We can reduce the size of the virtual call trampolines by moving the arity check
-        into the callee functions.  As a following step we will be able to remove the
-        check for native function / codeblocks by performing translation in a lazy stub.
+        SunSpider reports no change.
         
-        * interpreter/CallFrame.h:
-        (JSC::ExecState::init):
-        (JSC::ExecState::setReturnPC):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile):
-        (JSC::JIT::linkCall):
-        (JSC::JIT::linkConstruct):
-        * jit/JIT.h:
-        (JSC::JIT::compile):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * runtime/Executable.cpp:
-        (JSC::FunctionExecutable::generateJITCodeForCall):
-        (JSC::FunctionExecutable::generateJITCodeForConstruct):
-        (JSC::FunctionExecutable::reparseExceptionInfo):
-        * runtime/Executable.h:
-        (JSC::NativeExecutable::NativeExecutable):
-        (JSC::FunctionExecutable::generatedJITCodeForCallWithArityCheck):
-        (JSC::FunctionExecutable::generatedJITCodeForConstructWithArityCheck):
-
-2010-05-27  Luiz Agostini  <luiz.agostini@openbossa.org>
-
-        Reviewed by Darin Adler.
-
-        UTF-16 code points compare() for String objects
-        https://bugs.webkit.org/show_bug.cgi?id=39701
-
-        Moving compare() implementation from UString to StringImpl for it to be shared
-        with String. Adding overloaded free functions codePointCompare() in StringImpl
-        and WTFString. Renaming function compare in UString to codePointCompare to be
-        consistent.
+        Each MarkedBlock is now composed of a set of fixed-sized atoms, with one
+        mark bit per atom. A given cell may be composed of one or more atoms.
+        
+        * runtime/Heap.cpp:
+        (JSC::Heap::allocate): Made fixed-sizedness a property of MarkedSpace,
+        bubbling it up from MarkedBlock, since MarkedBlock now supports variable-
+        sizedness.
 
-        * runtime/JSArray.cpp:
-        (JSC::compareByStringPairForQSort):
-        * runtime/UString.cpp:
-        * runtime/UString.h:
-        (JSC::codePointCompare):
-        * wtf/text/StringImpl.cpp:
-        (WebCore::codePointCompare):
-        * wtf/text/StringImpl.h:
-        * wtf/text/WTFString.cpp:
-        (WebCore::codePointCompare):
-        * wtf/text/WTFString.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate): Removed use of CELLS_PER_BLOCK and
+        (implicit) one constants -- these quantities are not constant anymore.
+        Updated for switch from cell to atom.
 
-2010-05-26  Darin Adler  <darin@apple.com>
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep):
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::firstAtom):
+        (JSC::MarkedBlock::atoms):
+        (JSC::MarkedBlock::isAtomAligned):
+        (JSC::MarkedBlock::blockFor):
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::size):
+        (JSC::MarkedBlock::capacity):
+        (JSC::MarkedBlock::atomNumber):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::testAndSetMarked):
+        (JSC::MarkedBlock::setMarked):
+        (JSC::MarkedBlock::forEach): Same as above. Also removed use of CELL_SIZE
+        and BLOCK_SIZE, and switched away from calling arbitrary pointers cells.
 
-        Reviewed by Kent Tamura.
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::CollectorHeap):
+        (JSC::MarkedSpace::contains): Updated for renames. Made fixed-sizedness
+        a property of MarkedSpace.
 
-        Null characters handled incorrectly in ToNumber conversion
-        https://bugs.webkit.org/show_bug.cgi?id=38088
+2011-02-17  Oliver Hunt  <oliver@apple.com>
 
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::parseInt): Changed code to use UTF8String().data() instead of
-        ascii() to fix the thread safety issue. Code path is covered by existing
-        tests in run-javascriptcore-tests.
-        (JSC::parseFloat): Moved comment to UString::toDouble since the issue
-        affects all clients, not just parseFloat. Specifically, this also affects
-        standard JavaScript numeric conversion, ToNumber.
+        Attempt to fix windows build
 
-        * runtime/UString.cpp:
-        (JSC::UString::toDouble): Added a comment about incorrect space skipping.
-        Changed trailing junk check to use the length of the CString instead of
-        checking for a null character. Also got rid of a little unneeded logic
-        in the case where we tolerate trailing junk.
+        * runtime/WriteBarrier.h:
 
-2010-05-27  Nathan Lawrence  <nlawrence@apple.com>
+2011-02-17  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Geoffrey Garen.
 
-        Search for the new allocation one word at a time.  Improves
-        performance on SunSpider by approximately 1%.
-        http://bugs.webkit.org/show_bug.cgi?id=39758
-
-        * runtime/Collector.cpp:
-        (JSC::Heap::allocate):
-        * runtime/Collector.h:
-        (JSC::CollectorBitmap::advanceToNextPossibleFreeCell):
-
-2010-05-27  Kevin Ollivier  <kevino@theolliviers.com>
-
-        [wx] Build fixes for Windows after recent changes.
-
-        * wscript:
-
-2010-05-27  Gustavo Noronha Silva  <gns@gnome.org>
-
-        More build fixage for make dist.
-
-        * GNUmakefile.am:
-
-2010-05-27  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Darin Adler.
-
-        RVCT does not have strnstr.
-        https://bugs.webkit.org/show_bug.cgi?id=39719
-
-        Add COMPILER(RVCT) guard to strnstr in StringExtras.h as RVCT does not provide strnstr.
+        Refactor WriteBarrier and DeprecatedPtr to have less code duplication.
+        https://bugs.webkit.org/show_bug.cgi?id=54608
 
-        * wtf/StringExtras.h:
+        Make use of the tricks used for Handle, et al to avoid duplicating all
+        of the logic for DeprecatedPtr and WriteBarrier simply to support known
+        vs. unknown types.
 
-2010-05-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 39795 - Add support for YARR JIT generation of greedy quantified parens at the end of the main disjunction.
-        (relanding r60267)
-
-        If the last item in a main disjunction is a quantified set of parentheses,
-        this is easier to code generate for than the general case for quantified
-        parentheses. This is because we never need to backtrack into the parentheses
-        - the first match will be the final and accepted match.
-
-        This patch also somewhat reverts a recent change to when fallback to PCRE
-        occurs. At the minute the compiler is tracking on patterns which will
-        require JIT fallback. This is handy from a performance perspective (it saves
-        the failed attempt at JIT compilation), but it means introducing knowledge
-        of the JITs capabilities into the other layers of the regex compilers. For
-        the specific feature of back-references, add a flag tracking their presence
-        on the pattern, and make these expressions fallback without attempting to
-        JIT. For parentheses, return to detecting which cases are have or have not
-        been handled during JIT compilation.
-
-        18% progression on tagcloud, ~1.5% overall on sunspidey.
-
-        * yarr/RegexCompiler.cpp:
-        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
-        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastTerm):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::isMainDisjunction):
-        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
-        (JSC::Yarr::RegexGenerator::generateTerm):
-        (JSC::Yarr::RegexGenerator::RegexGenerator):
-        (JSC::Yarr::RegexGenerator::shouldFallBack):
-        (JSC::Yarr::jitCompileRegex):
-        * yarr/RegexPattern.h:
-        (JSC::Yarr::RegexPattern::RegexPattern):
-        (JSC::Yarr::RegexPattern::reset):
-
-2010-05-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by NOBODY (revert).
-
-        Temporarily rolling out r60267, I appear to have hoesed perf at the last minute. :-/ Fixing.
-
-        * yarr/RegexCompiler.cpp:
-        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
-        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::TermGenerationState::term):
-        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
-        (JSC::Yarr::RegexGenerator::generateTerm):
-        (JSC::Yarr::RegexGenerator::RegexGenerator):
-        (JSC::Yarr::jitCompileRegex):
-        * yarr/RegexPattern.h:
-        (JSC::Yarr::RegexPattern::RegexPattern):
-        (JSC::Yarr::RegexPattern::reset):
-
-2010-05-26  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Build fixes for make distcheck.
-
-        * GNUmakefile.am:
-
-2010-05-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 39795 - Add support for YARR JIT generation of greedy quantified parens at the end of the main disjunction.
-
-        If the last item in a main disjunction is a quantified set of parentheses,
-        this is easier to code generate for than the general case for quantified
-        parentheses. This is because we never need to backtrack into the parentheses
-        - the first match will be the final and accepted match.
-
-        This patch also somewhat reverts a recent change to when fallback to PCRE
-        occurs. At the minute the compiler is tracking on patterns which will
-        require JIT fallback. This is handy from a performance perspective (it saves
-        the failed attempt at JIT compilation), but it means introducing knowledge
-        of the JITs capabilities into the other layers of the regex compilers. For
-        the specific feature of back-references, add a flag tracking their presence
-        on the pattern, and make these expressions fallback without attempting to
-        JIT. For parentheses, return to detecting which cases are have or have not
-        been handled during JIT compilation.
-
-        18% progression on tagcloud, ~1.5% overall on sunspidey.
-
-        * yarr/RegexCompiler.cpp:
-        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
-        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
-        * yarr/RegexJIT.cpp:
-        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastTerm):
-        (JSC::Yarr::RegexGenerator::TermGenerationState::isMainDisjunction):
-        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
-        (JSC::Yarr::RegexGenerator::generateTerm):
-        (JSC::Yarr::RegexGenerator::RegexGenerator):
-        (JSC::Yarr::RegexGenerator::shouldFallBack):
-        (JSC::Yarr::jitCompileRegex):
-        * yarr/RegexPattern.h:
-        (JSC::Yarr::RegexPattern::RegexPattern):
-        (JSC::Yarr::RegexPattern::reset):
-
-2010-05-26  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Fixed a crash seen on the Leopard bot, caused by merge.
-
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION): Get the return address from the callframe,
-        since it's no longer passed to us as an argument.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * collector/handles/Global.h:
+        (JSC::Global::internalSet):
+        * collector/handles/Handle.h:
+        (JSC::Handle::Handle):
+        (JSC::Handle::get):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sortNumeric):
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        * runtime/SlotAccessor.h: Added.
+        (JSC::SlotTypes::getFromBaseType):
+        (JSC::SlotTypes::convertToBaseType):
+        (JSC::SlotTypes::getFromSlot):
+        (JSC::SlotTypes::toJSValue):
+        (JSC::SlotTypes::validateUpcast):
+        (JSC::SlotAccessor::operator->):
+        (JSC::SlotAccessor::operator*):
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::internalSet):
+        * runtime/WriteBarrier.h:
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator=):
+        (JSC::WriteBarrierTranslator::convertToStorage):
+        (JSC::WriteBarrierTranslator::convertFromStorage):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::clear):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+        (JSC::WriteBarrier::WriteBarrier):
 
-2010-05-25  Geoffrey Garen  <ggaren@apple.com>
+2011-02-17  Kevin Ollivier  <kevino@theolliviers.com>
 
-        Fixed build failure caused by merge.
+        [wx] Revert incorrect blind fix and restore previous working code.
 
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION): On error, return a single value, since this
-        function no longer returns a pair.
+        * wtf/wx/StringWx.cpp:
+        (WTF::String::String):
 
-2010-05-25  Geoffrey Garen  <ggaren@apple.com>
+2011-02-16  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Maciej Stachowiak.
 
-        <rdar://problem/8020221>
-        
-        Fixed a crash seen on Windows when calling a function with too many
-        arguments.
-        
-        SunSpider reports no change.
+        Intermittent crashes beneath MarkStack::drain
+        https://bugs.webkit.org/show_bug.cgi?id=54614
+        <rdar://problem/8971070>
         
-        No test because the ASSERT I added fires in existing tests.
-
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION): Make sure to grow the registerFile when too
-        many arguments have been provided, since the caller only allocated enough
-        registerFile space for the arguments it provided, not enough for the extra
-        copy of arguments we're going to need.
-
-2010-05-25  Kwang Yul Seo  <skyul@company100.net>
-
-        Reviewed by Darin Adler.
+        The crashes were caused by a GC happening after the global object's
+        property table had grown (due to compilation), but before the properties
+        had been fully initialized by program execution.
 
-        Build fix for JSFunction
-        https://bugs.webkit.org/show_bug.cgi?id=39658
-
-        MSVC can't compile one of JSFunction constructors when JIT is disabled.
-        "PassRefPtr<NativeExecutable>" causes the compile error as NativeExecutable is not defined. 
-        Add ENABLE(JIT) guard to the constructor.
-
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
-        * runtime/JSFunction.h:
-
-2010-05-24  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 39643 - Clean up code generation in the JIT of stub function calls for op_call.
-
-        Presently, as soon as op-call strays off the hot path we set up a set of values on
-        the stack to be passed as arguments to cti functions, in case any should be called.
-
-        Instead, hoist the setup of the callframe to happen slightly sooner, and make the
-        cti functions to compile & check arity read these values from the callframe. This
-        allows up to remove the deprecated methods to manually set up cti arguments, rather
-        than using JITStubCall.h.
-
-        * interpreter/CallFrame.h:
-        * jit/JIT.h:
-        * jit/JITCall.cpp:
-        (JSC::JIT::compileOpCallInitializeCallFrame):
-        (JSC::JIT::compileOpCallVarargs):
-        (JSC::JIT::compileOpCallVarargsSlowCase):
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpCallSlowCase):
-        * jit/JITCall32_64.cpp:
-        (JSC::JIT::compileOpCallInitializeCallFrame):
-        (JSC::JIT::compileOpCallVarargs):
-        (JSC::JIT::compileOpCallVarargsSlowCase):
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpCallSlowCase):
-        * jit/JITInlineMethods.h:
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        * jit/JITStubs.h:
-        (JSC::):
-
-2010-05-24  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-        Relanding r60075.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
-        * bytecode/CodeBlock.h:
-        * bytecode/Opcode.h:
         * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitConstruct):
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::emitGetByIdExceptionInfo):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JIT.h:
-        * jit/JITCall.cpp:
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpCallSlowCase):
-        * jit/JITCall32_64.cpp:
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpCallSlowCase):
-        * jit/JITOpcodes.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        (JSC::JIT::privateCompileCTINativeCall):
-        (JSC::JIT::emit_op_neq_null):
-        (JSC::JIT::emit_op_convert_this):
-        (JSC::JIT::emit_op_get_callee):
-        (JSC::JIT::emit_op_create_this):
-        * jit/JITOpcodes32_64.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        (JSC::JIT::privateCompileCTINativeCall):
-        (JSC::JIT::emit_op_get_callee):
-        (JSC::JIT::emit_op_create_this):
-        * jit/JITStubs.cpp:
-        (JSC::DEFINE_STUB_FUNCTION):
-        (JSC::JITThunks::hostFunctionStub):
-        * jit/JITStubs.h:
-        (JSC::JITThunks::ctiNativeConstruct):
-        (JSC::):
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createNotAnObjectError):
-        * runtime/Executable.h:
-        (JSC::NativeExecutable::create):
-        (JSC::NativeExecutable::NativeExecutable):
-        * runtime/JSFunction.cpp:
-        (JSC::callHostFunctionAsConstructor):
-        * runtime/JSFunction.h:
-        * wtf/Platform.h:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Explicitly resize the global
+        object's register storage immediately, without waiting for program
+        execution to do it for us. This ensures that the global object's count
+        of global variables is consistent with the size of its global variable
+        storage at all times, and it ensures that all global variables are
+        properly initialized from the get-go.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::resizeRegisters):
+        * runtime/JSGlobalObject.h: Added a helper function for growing the
+        global object's register storage, and initializing new registers.
 
-== Rolled over to ChangeLog-2010-05-24 ==
+== Rolled over to ChangeLog-2011-02-16 ==
diff --git a/Source/JavaScriptCore/ChangeLog-2011-02-16 b/Source/JavaScriptCore/ChangeLog-2011-02-16
new file mode 100644
index 0000000..9f81b2b
--- /dev/null
+++ b/Source/JavaScriptCore/ChangeLog-2011-02-16
@@ -0,0 +1,24628 @@
+2011-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 54524 - Allow JSObject to fully utilize cell's capacity for inline storage.
+
+        Currently JSObject is both directly instantiated for regular JS objects, and
+        derived to implement subtypes. A consequence of this is that we need to ensure
+        that sufficient space from the cell is left unused and available for any data
+        members that will be introduced by subclasses of JSObject. By restructuring
+        the internal storage array out of JSObject we can increase the size in the
+        internal storage for regular objects.
+
+        Add classes JSFinalObject and JSNonFinalObject. JSNonFinalObject retains as
+        much additional capacity as is currently available to allow for data members
+        in subclasses. JSFinalObject utilizes all available space for internal storage,
+        and only allows construction through JSFinalObject::create().
+
+        The additional storage made available in the JSObject means that we need no
+        longer rely on a union of the internal storage with a pointer to storage that
+        is only valid for external storage. This means we can go back to always having
+        a valid pointer to property storage, regardless of whether this is internal or
+        external. This simplifies some cases of access to the array from C code, and
+        significantly simplifies JIT access, since repatching no longer needs to be
+        able to change between a load of the storage pointer / a LEA of the internal
+        storage.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::repatchPointer):
+        * assembler/MIPSAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/RepatchBuffer.h:
+        * assembler/X86Assembler.h:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::emit_op_get_by_pname):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorInstance.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError):
+        (JSC::TerminatedExecutionError::TerminatedExecutionError):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyObject):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::JSNotAnObject):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::createInheritorID):
+        (JSC::JSObject::allocatePropertyStorage):
+        * runtime/JSObject.h:
+        (JSC::JSObject::propertyStorage):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSNonFinalObject::createStructure):
+        (JSC::JSFinalObject::create):
+        (JSC::JSFinalObject::createStructure):
+        (JSC::JSFinalObject::JSFinalObject):
+        (JSC::JSObject::offsetOfInlineStorage):
+        (JSC::constructEmptyObject):
+        (JSC::createEmptyObjectStructure):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::~JSObject):
+        (JSC::Structure::isUsingInlineStorage):
+        * runtime/JSObjectWithGlobalObject.cpp:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSObjectWithGlobalObject.h:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::isVanilla):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+        * runtime/StrictEvalActivation.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::growPropertyStorageCapacity):
+
+2011-02-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Incorrect handling of global writes in dynamic contexts
+        https://bugs.webkit.org/show_bug.cgi?id=49383
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+          Can't use the existing callframe to return an uncaught exception
+          as by definition that callframe has already been torn down.
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::ASTBuilder):
+        (JSC::ASTBuilder::varDeclarations):
+        (JSC::ASTBuilder::funcDeclarations):
+        (JSC::ASTBuilder::features):
+        (JSC::ASTBuilder::numConstants):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::addVar):
+        (JSC::ASTBuilder::incConstants):
+        (JSC::ASTBuilder::usesThis):
+        (JSC::ASTBuilder::usesCatch):
+        (JSC::ASTBuilder::usesClosures):
+        (JSC::ASTBuilder::usesArguments):
+        (JSC::ASTBuilder::usesAssignment):
+        (JSC::ASTBuilder::usesWith):
+        (JSC::ASTBuilder::usesEval):
+          Don't need a vector of scopes in the ASTBuilder
+        * runtime/Operations.h:
+        (JSC::resolveBase):
+          In strict mode the optimisation that we use to skip a lookup
+          on the global object is incorrect and lead to us always
+          disallowing global writes when we needed to do a dynamic slot
+          lookup.  Now the strict mode path actually checks for the
+          property.
+
+2011-02-15  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Windows build fix for
+        https://bugs.webkit.org/show_bug.cgi?id=54415
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Remove deleted files.
+
+2011-02-15  Oliver Hunt  <oliver@apple.com>
+
+        Fix EFL build for
+        https://bugs.webkit.org/show_bug.cgi?id=54415
+
+        * CMakeLists.txt:
+
+2011-02-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Refactor handles and weak pointers to become nicer and more automatic
+        https://bugs.webkit.org/show_bug.cgi?id=54415
+
+        Move to a true handle based mechanism for GC value protection.  This
+        also allows us to switch to a more sensible behaviour for weak pointers
+        in which weak pointers are automatically updated.
+
+        This allows us to remove the old (and convoluted) that required all
+        objects that may be held by a weak reference to be aware of the reference
+        and manually clear them in their destructors.
+
+        This also adds a few new data types to JSC that we use to efficiently
+        allocate and return the underlying handle storage.
+
+        This patch is largely renaming and removing now unnecessary destructors
+        from objects.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        (OpaqueJSClass::prototype):
+        * API/JSClassRef.h:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * collector/handles/Global.h: Added.
+            New Global handle type used to keep gc objects live, even if they're not
+            marked.
+        (JSC::Global::Global):
+        (JSC::Global::~Global):
+        (JSC::Global::set):
+            We can only assign directly to a global from another global.
+            In all other cases we need the JSGlobalData to be provided
+            explicitly so we use a set function.
+        (JSC::Global::operator=):
+        (JSC::Global::clear):
+        (JSC::Global::isHashTableDeletedValue):
+        (JSC::Global::internalSet):
+        * collector/handles/Handle.h: Added.
+            Root "Handle" type used for immutable handles and to provide the basic
+            APIs needed for pointer-like behaviour.
+        (JSC::HandleBase::operator!):
+        (JSC::HandleBase::operator UnspecifiedBoolType*):
+        (JSC::HandleBase::isEmpty):
+        (JSC::HandleBase::HandleBase):
+        (JSC::HandleBase::slot):
+        (JSC::HandleBase::invalidate):
+        (JSC::HandleBase::setSlot):
+        (JSC::HandleTypes::getFromSlot):
+        (JSC::HandleTypes::toJSValue):
+        (JSC::HandleTypes::validateUpcast):
+        (JSC::HandleConverter::operator->):
+        (JSC::HandleConverter::operator*):
+        (JSC::Handle::Handle):
+        (JSC::Handle::get):
+        (JSC::Handle::wrapSlot):
+        (JSC::operator==):
+        (JSC::operator!=):
+        * collector/handles/HandleHeap.cpp: Added.
+            New heap for global handles.
+        (JSC::HandleHeap::HandleHeap):
+        (JSC::HandleHeap::grow):
+        (JSC::HandleHeap::markStrongHandles):
+        (JSC::HandleHeap::updateAfterMark):
+        (JSC::HandleHeap::clearWeakPointers):
+        (JSC::HandleHeap::writeBarrier):
+        * collector/handles/HandleHeap.h: Added.
+        (JSC::HandleHeap::heapFor):
+        (JSC::HandleHeap::toHandle):
+        (JSC::HandleHeap::toNode):
+        (JSC::HandleHeap::allocate):
+        (JSC::HandleHeap::deallocate):
+        (JSC::HandleHeap::makeWeak):
+            Convert a hard handle into weak handle that does not
+            protect the object it points to.
+        (JSC::HandleHeap::makeSelfDestroying):
+            Converts a handle to a weak handle that will be returned
+            to the free list when the referenced object dies.
+        (JSC::HandleHeap::Node::Node):
+        (JSC::HandleHeap::Node::slot):
+        (JSC::HandleHeap::Node::handleHeap):
+        (JSC::HandleHeap::Node::setFinalizer):
+        (JSC::HandleHeap::Node::makeWeak):
+        (JSC::HandleHeap::Node::isWeak):
+        (JSC::HandleHeap::Node::makeSelfDestroying):
+        (JSC::HandleHeap::Node::isSelfDestroying):
+        (JSC::HandleHeap::Node::finalizer):
+        (JSC::HandleHeap::Node::setPrev):
+        (JSC::HandleHeap::Node::prev):
+        (JSC::HandleHeap::Node::setNext):
+        (JSC::HandleHeap::Node::next):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        * interpreter/Interpreter.h:
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::globalObjectCollected):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * runtime/GCHandle.cpp: Removed.
+        * runtime/GCHandle.h: Removed.
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        (JSC::Heap::allocateGlobalHandle):
+        (JSC::Heap::reportExtraMemoryCost):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::allocateGlobalHandle):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::clearEnumerationCache):
+        * runtime/Protect.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        * runtime/Structure.h:
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtrBase::get):
+        (JSC::WeakGCPtrBase::clear):
+        (JSC::WeakGCPtrBase::operator!):
+        (JSC::WeakGCPtrBase::operator UnspecifiedBoolType*):
+        (JSC::WeakGCPtrBase::~WeakGCPtrBase):
+        (JSC::WeakGCPtrBase::WeakGCPtrBase):
+        (JSC::WeakGCPtrBase::internalSet):
+        (JSC::LazyWeakGCPtr::LazyWeakGCPtr):
+        (JSC::LazyWeakGCPtr::set):
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::operator=):
+        * runtime/WriteBarrier.h:
+        * wtf/BlockStack.h: Added.
+        (WTF::::BlockStack):
+        (WTF::::~BlockStack):
+        (WTF::::blocks):
+        (WTF::::grow):
+        (WTF::::shrink):
+        * wtf/SentinelLinkedList.h: Added.
+        (WTF::::SentinelLinkedList):
+        (WTF::::begin):
+        (WTF::::end):
+        (WTF::::push):
+        (WTF::::remove):
+        * wtf/SinglyLinkedList.h: Added.
+        (WTF::::SinglyLinkedList):
+        (WTF::::isEmpty):
+        (WTF::::push):
+        (WTF::::pop):
+
+2011-02-15  Pratik Solanki  <psolanki@apple.com>
+
+        Move WTF_USE_CFNETWORK to Platform.h
+        https://bugs.webkit.org/show_bug.cgi?id=54168
+
+        Reviewed by Darin Adler.
+
+        * wtf/Platform.h: Define WTF_USE_CFNETWORK for Windows builds.
+
+2011-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Moved MarkedBlock data members to the head of the block
+        https://bugs.webkit.org/show_bug.cgi?id=54482
+        
+        This allows for a variable-sized tail, to accommodate oversized blocks.
+
+        SunSpider reports no change.
+        
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate):
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep):
+        * runtime/MarkedBlock.h: Added missing element to the CELLS_PER_BLOCK
+        calculation. This kind of error is why we want to migrate to the system
+        described below.
+
+        (JSC::roundUpToMultipleOf):
+        (JSC::MarkedBlock::firstCell):
+        (JSC::MarkedBlock::cells):
+        (JSC::MarkedBlock::cellNumber): Use subtraction instead of masking to
+        calculate cell number. The mask is no longer correct because the first
+        cell is not at the head of the block.
+
+        (JSC::MarkedBlock::forEach): Replaced m_cells data member with a cells()
+        accessor. We want to use sizeof(MarkedBlock) to calculate the size of the
+        block header, so we can't have an explicit data member to represent the block tail.
+        
+        Also replaced iteration from zero with iteration from startCell(), since
+        the first N cells are now occupied by the header.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::reset): Replaced iteration from zero as above.
+
+2011-02-15  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix Mutex::tryLock() on Windows to work properly with PlatformCondition::timedWait()
+        https://bugs.webkit.org/show_bug.cgi?id=54408
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::PlatformCondition::timedWait):
+
+2011-02-15  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Remove some dead code in ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=54461
+
+        * assembler/ARMv7Assembler.h: remove dead code.
+
+2011-02-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Some MarkedBlock refactoring.
+        
+        Made cells private.
+        
+        Renamed cells => m_cells
+                marked => m_marks.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate):
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep):
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::markCount):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::testAndSetMarked):
+        (JSC::MarkedBlock::setMarked):
+        (JSC::MarkedBlock::forEach):
+
+2011-02-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add basic parser for Content Security Policy
+        https://bugs.webkit.org/show_bug.cgi?id=54379
+
+        Add a constructor for copying a Vector into a String.  I suspect there
+        are a number of call sites that are doing this manually that would
+        benefit from being moved to this API.
+
+        * wtf/text/WTFString.h:
+        (WTF::String::String):
+
+2011-02-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: use call frame column to determine execution line in source frame.
+        https://bugs.webkit.org/show_bug.cgi?id=54001
+
+        * wtf/text/TextPosition.h:
+        (WTF::ZeroBasedNumber::convertAsOneBasedInt):
+
+2011-02-13  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a compile-time option to completely disable WebArchive support.
+        https://bugs.webkit.org/show_bug.cgi?id=52712
+
+        Add an ENABLE(WEB_ARCHIVE) compile-time setting and use it for all WebArchive code.
+        Ports Affected:
+            WebArchive support is currently enabled for all ports that define PLATFORM(CF) apart from Qt.
+            This patch preserves this behavior except that it also disables support in the Chromium port.
+
+        * wtf/Platform.h: Add ENABLE_WEB_ARCHIVE definition and turn it off explicitly for Qt & Chromium ports.
+
+2011-02-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 53760 - JSC fails to build with TOT Clang
+        https://bugs.webkit.org/show_bug.cgi?id=53760
+
+        Fix -Woverloaded-virtual warnings. This is also a 6% speedup on the v8 raytrace
+        benchmark; it is nothing-to-noise on everything else.
+
+        * API/JSCallbackObject.h: Remove pointlessly overloaded method.
+        * API/JSCallbackObjectFunctions.h: Ditto.
+        * runtime/Arguments.cpp: 
+        (JSC::Arguments::put): Change signature to match the base class. This implementation
+        was no longer being called by anyone. This wasn't noticed because it is merely an
+        optimization of the base class' implementation.
+        * runtime/Arguments.h: Ditto.
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Use /dev/urandom as the OSRandomSource on OS(DARWIN)
+        https://bugs.webkit.org/show_bug.cgi?id=54279
+
+        I'm not sure it makes much of a difference whether we use arc4random or
+        /dev/urandom on Mac.  However, there's some aesthetic benefit to using
+        the same underlying API on as many platforms as reasonable.
+
+        * config.h:
+        * wtf/OSRandomSource.cpp:
+        (WTF::cryptographicallyRandomValuesFromOS):
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Kenneth Russell.
+
+        Enable ArrayBuffers by default
+        https://bugs.webkit.org/show_bug.cgi?id=54310
+
+        Export the required functions.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-11  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove explicit disable ENABLE_ASSEMBLER_WX_EXCLUSIVE on non-iOS ports
+        https://bugs.webkit.org/show_bug.cgi?id=54107
+        
+        It is unnecessary to explicitly disable ENABLE_ASSEMBLER_WX_EXCLUSIVE
+        by the definition of ENABLE().
+
+        * wtf/Platform.h:
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Randomly touch some build files in the hopes of fixing the Qt build.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Garbage collection timer cycles forever, even when nothing is happening
+        https://bugs.webkit.org/show_bug.cgi?id=54320
+        
+        (Rolling back in r78386 with the build fixed.)
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger): Be sure to make
+        our timer inert after forcing a GC, to avoid GC'ing repeatedly.
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Used svn merge -r78386:78385 to roll out r78386 because it broke the build.
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger):
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Garbage collection timer cycles forever, even when nothing is happening
+        https://bugs.webkit.org/show_bug.cgi?id=54320
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger): Be sure to make
+        our timer inert after forcing a GC, to avoid GC'ing repeatedly.
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build: added an exported symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A little more encapsulation for the heap: Removed CollectorHeapIterator
+        https://bugs.webkit.org/show_bug.cgi?id=54298
+        
+        CollectorHeapIterator is a God object that knows the internals of each
+        of the pieces of the heap. This undermines the encapsulation I'm trying
+        to achieve by splitting concepts into different classes.
+        
+        As an alternative, I've given each class a forEach iteration function,
+        which takes a functor as an argument. Now, each class just needs to
+        know how to iterate the things it knows about.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Removed CollectorHeapIterator.
+
+        * debugger/Debugger.cpp:
+        (JSC::Recompiler::Recompiler):
+        (JSC::Recompiler::~Recompiler):
+        (JSC::Recompiler::operator()):
+        (JSC::Debugger::recompileAllJSFunctions): Updated to use forEach interface
+        instead of an iterator.
+
+        * runtime/CollectorHeapIterator.h: Removed.
+
+        * runtime/Heap.cpp:
+        (JSC::TypeCounter::TypeCounter):
+        (JSC::TypeCounter::typeName):
+        (JSC::TypeCounter::operator()):
+        (JSC::TypeCounter::take):
+        (JSC::Heap::protectedObjectTypeCounts):
+        (JSC::Heap::objectTypeCounts): Added forEach and removed iterator.
+
+        * runtime/Heap.h:
+        (JSC::Heap::forEach):
+        * runtime/JSGlobalData.cpp:
+        (JSC::Recompiler::operator()):
+        (JSC::JSGlobalData::recompileAllJSFunctions):
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::forEach): Added forEach. Removed friend declaration
+        for CollectorHeapIterator. Now, we can make all our data private and
+        change it without breaking any other classes.
+
+        * runtime/MarkedSpace.cpp:
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::forEach): Added forEach and removed iterator.
+
+2011-02-11  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        CryptographicRandomNumber has its threading ifdefs backwards
+        https://bugs.webkit.org/show_bug.cgi?id=54280
+
+        Turns out we want the mutex when thread is enabled.  :)
+
+        * wtf/CryptographicallyRandomNumber.cpp:
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomNumber):
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomValues):
+
+2011-02-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit should have a cryptographic RNG
+        https://bugs.webkit.org/show_bug.cgi?id=22049
+
+        Teach JavaScriptCore how to export this function.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little more encapsulation for MarkedBlock: Made all constants private
+        so clients don't know whether allocations are fixed-sized or not
+        https://bugs.webkit.org/show_bug.cgi?id=54270
+        
+        SunSpider reports no change.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::advance): Updated for removal of HeapConstants.
+
+        * runtime/Error.cpp: Switched to using ASSERT_CLASS_FITS_IN_CELL, like
+        all other classes.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::allocate): Updated for removal of HeapConstants.
+        (JSC::Heap::reset): Updated to use size(), instead of calculating size
+        on our own.
+
+        * runtime/Heap.h: Moved the ASSERT here to MarkedBlock, since it enforces
+        on special knowledge of fixed-sizery, which only MarkedBlock is supposed
+        to know about.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate): Updated for removal of HeapConstants.
+        Also changed to reset nextCell to 0 at the end of a block, since that
+        seems more consistent.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs): Changed to use a fixed array of char.
+        This hard-coded size is a little wonky, but the compiler will tell us
+        if it's ever wrong, so I think it's OK.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep): Updated for removal of HeapConstants.
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::size):
+        (JSC::MarkedBlock::capacity): Made constants private to this class.
+        Removed HeapConstants. Added size() and capacity() functions.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::size):
+        (JSC::MarkedSpace::capacity):
+        * runtime/MarkedSpace.h: Use MarkedBlock helper functions instead of
+        direct knowledge of MarkedBlock internals.
+
+2011-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little more encapsulation for MarkedBlock: Made mark bits private
+        https://bugs.webkit.org/show_bug.cgi?id=54264
+        
+        SunSpider reports no change.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::reset): Renamed clearMarkBits => clearMarks, since clients
+        don't need to know that marks are represented as bits. Renamed
+        markedCells => markCount, since clients don't need to know that blocks
+        are split into cells.
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::markCount): New helper functions for encapsulating
+        the information clients actually need.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::clearMarks):
+        (JSC::MarkedSpace::markCount):
+        (JSC::MarkedSpace::objectCount):
+        * runtime/MarkedSpace.h: Use new helper functions instead of accessing
+        MarkedBlock data directly.
+
+2011-02-10  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Cached JavaScript Parser Data Being Left in Memory Cache
+        https://bugs.webkit.org/show_bug.cgi?id=54245
+
+        Added clear method which removes SourceProviderCache items.
+        Cleaned up extraneous whitespace.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * parser/SourceProviderCache.cpp:
+        (JSC::SourceProviderCache::~SourceProviderCache):
+        (JSC::SourceProviderCache::clear):
+        (JSC::SourceProviderCache::byteSize):
+        (JSC::SourceProviderCache::add):
+        * parser/SourceProviderCache.h:
+
+2011-02-10  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Follow-up fix to r78291. I should pass (int) 0, not '0' to memset. 
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallback::commonConstructor): fix mistaken post-review change.
+
+2011-02-10  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Make DefaultGCActivityCallback for PLATFORM(CF) Easier to Subclass
+        https://bugs.webkit.org/show_bug.cgi?id=54257
+
+        A subclass may want to specify the CFRunLoop that the Garbage Collection
+        will happen on. It was difficult to manipulate this in a subclass because
+        the current DefaultGCActivityCallback class does this in its constructor.
+        This patch generalizes things a bit more so that a specific run loop can
+        be passed in to the constructor. This makes it so all run loop management
+        can stay in DefaultGCActivityCallback and a subclass can specify any runloop.
+
+        * runtime/GCActivityCallback.h: expose a PLATFORM(CF) constructor that can
+        specify the runloop GC can be scheduled on.
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): two constructors,
+        one that specifies the run loop and passes that on to commonConstructor and
+        the old constructor defaults to the current run loop.
+        (JSC::DefaultGCActivityCallback::commonConstructor): do normal construction,
+        adding the timer to the given runloop.
+
+2011-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A little more encapsulation for MarkedBlock: Moved allocate() and sweep() into MarkedBlock
+        https://bugs.webkit.org/show_bug.cgi?id=54253
+        
+        SunSpider reports no change.
+
+        * runtime/CollectorHeapIterator.h: Removed DeadObjectIterator, since it
+        is now unused.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset): Moved the call to shrink() here, since it seems a
+        little more clear for MarkedSpace's client to tell it explicitly when to
+        shrink.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate): Split out from MarkedSpace::allocate.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep): Split out from MarkedSpace::sweep, and
+        converted to more directly iterate a MarkedBlock based on knowing its
+        internal structure.
+
+        * runtime/MarkedBlock.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::sweep):
+        * runtime/MarkedSpace.h: Split out the code mentioned above.
+
+2011-02-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix compilation error on OpenBSD
+        https://bugs.webkit.org/show_bug.cgi?id=53766
+
+        Add a HAVE_STRNSTR in Platform.h and define it only on Darwin and FreeBSD.
+
+        * wtf/Platform.h:
+        * wtf/StringExtras.h: Use HAVE(STRNSTR) now.
+
+2011-02-10  Adam Roben  <aroben@apple.com>
+
+        Print locations of assertions and logs in a way that Visual Studio understands
+
+        With this change, double-clicking one of these locations in Visual Studio's Output Window
+        will focus that line of code in the editor.
+
+        Fixes <http://webkit.org/b/54208> Double-clicking locations of assertions/logs in Visual
+        Studio's Output Window does nothing
+
+        Reviewed by Alexey Proskuryakov.
+
+        * wtf/Assertions.cpp:
+        (printCallSite): Use OS(WINDOWS) instead of the meaningless OS(WIN). When we aren't using
+        the debug CRT (and thus can't call _CrtDbgReport), print the file and line number using the
+        same format that cl.exe uses when it prints compiler errors.
+
+2011-02-10  Dan Bernstein  <mitz@apple.com>
+
+        LLVM Compiler build fix.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+
+2011-02-10  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Remove PCRE source from trunk
+        https://bugs.webkit.org/show_bug.cgi?id=54188
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pro:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.order:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * pcre/AUTHORS: Removed.
+        * pcre/COPYING: Removed.
+        * pcre/dftables: Removed.
+        * pcre/pcre.h: Removed.
+        * pcre/pcre.pri: Removed.
+        * pcre/pcre_compile.cpp: Removed.
+        * pcre/pcre_exec.cpp: Removed.
+        * pcre/pcre_internal.h: Removed.
+        * pcre/pcre_tables.cpp: Removed.
+        * pcre/pcre_ucp_searchfuncs.cpp: Removed.
+        * pcre/pcre_xclass.cpp: Removed.
+        * pcre/ucpinternal.h: Removed.
+        * pcre/ucptable.cpp: Removed.
+        * wscript:
+
+2011-02-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add randomValuesFromOS for OS(WINDOWS)
+        https://bugs.webkit.org/show_bug.cgi?id=54155
+
+        Use CryptGenRandom for generating cryptographically secure random numbers.
+        This will work on WinCE and MinGW too.
+
+        * config.h:
+        * wtf/OSRandomSource.cpp:
+        (WTF::randomValuesFromOS):
+
+2011-02-10  Jarred Nicholls  <jarred@sencha.com>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION(r78149): Return value of read() shouldn't be ignored.
+        https://bugs.webkit.org/show_bug.cgi?id=54167
+        
+        stdio read should have its return value handled. Build error in gcc 4.4.5.
+
+        * wtf/OSRandomSource.cpp:
+        (WTF::randomValuesFromOS):
+
+2011-02-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename randomValuesFromOS to cryptographicallyRandomValuesFromOS
+        https://bugs.webkit.org/show_bug.cgi?id=54156
+
+        randomValuesFromOS generates random numbers of cryptographic quality.
+        Make this clear by adding "cryptographically" to the function name.
+
+        * wtf/CryptographicallyRandomNumber.cpp:
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::stir):
+        * wtf/OSRandomSource.cpp:
+        (WTF::cryptographicallyRandomValuesFromOS):
+        * wtf/OSRandomSource.h:
+
+2011-02-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8805364> Malloc zone enumeration code should be safe in the face of errors from the memory reader.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::PageHeapAllocator::recordAdministrativeRegions): Use the new helper function to walk the linked list safely.
+        (WTF::TCMalloc_ThreadCache_FreeList::enumerateFreeObjects): Ditto.
+        (WTF::TCMalloc_Central_FreeList::enumerateFreeObjects): Ditto.
+        (WTF::TCMallocStats::PageMapFreeObjectFinder::visit): Bail out if the span could not be read.
+        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::visit): Ditto.
+        * wtf/MallocZoneSupport.h:
+        (WTF::RemoteMemoryReader::operator()): Remove an assert that is not valid.
+        (WTF::RemoteMemoryReader::nextEntryInLinkedList): Add a helper function for retrieving the next entry in
+        a linked list. It maps a failed read of the remote memory in to a null pointer, which all callers can
+        handle gracefully.
+
+2011-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 54164 - Optimize global_var accesses on JSVALUE64
+
+        Directly embed the pointer to d->registers, optimize out the load
+        from the variable object, as we do already in JSVALUE32_64.
+
+        This is a ~1.5% win on sunspidey.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+
+2011-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A little more encapsulation for MarkedBlock: Made MarkedBlock responsible
+        for its own initialization and destruction
+        https://bugs.webkit.org/show_bug.cgi?id=54137
+
+        * runtime/CollectorHeapIterator.h: Removed ObjectIterator since it is
+        now unused.
+
+        * runtime/JSCell.h: Maded MarkedBlock a friend so it can construct and
+        destruct JSCells.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock): Migrated initialization and destruction
+        code from MarkedSpace, updating it not to use ObjectIterator. We don't
+        want to use an abstract iterator since iteration will be unique to each
+        block in the future.
+
+        * runtime/MarkedBlock.h: Made the consructor private and moved it into
+        the .cpp file because it's big now.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlock): Migrated code.
+
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::collectorBlock): Keep a vector of MarkedBlock
+        pointers instead of aligned allocations -- how MarkedBlocks are allocated
+        is now an implementation detail of MarkedBlock.
+
+2011-02-09  Adam Barth  <abarth@webkit.org>
+
+        Another attempt to fix the Qt Windows build.
+
+        * config.h:
+        * wtf/OSRandomSource.cpp:
+        (WTF::randomValuesFromOS):
+
+2011-02-09  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the Qt Windows build.
+
+        * wtf/OSRandomSource.cpp:
+        (WTF::randomValuesFromOS):
+
+2011-02-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add WTF::cryptographicallyRandomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=54083
+
+        Introduce a cryptographically strong random number generator to WTF.
+        The random number generator is based on arc4random as found in:
+
+        http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/crypt/arc4random.c?rev=1.22
+
+        I've changed to source to WebKit style and abstracted the operating
+        system interaction to OSRandomSource.  We'll use this functionality to
+        expose a cryptographically strong random number generator to
+        JavaScript.
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * config.h:
+        * wtf/CMakeLists.txt:
+        * wtf/CryptographicallyRandomNumber.cpp: Added.
+        (WTF::initMutexIfNeeded):
+        (WTF::init):
+        (WTF::addRandomData):
+        (WTF::stir):
+        (WTF::stirIfNeeded):
+        (WTF::getByte):
+        (WTF::getWord):
+        (WTF::cryptographicallyRandomNumber):
+        (WTF::cryptographicallyRandomValues):
+        * wtf/CryptographicallyRandomNumber.h: Added.
+        * wtf/OSRandomSource.cpp: Added.
+        (WTF::randomValuesFromOS):
+        * wtf/OSRandomSource.h: Added.
+        * wtf/wtf.pri:
+
+2011-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the build.
+
+        * wtf/Bitmap.h: Include string.h for memset. Not sure why this started
+        failing now.
+
+2011-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A tiny bit of encapsulation for MarkedBlock: made its heap data member private
+        https://bugs.webkit.org/show_bug.cgi?id=54129
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isCellAligned):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::heap): Made the heap data member private, and provided
+        a constructor and an accessor.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocateBlock):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::heap): Use the constructor and accessor.
+
+2011-02-09  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Replace PCRE with Yarr in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=53496
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_regex_tables:
+        * runtime/RegExp.cpp:
+        * wtf/Platform.h:
+        * yarr/Yarr.h:
+        * yarr/YarrJIT.cpp:
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.h:
+        * yarr/YarrSyntaxChecker.h:
+        * yarr/yarr.pri: Added.
+
+2011-02-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed some dead code from Heap
+        https://bugs.webkit.org/show_bug.cgi?id=54064
+
+        * runtime/MarkedSpace.cpp: Removed some now-unused constants and
+        declarations.
+
+        (JSC::MarkedSpace::allocate): Removed some ASSERTs that are also ASSERTed
+        by our caller. Removed redundant typedefs.
+
+2011-02-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use a vector to track blocks in the Heap, instead of hand-rolled vector-like code
+        https://bugs.webkit.org/show_bug.cgi?id=54062
+        
+        SunSpider reports no change.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::isValid):
+        (JSC::CollectorHeapIterator::isLive): Updated for new mark invariant: To
+        know if an object is live, you just need to test its mark bit.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace): Moved waterMark and highWaterMark from
+        CollectorHeap into MarkedSpace, since they're global state. Removed call
+        to memset since CollectorHeap is a true class with its own constructor now.
+
+        (JSC::MarkedSpace::destroy): Change uses of m_heap.usedBlocks to
+        m_heap.blocks.size(), and m_heap.numBlocks to m_heap.blocks.capacity().
+
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlock): No need to manage our vector manually anymore.
+
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::clearMarkBits):
+        (JSC::MarkedSpace::markedCells):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::capacity):
+        (JSC::MarkedSpace::reset):
+        (JSC::MarkedSpace::primaryHeapEnd):
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::CollectorHeap):
+        (JSC::MarkedSpace::highWaterMark):
+        (JSC::MarkedSpace::setHighWaterMark):
+        (JSC::MarkedSpace::contains): Same as above.
+
+2011-02-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Give each MarkedBlock enough mark bits to cover the whole block
+        https://bugs.webkit.org/show_bug.cgi?id=54029
+        
+        SunSpider reports no change.
+
+        This simplifies access to mark bits, since any cell-aligned pointer
+        into a block now has a valid mark bit to test.
+        
+        * runtime/MarkedBlock.h: Changed CELLS_PER_BLOCK to account for the extra
+        mark bits. This happens not to change its actual value.
+        (JSC::MarkedBlock::cellNumber):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::testAndSetMarked):
+        (JSC::MarkedBlock::setMarked): Changed const JSCell* to const void* to
+        remove a cast from our caller, and to more accurately reflect the fact
+        that MarkedBlock is agnostic about the types pointed to by the pointers
+        you pass to it.
+
+        (JSC::MarkedBlock::isPossibleCell): Removed a null check. We now consider
+        the null pointer to be a possible cell with a 0 (impossible) block. This
+        removes a null check from marking.
+
+        * runtime/MarkedSpace.cpp:
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::contains): Simplified the contains check, and inlined
+        the whole thing, now that it's so simple.
+
+2011-02-08  Daniel Bates  <dbates@rim.com>
+
+        Rubber-stamped by Martin Robinson.
+
+        Rename enum ProtectionSeting [sic] to ProtectionSetting.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::reprotectRegion):
+        * jit/ExecutableAllocator.h:
+
+2011-02-08  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Should not always define USE_SYSTEM_MALLOC
+        https://bugs.webkit.org/show_bug.cgi?id=54007
+
+        * wtf/Platform.h:
+
+2011-02-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        LLVM Compiler build fix.
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrier::WriteBarrier):
+
+2011-02-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        JSVariableObject::setRegisters should take PassOwnArrayPtr for registersArray.
+        https://bugs.webkit.org/show_bug.cgi?id=53902
+
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters): Uses OwnArrayPtr<Register> instead of Register*.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::copyGlobalsFrom): Ditto.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::setRegisters): Takes PassOwnArrayPtr<Register> instead of Register*
+        for registerArray.
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::copyRegisterArray): Returns PassOwnArrayPtr<Register> instead of Register*.
+        (JSC::JSVariableObject::setRegisters): Takes PassOwnArrayPtr<Register> instead of Register*
+        for registerArray.
+
+2011-02-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed some dead code from Heap
+        https://bugs.webkit.org/show_bug.cgi?id=53969
+        
+        SunSpider reports no change.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::sweep):
+        * runtime/MarkedSpace.h: Removed resizeBlocks and growBlocks, and
+        renamed shrinkBlocks to shrink, making it unconditionally shrink as
+        much as possible.
+
+2011-02-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Simplified the marked space's mark invariant
+        https://bugs.webkit.org/show_bug.cgi?id=53968
+        
+        SunSpider reports no change.
+        
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate): Mark objects when allocating them. This
+        means that, at all times other than the mark phase, an object is live
+        if and only if it is marked.
+
+        (JSC::MarkedSpace::containsSlowCase): Use the new mark invariant to
+        simplify testing whether an object is live.
+
+2011-02-07  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=53950
+        USE_WK_SCROLLBAR_PAINTER in ScrollbarThemeMac should be in
+        Platform.h instead
+
+        * wtf/Platform.h:
+
+2011-02-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Add built-in decoder for UTF-8 for improved performance
+        https://bugs.webkit.org/show_bug.cgi?id=53898
+
+        * wtf/unicode/UnicodeMacrosFromICU.h: Added U8_MAX_LENGTH and
+        U8_APPEND_UNSAFE. Also fixed header.
+
+2011-02-07  Adam Roben  <aroben@apple.com>
+
+        Delete precompiled headers whenever any .vsprops file changes
+
+        Precompiled headers need to be rebuilt if, e.g., an ENABLE_* macro is changed in one of our
+        .vsprops files. Unfortunately, Visual Studio isn't smart enough to figure this out, so we
+        give it some assistance by deleting the precompiled headers whenever any .vsprops file
+        changes.
+
+        I also made some drive-by fixes while I was in the area.
+
+        Fixes <http://webkit.org/b/53826> react-to-vsprops-changes.py doesn't force precompiled
+        headers to be rebuilt, but should
+
+        Reviewed by David Kilzer.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Stop ignoring the
+        return code from react-to-vsprops-changes.py so we will notice when errors are introduced.
+        But skip the script entirely in production builds, where it is both unnecessary and can't
+        function correctly (due to not having the entire source tree available to it).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        (main): Removed an extra '*' in the glob for finding manifest files. The extra '*' was
+        leftover from before we rearranged WebKitBuild in r75138. Moved code to delete an old file
+        to the new delete_if_older_than function. Added code to delete any precompiled headers older
+        than the newest .vsprops file.
+        (delete_if_older_than): Added. Code came from main.
+
+2011-02-07  Antti Koivisto  <antti@apple.com>
+
+        Not reviewed.
+        
+        ASSERTS_DISABLED -> ASSERT_DISABLED
+
+        * wtf/BloomFilter.h:
+
+2011-02-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed; speculative Qt build fix.
+
+        * JavaScriptCore.pro:
+
+2011-02-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        OwnArraryPtr.h uses deleteOwnedPtr but doesn’t include OwnPtrCommon.h
+        https://bugs.webkit.org/show_bug.cgi?id=52867
+
+        Removed LOOSE_OWN_ARRAY_PTR and OwnArrayPtr<T>::set. Replaced all calls to OwnArrayPtr::set
+        and loose instantiation of OwnArrayPtr by calls to operator= and adoptArrayPtr. Also removed
+        OwnArrayPtrCommon.h since PassOwnArrayPtr.h needs to include OwnArrayPtr.h and there is
+        no point in putting deleteOwnedArrayPtr into a separate header.
+        
+        Note: if this patch breaks build, the code is either instiantiating OwnArrayPtr
+        without calling adoptArrayPtr or calling set on ArrayOwnPtr instead of operator=.
+
+        No tests are added since this is a refactoring.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString): Calls adoptArrayPtr.
+        * GNUmakefile.am: Removed OwnArrayPtrCommon.h
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::deleteProperty): Calls adoptArrayPtr.
+        * runtime/Arguments.h:
+        (JSC::Arguments::copyRegisters): Ditto.
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator): Ditto.
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::setRegisters): Calls operator= instead of set.
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain): Ditto.
+        * wtf/CMakeLists.txt:
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime): No longer instnatiates OwnArrayPtr
+        with a null pointer.
+        * wtf/OwnArrayPtr.h:
+        * wtf/OwnArrayPtrCommon.h: Removed.
+        * wtf/PassOwnArrayPtr.h: No longer includes OwnArrayCommon.h
+        (WTF::deleteOwnedArrayPtr): Moved from OwnArrayPtrCommon.h
+
+2011-02-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Use bloom filter for descendant selector filtering
+        https://bugs.webkit.org/show_bug.cgi?id=53880
+        
+        Implement a bloom filter with k=2 and 8 bit counting.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/BloomFilter.h: Added.
+        (WTF::BloomFilter::maximumCount):
+        (WTF::BloomFilter::BloomFilter):
+        (WTF::BloomFilter::mayContain):
+        (WTF::BloomFilter::add):
+        (WTF::BloomFilter::remove):
+        (WTF::BloomFilter::firstSlot):
+        (WTF::BloomFilter::secondSlot):
+        (WTF::::add):
+        (WTF::::remove):
+        (WTF::::clear):
+        (WTF::::likelyEmpty):
+        (WTF::::isClear):
+
+2011-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Rolled back in r77612 with ASSERT/crash fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=53759
+        
+        Don't shrink the heap to 0 unconditionally. Instead, shrink to 1 if
+        necessary. For now, the heap assumes that it always has at least one
+        block live.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reset):
+        * runtime/Heap.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::shrinkBlocks):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::highWaterMark):
+        (JSC::MarkedSpace::setHighWaterMark):
+
+2011-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX: REALLY remove the last vestiges of JSVALUE32!
+
+        <rdar://problem/8957409> Remove last vestiges of JSVALUE32
+        <http://webkit.org/b/53779>
+
+        * DerivedSources.make: Removed dependency on
+        JavaScriptCore.JSVALUE32.exp.
+
+2011-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/8957409> Remove last vestiges of JSVALUE32
+        <http://webkit.org/b/53779>
+
+        Reviewed by Darin Adler.
+
+        Support for JSVALUE32 was originaly removed in r70111.
+
+        * Configurations/JavaScriptCore.xcconfig: Changed armv6 to use
+        JavaScriptCore.JSVALUE32_64.exp and ppc64 to use
+        JavaScriptCore.JSVALUE64.exp to match Platform.h.
+        * DerivedSources.make: Removed rule for
+        JavaScriptCore.JSVALUE32.exp.
+        * JavaScriptCore.JSVALUE32only.exp: Removed.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed references
+        to JavaScriptCore.JSVALUE32only.exp.
+
+2011-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        Use static_cast and other style cleanup in YarrInterpreter.cpp
+        <http://webkit.org/b/53772>
+
+        Reviewed by John Sullivan.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::InputStream::readChecked): Use
+        static_cast.
+        (JSC::Yarr::Interpreter::InputStream::checkInput): Remove
+        unnecessary else block.
+        (JSC::Yarr::Interpreter::matchAssertionEOL): Ditto.
+        (JSC::Yarr::Interpreter::backtrackBackReference): Ditto.
+        (JSC::Yarr::ByteCompiler::emitDisjunction): Use static_cast.
+
+2011-02-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77625 and r77626.
+        http://trac.webkit.org/changeset/77625
+        http://trac.webkit.org/changeset/77626
+        https://bugs.webkit.org/show_bug.cgi?id=53765
+
+        It broke Windows builds (Requested by Ossy_ on #webkit).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_regex_tables:
+        * runtime/RegExp.cpp:
+        * wtf/Platform.h:
+        * yarr/Yarr.h:
+        * yarr/YarrJIT.cpp:
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.h:
+        * yarr/YarrSyntaxChecker.h:
+        * yarr/yarr.pri: Removed.
+
+2011-02-04  Jessie Berlin  <jberlin@apple.com>
+
+        Windows build fix. Unreviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2011-02-04  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Replace PCRE with Yarr in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=53496
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_regex_tables:
+        * runtime/RegExp.cpp:
+        * wtf/Platform.h:
+        * yarr/Yarr.h:
+        * yarr/YarrJIT.cpp:
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.h:
+        * yarr/YarrSyntaxChecker.h:
+        * yarr/yarr.pri: Added.
+
+2011-02-04  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed rollout two patches r77614 and r77612.
+
+        REGRESSION: Snow Leopard Intel Release anumber of failing tests.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reset):
+        * runtime/Heap.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+
+2011-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix 32bit build.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset): Use an explicit cast to avoid shortening warnings,
+        since 1.5 is double (64bit), and the result is size_t (32bit).
+
+2011-02-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Changed MarkedSpace to delegate grow/shrink decisions to Heap
+        https://bugs.webkit.org/show_bug.cgi?id=53759
+        
+        SunSpider reports no change.
+        
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reset):
+        * runtime/Heap.h: Reorganized a few data members for better cache locality.
+        Added a grow policy.
+        
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::reset): Don't shrink automatically. Instead, wait for
+        the heap to make an explicit sweep call.
+
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::highWaterMark):
+        (JSC::MarkedSpace::setHighWaterMark): Use a watermark to determine how
+        many bytes to allocate before failing and giving the heap an opportunity
+        to collect garbage. This also means that we allocate blocks on demand,
+        instead of ahead of time.
+
+2011-02-03  James Kozianski  <koz@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add navigator.registerProtocolHandler behind a flag.
+        https://bugs.webkit.org/show_bug.cgi?id=52609
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-02-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Not all blocks are freed when the heap is freed (counting is hard!)
+        https://bugs.webkit.org/show_bug.cgi?id=53732
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy): Freeing a block compacts the list, so just
+        keep freeing block 0 until there are no blocks left.
+
+2011-02-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: The new MarkedBlock.h header
+        needs to be private, not project, so other projects can include headers
+        that depend on it.
+
+2011-02-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Start using MarkedBlock instead of CollectorBlock
+        https://bugs.webkit.org/show_bug.cgi?id=53693
+        
+        SunSpider reports no change.
+        
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::blockFor):
+        (JSC::MarkedBlock::setMarked):
+        (JSC::MarkedBlock::isCellAligned):
+        (JSC::MarkedBlock::isPossibleCell): Updated for const-ness.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::containsSlowCase):
+        (JSC::MarkedSpace::clearMarkBits): Updated for const-ness.
+
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::collectorBlock):
+        (JSC::MarkedSpace::heap):
+        (JSC::MarkedSpace::isMarked):
+        (JSC::MarkedSpace::testAndSetMarked):
+        (JSC::MarkedSpace::setMarked):
+        (JSC::MarkedSpace::contains): Switched from CollectorBlock to MarkedBlock,
+        and deleted dead CollectorBlock-related code.
+
+2011-02-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Avoid strlen() in AtomicString::fromUTF8
+        https://bugs.webkit.org/show_bug.cgi?id=50516
+
+        Add an overload to calculateStringHashFromUTF8 to get
+        strlen() of the input data with only one call.
+
+        This change shows about 3% performance win on the xml-parser benchmark.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::fromUTF8):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8Internal):
+        (WTF::Unicode::calculateStringHashFromUTF8):
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8):
+        * wtf/unicode/UTF8.h:
+
+2011-02-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-02  Gavin Barraclough  <barraclough@apple.com>
+
+        oops, build fix!
+
+        * wtf/Assertions.cpp:
+
+2011-02-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 53650 - Add a BACKTRACE macro to Assertions.h
+
+        Add a BACKTRACE macro to Assertions.h, which will print a backtrace on
+        debug Mac builds, make CRASH (and thus ASSERT) automatically call this.
+
+        * JavaScriptCore.exp:
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+
+2011-02-02  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improper backtrack of nested non-capturing greedy paren to prior paren
+        https://bugs.webkit.org/show_bug.cgi?id=53261
+
+        A paren that follows a non-capturing greedy paren nested within a 
+        non-capturing fixed paren was back tracking to the last paren 
+        processed instead of the immediately prior paren.
+        Refactored default backtracking of parens to prior paren to work for
+        both nested (within) and immediately prior (after) parens.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::GenerationState::addParenthesesTail):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setJumpListToPriorParen):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::getJumpListToPriorParen):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::ParenthesesTail):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::YarrGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+        (JSC::Yarr::YarrGenerator::generateDisjunction):
+
+2011-02-02  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Darin Adler and Steve Falkenburg.
+
+        Add DerivedSources.make to some Visual Studio projects
+        https://bugs.webkit.org/show_bug.cgi?id=53607
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Add DerivedSources.make.
+
+2011-02-02  Steve Lacey  <sjl@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Implement basic media statistics on media elements.
+        https://bugs.webkit.org/show_bug.cgi?id=53322
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-02-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes for wxWebKit.
+
+        * wtf/wx/StringWx.cpp:
+        (WTF::String::String):
+
+2011-02-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little more Heap refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=53577
+        
+        SunSpider reports no change.
+        
+        Split out MarkedBlock into its own file / class.
+        
+        Did the following renames:
+            isCellMarked => isMarked
+            checkMarkCell => testAndSetMarked
+            markCell => setMarked
+            cellOffset => cellNumber
+            collectorBlock => blockFor
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Heap.cpp:
+        (JSC::WeakGCHandlePool::update):
+        * runtime/Heap.h:
+        (JSC::Heap::isMarked):
+        (JSC::Heap::testAndSetMarked):
+        (JSC::Heap::setMarked):
+        * runtime/JSArray.h:
+        (JSC::MarkStack::markChildren):
+        (JSC::MarkStack::drain):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::internalAppend):
+        * runtime/MarkedBlock.cpp: Added.
+        * runtime/MarkedBlock.h: Added.
+        (JSC::MarkedBlock::blockFor):
+        (JSC::MarkedBlock::cellNumber):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::testAndSetMarked):
+        (JSC::MarkedBlock::setMarked):
+        (JSC::MarkedBlock::isCellAligned):
+        (JSC::MarkedBlock::isPossibleCell):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::isMarked):
+        (JSC::MarkedSpace::testAndSetMarked):
+        (JSC::MarkedSpace::setMarked):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::isValid):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+
+2011-02-02  Sam Weinig  <sam@webkit.org>
+
+        Fix windows clean build.
+
+        * DerivedSources.make:
+
+2011-02-02  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Fix dist compilation
+        https://bugs.webkit.org/show_bug.cgi?id=53579
+
+        * GNUmakefile.am: Added WriteBarrier.h to the sources, it was
+        added in r77151
+
+2011-02-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77297.
+        http://trac.webkit.org/changeset/77297
+        https://bugs.webkit.org/show_bug.cgi?id=53538
+
+        caused leopard crashes (Requested by paroga on #webkit).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::fromUTF8):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashFromUTF8):
+        * wtf/unicode/UTF8.h:
+
+2011-02-01  Sam Weinig  <sam@webkit.org>
+
+        Fix Mac production builds.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-02-01  Sam Weinig  <sam@webkit.org>
+
+        Try to fix the windows build.
+
+        * DerivedSources.make:
+
+2011-02-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Avoid strlen() in AtomicString::fromUTF8
+        https://bugs.webkit.org/show_bug.cgi?id=50516
+
+        Add an overload to calculateStringHashFromUTF8 to get
+        strlen() of the input data with only one call.
+
+        This change shows about 3% performance win on the xml-parser benchmark.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::fromUTF8):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8Internal):
+        (WTF::Unicode::calculateStringHashFromUTF8):
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8):
+        * wtf/unicode/UTF8.h:
+
+2011-02-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Part 2 for <rdar://problem/8492788>
+        Adopt WKScrollbarPainterController
+
+        Use header detection to define scrollbar painting controller #define.
+
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-02-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Refactor JSGlobalObject-related tear-down
+        https://bugs.webkit.org/show_bug.cgi?id=53478
+        
+        While investigating crashes caused by r77082, I noticed some strange
+        destructor-time behaviors. This patch makes them less strange.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::GlobalCodeBlock::~GlobalCodeBlock): Store the set of global code
+        blocks on the Heap, instead of on independent global objects. The heap
+        is guaranteed to outlast any GC-owned data structure. The heap is also
+        a natural place to store objects that needs out-of-band marking, since
+        the heap is responsible for marking all roots.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::globalObjectCount):
+        (JSC::Heap::protectedGlobalObjectCount):
+        * runtime/Heap.h:
+        (JSC::Heap::codeBlocks):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        * runtime/MarkedSpace.cpp: Store the set of global objects in a weak map
+        owned by JSGlobalData, instead of an instrusive circular linked list.
+        This is simpler, and it avoids destructor-time access between garbage
+        collected objects, which is hard to get right.
+
+        (JSC::MarkedSpace::destroy): Make sure to clear mark bits before tearing
+        everything down. Otherwise, weak data structures will incorrectly report
+        that objects pending destruction are still alive.
+
+2011-02-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION(77082): GC-related crashes seen: on WebKit2 bot; on GTK 32bit
+        bot; loading trac pages; typing in search field
+        https://bugs.webkit.org/show_bug.cgi?id=53519
+        
+        The crashes were all caused by failure to run an object's destructor.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::ObjectIterator::ObjectIterator): Don't skip forward upon
+        construction. The iterator class used to do that when it was designed
+        for prior-to-beginning initialization. I forgot to remove this line
+        of code when I changed the iterator to normal initialization.
+        
+        Skipping forward upon construction was causing the heap to skip running
+        the destructor for the very first object in a block when destroying the
+        block. This usually did not crash, since block destruction is rare and
+        most objects have pretty trivial destructors. However, in the rare case
+        when the heap would destroy a block whose first object was a global
+        object or a DOM node, BOOM.
+
+2011-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Update JSObject storage for new marking API
+        https://bugs.webkit.org/show_bug.cgi?id=53467
+
+        JSObject no longer uses EncodedJSValue for its property storage.
+        This produces a stream of mechanical changes to PropertySlot and
+        anonymous storage APIs.
+
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::putAnonymousValue):
+        (JSC::JSObject::clearAnonymousValue):
+        (JSC::JSObject::getAnonymousValue):
+        (JSC::JSObject::putThisToAnonymousValue):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        * runtime/JSObjectWithGlobalObject.cpp:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setRegisterSlot):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+
+2011-02-01  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Antonio Gomes.
+
+        Modify RandomNumberSeed.h to use USE(MERSENNE_TWISTER_19937)
+        https://bugs.webkit.org/show_bug.cgi?id=53506
+
+        Currently, use of the Mersenne Twister pseudorandom number generator
+        is hardcoded to the Windows CE port. With the passing of bug #53253,
+        we can generalize support for this PRNG to all ports that use srand(3)
+        and rand(3), including Windows CE.
+
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+
+2011-02-01  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        MacroAssemblerARM would generate code that did 32bit loads
+        on addresses that were not aligned. More specifically it would
+        generate a ldr r8,[r1, #7] which isn't valid on ARMv5 and lower.
+        The intended instruction really is ldrb r8,[r1, #7]; ensure we
+        call load8 instead of load32.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46095
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::set32Test32):
+        (JSC::MacroAssemblerARM::set32Test8):
+
+2011-02-01  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix some Visual Studio compiler warnings.
+        https://bugs.webkit.org/show_bug.cgi?id=53476
+
+        * wtf/MathExtras.h:
+        (clampToInteger):
+        (clampToPositiveInteger):
+        * wtf/ThreadingWin.cpp:
+        (WTF::absoluteTimeToWaitTimeoutInterval):
+
+2011-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bogus callframe during stack unwinding
+        https://bugs.webkit.org/show_bug.cgi?id=53454
+
+        Trying to access a callframe's globalData after destroying its
+        ScopeChain is not a good thing.  While we could access the
+        globalData directly through the (known valid) scopechain we're
+        holding on to, it feels fragile.  Instead we push the valid
+        ScopeChain onto the callframe again to ensure that the callframe
+        itself remains valid.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+
+2011-01-31  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
+        https://bugs.webkit.org/show_bug.cgi?id=53271
+
+        Reapplying this change again.
+        Changed isValid() to use .get() as a result of change r77151.
+
+        Added new isValid() methods to check if a contained object in
+        a WeakGCMap is valid when using an unchecked iterator.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::isValid):
+
+2011-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Convert markstack to a slot visitor API
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        rolling r77098, r77099, r77100, r77109, and
+        r77111 back in, along with a few more Qt fix attempts.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::append):
+        (JSC::JSCell::MarkStack::internalAppend):
+        (JSC::JSCell::MarkStack::deprecatedAppend):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::Holder::objectSlot):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::putUndefinedAtDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::deprecatedAppendValues):
+        (JSC::MarkStack::appendValues):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+        (JSC::Structure::storedPrototypeSlot):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedGetSlot):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Added.
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::clear):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrier::WriteBarrier):
+        (JSC::operator==):
+
+2011-01-31  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        wss (websockets ssl) support for gtk via new gio TLS support
+        https://bugs.webkit.org/show_bug.cgi?id=50344
+
+        Add a GPollableOutputStream typedef for TLS WebSockets support
+
+        * wtf/gobject/GTypedefs.h:
+
+2011-01-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53352
+        Heavy external fragmentation in FixedVMPoolAllocator can lead to a CRASH().
+
+        The FixedVMPoolAllocator currently uses a best fix policy -
+        switch to first fit, this is less prone to external fragmentation.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::AllocationTableSizeClass::AllocationTableSizeClass):
+        (JSC::AllocationTableSizeClass::blockSize):
+        (JSC::AllocationTableSizeClass::blockCount):
+        (JSC::AllocationTableSizeClass::blockAlignment):
+        (JSC::AllocationTableSizeClass::size):
+        (JSC::AllocationTableLeaf::AllocationTableLeaf):
+        (JSC::AllocationTableLeaf::~AllocationTableLeaf):
+        (JSC::AllocationTableLeaf::allocate):
+        (JSC::AllocationTableLeaf::free):
+        (JSC::AllocationTableLeaf::isEmpty):
+        (JSC::AllocationTableLeaf::isFull):
+        (JSC::AllocationTableLeaf::size):
+        (JSC::AllocationTableLeaf::classForSize):
+        (JSC::AllocationTableLeaf::dump):
+        (JSC::LazyAllocationTable::LazyAllocationTable):
+        (JSC::LazyAllocationTable::~LazyAllocationTable):
+        (JSC::LazyAllocationTable::allocate):
+        (JSC::LazyAllocationTable::free):
+        (JSC::LazyAllocationTable::isEmpty):
+        (JSC::LazyAllocationTable::isFull):
+        (JSC::LazyAllocationTable::size):
+        (JSC::LazyAllocationTable::dump):
+        (JSC::LazyAllocationTable::classForSize):
+        (JSC::AllocationTableDirectory::AllocationTableDirectory):
+        (JSC::AllocationTableDirectory::~AllocationTableDirectory):
+        (JSC::AllocationTableDirectory::allocate):
+        (JSC::AllocationTableDirectory::free):
+        (JSC::AllocationTableDirectory::isEmpty):
+        (JSC::AllocationTableDirectory::isFull):
+        (JSC::AllocationTableDirectory::size):
+        (JSC::AllocationTableDirectory::classForSize):
+        (JSC::AllocationTableDirectory::dump):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::allocated):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::classForSize):
+        (JSC::FixedVMPoolAllocator::offsetToPointer):
+        (JSC::FixedVMPoolAllocator::pointerToOffset):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::PageReservation):
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::committed):
+
+2011-01-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76969.
+        http://trac.webkit.org/changeset/76969
+        https://bugs.webkit.org/show_bug.cgi?id=53418
+
+        "It is causing crashes in GTK+ and Leopard bots" (Requested by
+        alexg__ on #webkit).
+
+        * runtime/WeakGCMap.h:
+
+2011-01-30  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, rolling out r77098, r77099, r77100, r77109, and
+        r77111.
+        http://trac.webkit.org/changeset/77098
+        http://trac.webkit.org/changeset/77099
+        http://trac.webkit.org/changeset/77100
+        http://trac.webkit.org/changeset/77109
+        http://trac.webkit.org/changeset/77111
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        Qt build is broken
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toThisObject):
+        (JSC::JSCell::MarkStack::append):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::appendValues):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::isValid):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Removed.
+
+2011-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix the build fix. I assume Oliver meant m_cell, not m_value.
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::clear):
+
+2011-01-30  Oliver Hunt  <oliver@apple.com>
+
+        More Qt build fixes
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::clear):
+
+2011-01-30  Oliver Hunt  <oliver@apple.com>
+
+        Convert markstack to a slot visitor API
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        rolling r77006 and r77020 back in.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::append):
+        (JSC::JSCell::MarkStack::internalAppend):
+        (JSC::JSCell::MarkStack::deprecatedAppend):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::Holder::objectSlot):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::putUndefinedAtDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::deprecatedAppendValues):
+        (JSC::MarkStack::appendValues):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+        (JSC::Structure::storedPrototypeSlot):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedGetSlot):
+        (JSC::WeakGCMap::isValid):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Added.
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrier::WriteBarrier):
+        (JSC::operator==):
+
+2011-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Filter all Heap collection through a common reset function, in
+        preparation for adding features triggered by collection.
+        https://bugs.webkit.org/show_bug.cgi?id=53396
+        
+        SunSpider reports no change.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reportExtraMemoryCostSlowCase): When we're over the extraCost
+        limit, just call collectAllGarbage() instead of rolling our own special
+        way of resetting the heap. In theory, this may be slower in some cases,
+        but it also fixes cases of pathological heap growth that we've seen,
+        where the only objects being allocated are temporary and huge
+        (<rdar://problem/8885843>).
+
+        (JSC::Heap::allocate):
+        (JSC::Heap::collectAllGarbage): Use the shared reset function.
+
+        (JSC::Heap::reset):
+        * runtime/Heap.h: Carved a new shared reset function out of the old
+        collectAllGarbage.
+
+2011-01-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77025.
+        http://trac.webkit.org/changeset/77025
+        https://bugs.webkit.org/show_bug.cgi?id=53401
+
+        It made js1_5/Regress/regress-159334.js fail on 64 bit Linux
+        (Requested by Ossy on #webkit).
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FreeListEntry::FreeListEntry):
+        (JSC::AVLTreeAbstractorForFreeList::get_less):
+        (JSC::AVLTreeAbstractorForFreeList::set_less):
+        (JSC::AVLTreeAbstractorForFreeList::get_greater):
+        (JSC::AVLTreeAbstractorForFreeList::set_greater):
+        (JSC::AVLTreeAbstractorForFreeList::get_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::set_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::null):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_key):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_node):
+        (JSC::AVLTreeAbstractorForFreeList::compare_node_node):
+        (JSC::reverseSortFreeListEntriesByPointer):
+        (JSC::reverseSortCommonSizedAllocations):
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::addToFreeList):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::allocInternal):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+        (JSC::FixedVMPoolAllocator::addToCommittedByteCount):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::maybeModifyVMPoolSize):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::PageReservation):
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+
+2011-01-30  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Daniel Bates.
+
+        Code style issue in JavaScriptCore/wtf/CurrentTime.h
+        https://bugs.webkit.org/show_bug.cgi?id=53394
+
+        According to rule #3 at http://webkit.org/coding/coding-style.html,
+        This patch fix style issue in CurrentTime.h.
+
+        No functionality change, no new tests.
+
+        * wtf/CurrentTime.h:
+        (WTF::currentTimeMS):
+        (WTF::getLocalTime):
+
+2011-01-30  Benjamin Poulain  <ikipou@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] JavaScriptCore does not link on Mac if building WebKit 2
+        https://bugs.webkit.org/show_bug.cgi?id=53377
+
+        The option "-whole-archive" is not availabe with the libtool of Mac OS X,
+        instead, we can use "-all_load" on Mac.
+
+        * JavaScriptCore.pri:
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Sorry Leopard bot -- I committed a change by accident.
+
+        * JavaScriptCore.exp: You may have your symbols back now.
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Simplified Heap iteration
+        https://bugs.webkit.org/show_bug.cgi?id=53393
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::isValid):
+        (JSC::CollectorHeapIterator::isLive):
+        (JSC::CollectorHeapIterator::advance): Removed "max" argument to
+        advance because it's a constant.
+        (JSC::LiveObjectIterator::LiveObjectIterator):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::DeadObjectIterator):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::ObjectIterator):
+        (JSC::ObjectIterator::operator++): Factored out common checks into
+        two helper functions -- isValid() for "Am I past the end?" and isLive()
+        for "Is the cell I'm pointing to live?".
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::sweep): Always sweep from the beginning of the heap
+        to the end, to avoid making sweep subtly reliant on internal Heap state.
+        (JSC::MarkedSpace::primaryHeapBegin):
+        (JSC::MarkedSpace::primaryHeapEnd): Always be explicit about where
+        iteration begins.
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Simplified heap destruction
+        https://bugs.webkit.org/show_bug.cgi?id=53392
+
+        * JavaScriptCore.exp:
+        * runtime/Heap.cpp:
+        (JSC::Heap::destroy):
+        * runtime/Heap.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy):
+        * runtime/MarkedSpace.h: Don't go out of our way to destroy GC-protected
+        cells last -- the difficult contortions required to do so just don't seem
+        justified. We make no guarantees about GC protection after the client
+        throws away JSGlobalData, and it doesn't seem like any meaningful
+        guarantee is even possible.
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Switched heap to use the Bitmap class and removed CollectorBitmap
+        https://bugs.webkit.org/show_bug.cgi?id=53391
+        
+        SunSpider says 1.005x as fast. Seems like a fluke.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate): Updated for rename and returning a value
+        rather than taking a value by reference.
+
+        * runtime/MarkedSpace.h: Code reuse is good.
+
+        * wtf/Bitmap.h:
+        (WTF::::testAndSet): Added, since this is the one thing Bitmap was missing
+        which CollectorBitmap had. (Renamed from the less conventional "getset".)
+
+        (WTF::::nextPossiblyUnset): Renamed and changed to return a value for
+        clarity. It's all the same with inlining.
+
+2011-01-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Some more Heap cleanup.
+        https://bugs.webkit.org/show_bug.cgi?id=53357
+        
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated exported symbols.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reportExtraMemoryCostSlowCase): Renamed recordExtraCost to 
+        reportExtraMemoryCostSlowCase to match our naming conventions.
+
+        (JSC::Heap::capacity): Renamed size to capacity because this function
+        returns the capacity of the heap, including unused portions.
+
+        * runtime/Heap.h:
+        (JSC::Heap::globalData):
+        (JSC::Heap::markedSpace):
+        (JSC::Heap::machineStackMarker):
+        (JSC::Heap::reportExtraMemoryCost): Moved statics to the top of the file.
+        Moved ctor and dtor to the beginning of the class definition. Grouped
+        functions by purpose.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::capacity): Renamed size to capacity because this
+        function returns the capacity of the heap, including unused portions.
+
+        * runtime/MarkedSpace.h: Removed statistics and the Statistics class because
+        the same information can be gotten just by calling size() and capacity().
+
+        * runtime/MemoryStatistics.cpp:
+        * runtime/MemoryStatistics.h: Ditto.
+
+2011-01-29  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move wince/mt19937ar.c to ThirdParty and make it a policy choice
+        https://bugs.webkit.org/show_bug.cgi?id=53253
+
+        Make inclusion of MT19937 a policy decision.
+
+        Currently, we hardcoded to  use MT19937 when building for
+        Windows CE. Instead, we should make this a policy decision
+        with the Windows CE port using this by default.
+
+        * JavaScriptCore.pri: Append Source/ThirdParty to the end
+        of the list include directories.
+        * wtf/CMakeLists.txt: Ditto.
+        * wtf/Platform.h: Defined WTF_USE_MERSENNE_TWISTER_19937 when
+        building for Windows CE.
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Substituted USE(MERSENNE_TWISTER_19937) for OS(WINCE).
+
+2011-01-29  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Bug 53374 - Remove uses of unsafe string functions in debugging code
+        https://bugs.webkit.org/show_bug.cgi?id=53374
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::printTraceData):
+
+2011-01-29  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JavaScriptCoreUseJIT environment variable broken
+        https://bugs.webkit.org/show_bug.cgi?id=53372
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Check the actual value in the string returned
+        by getenv() rather than just doing a NULL check on the return value.
+
+2011-01-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Move CharacterNames.h into WTF directory
+        https://bugs.webkit.org/show_bug.cgi?id=49618
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/unicode/CharacterNames.h: Renamed from WebCore/platform/text/CharacterNames.h.
+        * wtf/unicode/UTF8.cpp:
+
+2011-01-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add various clampToInt() methods to MathExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=52910
+        
+        Add functions for clamping doubles and floats to valid int
+        ranges, for signed and positive integers.
+
+        * wtf/MathExtras.h:
+        (clampToInteger):
+        (clampToPositiveInteger):
+
+2011-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77006 and r77020.
+        http://trac.webkit.org/changeset/77006
+        http://trac.webkit.org/changeset/77020
+        https://bugs.webkit.org/show_bug.cgi?id=53360
+
+        "Broke Windows tests" (Requested by rniwa on #webkit).
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toThisObject):
+        (JSC::JSCell::MarkStack::append):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::appendValues):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::isValid):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Removed.
+
+2011-01-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53352
+        Heavy external fragmentation in FixedVMPoolAllocator can lead to a CRASH().
+
+        The FixedVMPoolAllocator currently uses a best fix policy -
+        switch to first fit, this is less prone to external fragmentation.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::AllocationTableSizeClass::AllocationTableSizeClass):
+        (JSC::AllocationTableSizeClass::blockSize):
+        (JSC::AllocationTableSizeClass::blockCount):
+        (JSC::AllocationTableSizeClass::blockAlignment):
+        (JSC::AllocationTableSizeClass::size):
+        (JSC::AllocationTableLeaf::AllocationTableLeaf):
+        (JSC::AllocationTableLeaf::~AllocationTableLeaf):
+        (JSC::AllocationTableLeaf::allocate):
+        (JSC::AllocationTableLeaf::free):
+        (JSC::AllocationTableLeaf::isEmpty):
+        (JSC::AllocationTableLeaf::isFull):
+        (JSC::AllocationTableLeaf::size):
+        (JSC::AllocationTableLeaf::classForSize):
+        (JSC::AllocationTableLeaf::dump):
+        (JSC::LazyAllocationTable::LazyAllocationTable):
+        (JSC::LazyAllocationTable::~LazyAllocationTable):
+        (JSC::LazyAllocationTable::allocate):
+        (JSC::LazyAllocationTable::free):
+        (JSC::LazyAllocationTable::isEmpty):
+        (JSC::LazyAllocationTable::isFull):
+        (JSC::LazyAllocationTable::size):
+        (JSC::LazyAllocationTable::dump):
+        (JSC::LazyAllocationTable::classForSize):
+        (JSC::AllocationTableDirectory::AllocationTableDirectory):
+        (JSC::AllocationTableDirectory::~AllocationTableDirectory):
+        (JSC::AllocationTableDirectory::allocate):
+        (JSC::AllocationTableDirectory::free):
+        (JSC::AllocationTableDirectory::isEmpty):
+        (JSC::AllocationTableDirectory::isFull):
+        (JSC::AllocationTableDirectory::size):
+        (JSC::AllocationTableDirectory::classForSize):
+        (JSC::AllocationTableDirectory::dump):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::allocated):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::classForSize):
+        (JSC::FixedVMPoolAllocator::offsetToPointer):
+        (JSC::FixedVMPoolAllocator::pointerToOffset):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::PageReservation):
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::committed):
+
+2011-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Convert markstack to a slot visitor API
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        Move the MarkStack over to a slot based marking API.
+
+        In order to avoiding aliasing concerns there are two new types
+        that need to be used when holding on to JSValues and JSCell that
+        need to be marked: WriteBarrier and DeprecatedPtr.  WriteBarrier
+        is expected to be used for any JSValue or Cell that's lifetime and
+        marking is controlled by another GC object.  DeprecatedPtr is used
+        for any value that we need to rework ownership for.
+
+        The change over to this model has produced a large amount of
+        code changes, but they are mostly mechanical (forwarding JSGlobalData,
+        etc).
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Register.h:
+        (JSC::Register::jsValueSlot):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::append):
+        (JSC::JSCell::MarkStack::appendCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::Holder::objectSlot):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::putUndefinedAtDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototypeSlot):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedGetSlot):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Added.
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrier::WriteBarrier):
+        (JSC::operator==):
+
+2011-01-28  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix after r76967
+
+        * wtf/ThreadingPrimitives.h: Use OS(WINDOWS) instead of PLATFORM(WIN), to match other
+        similar macros in this file.
+
+2011-01-28  Michael Saboff  <msaboff@apple.com>
+
+        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
+        https://bugs.webkit.org/show_bug.cgi?id=53271
+
+        Reapplying this this change.  No change from prior patch in
+        JavaScriptCore.
+
+        Added new isValid() methods to check if a contained object in
+        a WeakGCMap is valid when using an unchecked iterator.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::isValid):
+
+2011-01-27  Adam Roben  <aroben@apple.com>
+
+        Extract code to convert a WTF absolute time to a Win32 wait interval into a separate
+        function
+
+        Fixes <http://webkit.org/b/53208> <rdar://problem/8922490> BinarySemaphore should wrap a
+        Win32 event
+
+        Reviewed by Dave Hyatt.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export the new function.
+
+        * wtf/ThreadingPrimitives.h: Declare the new function.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadCondition::timedWait): Moved code to convert the absolute time to a wait
+        interval from here...
+        (WTF::absoluteTimeToWaitTimeoutInterval): ...to here.
+
+2011-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add basic rubber banding support
+        <rdar://problem/8219429>
+        https://bugs.webkit.org/show_bug.cgi?id=53277
+
+        * wtf/Platform.h: Add ENABLE for rubber banding.
+
+2011-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76893.
+        http://trac.webkit.org/changeset/76893
+        https://bugs.webkit.org/show_bug.cgi?id=53287
+
+        It made some tests crash on GTK and Qt debug bots (Requested
+        by Ossy on #webkit).
+
+        * runtime/WeakGCMap.h:
+
+2011-01-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add WTFString method to compare equality with Vector<UChar>
+        https://bugs.webkit.org/show_bug.cgi?id=53266
+
+        I'm planning to use this method in the new XSS filter implementation,
+        but it seems generally useful.
+
+        * wtf/text/StringImpl.h:
+        (WTF::equalIgnoringNullity):
+        * wtf/text/WTFString.h:
+        (WTF::equalIgnoringNullity):
+
+2011-01-27  Michael Saboff  <msaboff@apple.com>
+
+        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
+        https://bugs.webkit.org/show_bug.cgi?id=53271
+
+        Added new isValid() methods to check if a contained object in
+        a WeakGCMap is valid when using an unchecked iterator.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::isValid):
+
+2011-01-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add events to represent the start/end of a gesture scroll
+        https://bugs.webkit.org/show_bug.cgi?id=53215
+
+        * wtf/Platform.h: Add ENABLE for gesture events. 
+
+2011-01-26  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt][Symbian] Fix --minimal build
+        https://bugs.webkit.org/show_bug.cgi?id=52839
+
+        Move definition of USE_SYSTEM_MALLOC out of pri file.
+        Put it in platform.h instead.
+
+        * wtf/Platform.h:
+        * wtf/TCSystemAlloc.cpp:
+        * wtf/wtf.pri:
+
+2011-01-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [WINCE] Add JIT support to build system
+        https://bugs.webkit.org/show_bug.cgi?id=53079
+
+        * CMakeListsWinCE.txt:
+
+2011-01-25  Adam Roben  <aroben@apple.com>
+
+        Windows Production build fix
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Set BUILDSTYLE to Release_PGO at the very start
+        of the file so that ConfigurationBuildDir takes that into account. Also set it the right way
+        (by redefining the macro) rather than the wrong way (by modifying the environment variable).
+
+2011-01-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Windows production build fix.
+        Use correct environment variable escaping
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2011-01-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JSON.stringify processing time exponentially grows with size of object
+        https://bugs.webkit.org/show_bug.cgi?id=51922
+
+        Remove last use of reserveCapacity from JSON stringification, as it results
+        in appalling append behaviour when there are a large number of property names
+        and nothing else.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendQuotedString):
+
+2011-01-25  Antti Koivisto  <antti@apple.com>
+
+        Not reviewed.
+        
+        Try to fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-01-25  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION: Leak in JSParser::Scope::copyCapturedVariablesToVector()
+        https://bugs.webkit.org/show_bug.cgi?id=53061
+         
+        Cache did not know about the subclass so failed to fully delete the items. 
+        Got rid of the subclass and moved the classes to separate files.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::saveFunctionInfo):
+        (JSC::JSParser::Scope::restoreFunctionInfo):
+        (JSC::JSParser::findCachedFunctionInfo):
+        (JSC::JSParser::parseFunctionInfo):
+        * parser/SourceProvider.h:
+        * parser/SourceProviderCache.cpp: Added.
+        (JSC::SourceProviderCache::~SourceProviderCache):
+        (JSC::SourceProviderCache::byteSize):
+        * parser/SourceProviderCache.h: Added.
+        (JSC::SourceProviderCache::SourceProviderCache):
+        (JSC::SourceProviderCache::add):
+        (JSC::SourceProviderCache::get):
+        * parser/SourceProviderCacheItem.h: Added.
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+        (JSC::SourceProviderCacheItem::approximateByteSize):
+        (JSC::SourceProviderCacheItem::closeBraceToken):
+
+2011-01-25  Marcilio Mendonca  <mamendonca@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 53087: Refactoring: replaced a hanging "else" with a "return"
+        statement
+        https://bugs.webkit.org/show_bug.cgi?id=53087.
+
+        Refactoring work: Replaced a hanging "else" within an #if PLATFORM(M
+        with a "return" so that the code is more readable and less error pro
+        (e.g., "else" doesn't use braces so adding extra lines to the else
+        block won't have any effect; even worse, code still compiles
+        successfully.
+
+        * wtf/Assertions.cpp:
+
+2011-01-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Change ENABLE_3D_CANVAS to ENABLE_WEBGL
+        https://bugs.webkit.org/show_bug.cgi?id=53041
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-01-25  Adam Roben  <aroben@apple.com>
+
+        Windows Production build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Added a missing "set".
+
+2011-01-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add missing defines for COMPILER(RVCT) && CPU(ARM_THUMB2)
+        https://bugs.webkit.org/show_bug.cgi?id=52949
+
+        * jit/JITStubs.cpp:
+
+2011-01-24  Adam Roben  <aroben@apple.com>
+
+        Windows Production build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Update for move of JavaScriptCore into Source.
+
+2011-01-24  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Optimize regex patterns which contain empty alternatives
+        https://bugs.webkit.org/show_bug.cgi?id=51395
+
+        Eliminate the empty alternatives from the regex pattern and convert it to do
+        the matching in an easier way.
+
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
+
+2011-01-24  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Move project files into Source
+        https://bugs.webkit.org/show_bug.cgi?id=52891
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2011-01-23  Mark Rowe  <mrowe@apple.com>
+
+        Follow-up to r76477.
+
+        Fix the scripts that detect problematic code such as static initializers
+        and destructors, weak vtables, inappropriate files in the framework wrappers,
+        and public headers including private headers. These had all been broken
+        since the projects were moved in to the Source directory as the paths to the
+        scripts were not updated at that time.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use WTF::StringHasher in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=52934
+
+        Add an additional function to calculate the hash
+        of data with a runtimedependent size.
+
+        * wtf/StringHasher.h:
+        (WTF::StringHasher::createBlobHash):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Fix comment in String::ascii()
+        https://bugs.webkit.org/show_bug.cgi?id=52980
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::ascii):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Add String::containsOnlyLatin1()
+        https://bugs.webkit.org/show_bug.cgi?id=52979
+
+        * wtf/text/WTFString.h:
+        (WTF::String::containsOnlyLatin1):
+        (WTF::charactersAreAllLatin1):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove obsolete JSVALUE32 code
+        https://bugs.webkit.org/show_bug.cgi?id=52948
+
+        r70111 removed support for JSVALUE32.
+        ARM, MIPS and X86 support JSVALUE32_64 only.
+
+        * jit/JITStubs.cpp:
+
+2011-01-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        ASSERT running run-webkit-tests --threaded.
+        https://bugs.webkit.org/show_bug.cgi?id=52971
+        
+        SunSpider and v8 report no change.
+
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        (JSC::ConservativeSet::add):
+        * runtime/ConservativeSet.h: Tweaked the inline capacity to 128, and
+        the growth policy to 2X, to make SunSpider and v8 happy.
+        (JSC::ConservativeSet::ConservativeSet):
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark): Use OSAllocator directly, instead of malloc.
+        Malloc is forbidden during a multi-threaded mark phase because it can
+        cause deadlock.
+
+2011-01-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        A few of Maciej's review suggestions for my last patch.
+        https://bugs.webkit.org/show_bug.cgi?id=52946        
+
+        SunSpider reports no change.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated build systems.
+
+        * runtime/ConservativeSet.cpp: Added.
+        (JSC::isPointerAligned):
+        (JSC::ConservativeSet::add):
+        * runtime/ConservativeSet.h: Added.
+        (JSC::ConservativeSet::ConservativeSet):
+        (JSC::ConservativeSet::mark): Split ConservativeSet out into its own
+        file, and moved the conservative check into ConservativeSet::add, making
+        ConservativeSet's responsibility clearer.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        * runtime/MachineStackMarker.h:
+        * runtime/MarkStack.h: Updated for changes above.
+
+2011-01-22  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r76430.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::swapIfBackwards):
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Reorganized MarkedSpace, making many of its functions private.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::Heap::heap):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::globalData):
+        (JSC::MarkedSpace::heap):
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix build: moved helper function out of #ifdef.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::swapIfBackwards):
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        A few of Maciej's review suggestions for my last patch.
+        https://bugs.webkit.org/show_bug.cgi?id=52946        
+
+        SunSpider reports no change.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::swapIfBackwards): Added a helper function for handling platforms
+        where the stack can grow in any direction.
+
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markOtherThreadConservatively): Use the helper
+        function.
+
+        (JSC::isPointerAligned): Use "!" instead of "==0" because a robot told me to.
+
+        (JSC::MachineStackMarker::markConservatively): Changed to use a more
+        standard looping idiom, and to use the helper function above.
+
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::isCellAligned): Use "!" instead of "==0" because a robot told me to.
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Cleaned up some conservative marking code.
+        https://bugs.webkit.org/show_bug.cgi?id=52946
+        
+        SunSpider reports no change.
+
+        * interpreter/RegisterFile.h: No need for a special marking function,
+        since we already expose a start() and end().
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::registerFile):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        (JSC::Heap::contains): Migrated markConservatively() to the machine stack
+        marker class. Now, Heap just provides a contains() function, which the
+        machine stack marker uses for checking whether a pointer points into the heap.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        (JSC::isPointerAligned):
+        (JSC::MachineStackMarker::markConservatively):
+        * runtime/MachineStackMarker.h: Move the conservative marking code here.
+
+        * runtime/MarkStack.h:
+        (JSC::ConservativeSet::add):
+        (JSC::ConservativeSet::mark): Changed to using a vector instead of hash
+        set. Vector seems to be a bit faster, and it generates smaller code.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::containsSlowCase):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::isCellAligned):
+        (JSC::MarkedSpace::isPossibleCell):
+        (JSC::MarkedSpace::contains): Kept the code for determining whether a
+        pointer pointed into marked space, and moved the code for marking
+        a set of conservative pointers into the machine stack marker.
+
+        * wtf/HashSet.h:
+        (WTF::::add): Added two missing inlines that I noticed while testing
+        vector vs hash set.
+
+2011-01-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Work around a Clang bug <rdar://problem/8876150> that leads to it incorrectly emitting an access
+        control warning when a client tries to use operator bool exposed above via "using PageBlock::operator bool".
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::operator bool):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::operator bool):
+
+2011-01-21  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [RegexFuzz] Hang with forward assertion
+        https://bugs.webkit.org/show_bug.cgi?id=52825
+        <rdar://problem/8894332>
+
+        The backtrackTo label from the first term in a list of terms is
+        being overwritten by processing of subsequent terms.  Changed
+        copyBacktrackToLabel() to check for an existing bcaktrackTo label
+        before copying and renamed it to propagateBacktrackToLabel() since
+        it no longer copies.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::propagateBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Moved the mark stack from global data to the heap, since it pertains
+        to the heap, and not the virtual machine as a whole.
+        https://bugs.webkit.org/show_bug.cgi?id=52930
+        
+        SunSpider reports no change.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+
+2011-01-21  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r76177): All JavaScriptCore tests fail on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=52814
+
+        Get the approximateByteSize value before releasing the OwnPtr.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseFunctionInfo):
+
+2011-01-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Remove unnecessary <stdio.h> include
+        https://bugs.webkit.org/show_bug.cgi?id=52884
+
+        * jit/JIT.cpp: remove unnecessary include.
+
+2011-01-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Added OwnPtrCommon.h because OwnArrayPtr::set calls deleteOwnedPtr.
+
+        * wtf/OwnArrayPtr.h:
+
+2011-01-20  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [WINCE] Remove obsolete JSVALUE32 code
+        https://bugs.webkit.org/show_bug.cgi?id=52450
+
+        Remove the "offset hack" in create_jit_stubs, since we
+        only support JSVALUE32_64 in the meantime.
+
+        * create_jit_stubs: Removed offset argument
+        * jit/JITStubs.cpp:
+
+2011-01-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        When marking conservatively, guard against reviving dead objects.
+        https://bugs.webkit.org/show_bug.cgi?id=52840
+        
+        SunSpider and v8 say no change.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::markCallFrames): Updated to use the ConservativeSet API.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::recordExtraCost): No need to guard against conservative
+        marking reviving dead objects anymore, since the conservative marking
+        mechanism guards against this now.
+
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors): Don't drain the mark stack inside a
+        marking function. We want to establish a separation of concerns between
+        visiting roots and draining the mark stack.
+
+        (JSC::Heap::markRoots): Gather the set of conservative references before
+        clearning mark bits, because conservative marking now uses the mark bits
+        to determine if a reference is valid, and avoid reviving dead objects.
+
+        (JSC::Heap::collectAllGarbage): No need to guard against conservative
+        marking reviving dead objects anymore, since the conservative marking
+        mechanism guards against this now.
+
+        * runtime/Heap.h: Updated to use the ConservativeSet API.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markCurrentThreadConservatively):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        (JSC::MachineStackMarker::markMachineStackConservatively):
+        * runtime/MachineStackMarker.h: Ditto.
+
+        * runtime/MarkStack.h:
+        (JSC::ConservativeSet::add):
+        (JSC::ConservativeSet::mark): Added ConservativeSet, for gathering the
+        set of conservative references. This is different from MarkStack, since
+        we don't mark the set until it is completely gathered.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::resizeBlocks):
+        (JSC::MarkedSpace::markConservatively):
+        * runtime/MarkedSpace.h: When marking conservatively, guard against
+        reviving dead objects.
+
+2011-01-20  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [Symbian] Fix StackBounds::initialize()
+        https://bugs.webkit.org/show_bug.cgi?id=52842
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize): Use TThreadStackInfo.iLimit for stack limit
+
+2011-01-20  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/8890203> [RegexFuzz] Crash in generated code (52773)
+        https://bugs.webkit.org/show_bug.cgi?id=52773
+
+        Fixed case where an existing DataLabelPtr is overwritten.  The
+        replacing DataLabelPtr is now resolved immediately in
+        linkDataLabelToBacktrackIfExists().  Cleanup - eliminated bool
+        return value for the routine as it was never used.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists):
+
+2011-01-20  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt][WK2] WebKit2 enabled build fails to link
+
+        Work around undefined reference linking issues until the buildsystem gets redesigned.
+        These issues first occured in minimal builds (see BUG 50519).
+
+        * JavaScriptCore.pri: link as whole-archive for WebKit2 builds
+
+2011-01-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Refactoring of the custom allocation framework
+        https://bugs.webkit.org/show_bug.cgi?id=49897
+
+        Inheriting from FastAllocBase can result in objects getting larger (bug #33896, #46589).
+        The modification replaces Noncopyable and FastAllocBase classes and these inherits with their
+        equivalent macro implementation at the necessary places.
+
+        * wtf/FastAllocBase.h: Turn FastAllocBase's implementation into a macro.
+
+2011-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Follow-up to r75766 / <rdar://problem/5469576>.
+
+        We were failing to initialize the key, causing all sorts of unexpected behavior.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::setThreadHeap):
+        (WTF::TCMalloc_ThreadCache::GetThreadHeap):
+        (WTF::TCMalloc_ThreadCache::InitTSD): Ensure that the key is initialized.
+
+2011-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Rolled back in r76078, with crash fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=52668
+        
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren): Account for the fact that the global
+        object moves its variables into and out of the register file. While out
+        of the register file, the symbol table's size is not an accurate count
+        for the size of the register array, since the BytecodeGenerator might
+        be compiling, adding items to the symbol table.
+        
+2011-01-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Stack overflow when converting an Error object to string
+        https://bugs.webkit.org/show_bug.cgi?id=46410
+
+        * Android.mk: Added StringRecursionChecker.cpp and
+        StringRecursionChecker.h.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.pro: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString): Use StringRecursionChecker instead
+        of the older hand-written code to do the same thing.
+        (JSC::arrayProtoFuncToLocaleString): Ditto.
+        (JSC::arrayProtoFuncJoin): Ditto.
+
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString): Use StringRecursionChecker.
+
+        * runtime/JSGlobalData.h: Renamed arrayVisitedElements to
+        stringRecursionCheckVisitedObjects.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString): Use StringRecursionChecker.
+
+        * runtime/StringRecursionChecker.cpp: Added.
+        * runtime/StringRecursionChecker.h: Added.
+
+2011-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove non-spec support for callable RegExp
+        https://bugs.webkit.org/show_bug.cgi?id=28285
+
+        Remove support for callable regexps.  If it breaks sites we can
+        just roll this out.
+
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpObject.h:
+        * tests/mozilla/expected.html: update results.
+
+2011-01-19  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cache function offsets to speed up javascript parsing
+        https://bugs.webkit.org/show_bug.cgi?id=52622
+        
+        Use cache to save function offsets and some other info.
+        This avoids quite a bit of work when reparsing the source.
+
+        * parser/ASTBuilder.h:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::CachedFunctionInfo::CachedFunctionInfo):
+        (JSC::JSParser::CachedFunctionInfo::approximateByteSize):
+        (JSC::JSParser::CachedFunctionInfo::closeBraceToken):
+        (JSC::JSParser::Scope::copyCapturedVariablesToVector):
+        (JSC::JSParser::Scope::saveFunctionInfo):
+        (JSC::JSParser::Scope::restoreFunctionInfo):
+        (JSC::JSParser::findCachedFunctionInfo):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseFunctionInfo):
+        * parser/Lexer.h:
+        (JSC::Lexer::setOffset):
+        (JSC::Lexer::setLineNumber):
+        (JSC::Lexer::sourceProvider):
+        * parser/SourceProvider.h:
+        (JSC::SourceProviderCache::SourceProviderCache):
+        (JSC::SourceProviderCache::~SourceProviderCache):
+        (JSC::SourceProviderCache::byteSize):
+        (JSC::SourceProviderCache::add):
+        (JSC::SourceProviderCache::get):
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::~SourceProvider):
+        (JSC::SourceProvider::cache):
+        (JSC::SourceProvider::notifyCacheSizeChanged):
+        (JSC::SourceProvider::cacheSizeChanged):
+        * parser/SyntaxChecker.h:
+
+2011-01-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Follow-up to r75766 / <rdar://problem/5469576>.
+
+        * DerivedSources.make: Evaluate the SDKROOT variable correctly.
+
+2011-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] Defining a function called __proto__ inside an eval triggers an assertion
+        https://bugs.webkit.org/show_bug.cgi?id=52672
+
+        Rather than coming up with a somewhat convoluted mechanism to ensure that
+        developers can override the global objects prototype with a function named
+        __proto__ and expect it to work, we just disallow it at the syntax level.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseFunctionInfo):
+
+2011-01-19  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/8882994> Regression: Simple nested backtrack hangs
+        https://bugs.webkit.org/show_bug.cgi?id=52675
+
+        The changeset (r76076) for https://bugs.webkit.org/show_bug.cgi?id=52540
+        broke simple backtracking in some cases.  Reworked that change to 
+        link both jumps and labels.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::hasBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::propagateBacktrackingFrom):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+
+2011-01-19  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [JSC] scripts have incorrect starting line (always 1).
+        https://bugs.webkit.org/show_bug.cgi?id=52721
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * debugger/Debugger.h:
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::startPosition):
+
+2011-01-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Laszlo Gombos and Tor Arne Vestbø.
+
+        [Qt] Remove unnecessary "../Source" from paths
+        after moving source files into Source is finished.
+
+        * JavaScriptCore.pri:
+
+2011-01-19  Benjamin Kalman  <kalman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Don't return void from void function String::split
+        https://bugs.webkit.org/show_bug.cgi?id=52684
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::split):
+
+2011-01-18  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r76078.
+        http://trac.webkit.org/changeset/76078
+        https://bugs.webkit.org/show_bug.cgi?id=52668
+
+        Caused crashes of fast/canvas/webgl/constants.html,
+        fast/canvas/webgl/gl-enum-tests.html, and possibly other layout
+        test crashes in Release mode. WebGL crashes were observed with
+        "run-webkit-tests fast/canvas/webgl". It was necessary to run
+        multiple tests to provoke the crash.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::markGlobals):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren):
+
+2011-01-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] Assertion asking activation for arguments when arguments is overridden
+        https://bugs.webkit.org/show_bug.cgi?id=52690
+
+        Clean up code to retrieve arguments from activation and function objects.
+        Remove the incorrect assertion from JSActivation's argumentsGetter.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveArguments):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+
+2011-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removed RegisterFile::markGlobals because it was obtuse, and it
+        unnecessarily relied on conservative marking.
+        https://bugs.webkit.org/show_bug.cgi?id=52668
+
+        * interpreter/RegisterFile.h: Removed markGlobals.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren): Added a comment explaning why some
+        JSActivations don't always mark their registers arrays.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren): Instead of calling markGlobals, mark
+        the registers array directly.
+
+2011-01-18  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/8875432> Regression: Some text-only e-mails cause hang beneath RegExp::match (52540)
+        https://bugs.webkit.org/show_bug.cgi?id=52540
+        https://bugs.webkit.org/show_bug.cgi?id=52662
+
+        Directly use backtrack label with parentheses nested under a
+        non-capturing parentheses.  Also linked current parentheses
+        tail code object for possible parens nested within a non-capturing
+        parentheses.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+
+2011-01-18  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Only use moving memory model assumption in ExecutableAllocator::intializePageSize() for Symbian OS
+        https://bugs.webkit.org/show_bug.cgi?id=52517
+
+        Patch by David Tapuska
+
+        Currently, we compile code with respect to the Symbian-specific moving memory model
+        assumption for all ARMv5 or lower architectures. Instead, we should only compile
+        such code when building for Symbian OS on those architectures because this model
+        is Symbian-specific.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+
+2011-01-18  Dimitry Andric  <dim@freebsd.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix linking JavaScriptCore on FreeBSD/amd64
+        https://bugs.webkit.org/show_bug.cgi?id=52591
+
+        Linking of JavaScriptCore on FreeBSD/amd64 fails, for the same reason as
+        in bug 28422: cti_vm_throw needs a "@plt" suffix, otherwise the linker
+        complains about the relocation type.
+
+        * jit/JITStubs.cpp: use @plt suffix on x86_64 platforms, for both Linux
+        and FreeBSD.
+
+2011-01-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        [jsfunfuzz] Assertion in codegen for array of NaN constants
+        https://bugs.webkit.org/show_bug.cgi?id=52643
+
+        Don't cache NaN literals in the code generator, as NaN doesn't compare
+        as equal to itself it causes problems when rehashing the number cache.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+
+2011-01-17  Jarred Nicholls  <jarred@sencha.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        REGRESSION(r75709): Return value of fscanf() shouldn't be ignored.
+        https://bugs.webkit.org/show_bug.cgi?id=52585
+        
+        gcc 4.4.4+ has warn_unused_value attribute on fscanf, so we should check
+        the return value to get around the gcc warning
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::maybeModifyVMPoolSize):
+
+2011-01-17  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [regexfuzz] Crash running regex with lookahead
+        https://bugs.webkit.org/show_bug.cgi?id=52548
+
+        Eliminated agressive chaining of backtracks.  This code was overwriting
+        already valid backtrack information.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::processBacktracks):
+
+2011-01-17  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix some headers with missing or misspelled #ifndef guards
+        https://bugs.webkit.org/show_bug.cgi?id=52545
+
+        * wtf/RefPtrHashMap.h:
+
+2011-01-17  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Update xcodeproj svn:ignore to include xcuserdata.
+
+        * JavaScriptCore.xcodeproj: Modified property svn:ignore.
+
+2011-01-16  Adam Barth  <abarth@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        Move WebKit into Source
+        https://bugs.webkit.org/show_bug.cgi?id=52530
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2011-01-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        [jsfunfuzz] Parser doesn't correctly validate for-loop syntax
+        https://bugs.webkit.org/show_bug.cgi?id=52516
+
+        Ensure that we always check for a semicolon after encountering
+        multiple declarations in the initialiser portion of a for-loop.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseForStatement):
+
+2011-01-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Strict mode restrictions on arguments and eval usage aren't complete
+        https://bugs.webkit.org/show_bug.cgi?id=52528
+
+        Fix a few bugs in strict mode where we incorrect allow mutation of
+        arguments and eval in the parser.
+
+        Alas the "optimisation" used by the syntax checker for validating
+        binary and unary expressions was too aggressive: we do actually need
+        a stack for operations and operands although it needn't be as complete
+        as that used for the full AST builder.
+
+        Also disallow assignment to arguments in all cases as allowing arguments
+        to be assignable is always an error in strict mode, regardless of context.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::BinaryExprContext::BinaryExprContext):
+        (JSC::ASTBuilder::UnaryExprContext::UnaryExprContext):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseAssignmentExpression):
+        (JSC::JSParser::parseBinaryExpression):
+        (JSC::JSParser::parseUnaryExpression):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::BinaryExprContext::BinaryExprContext):
+        (JSC::SyntaxChecker::BinaryExprContext::~BinaryExprContext):
+        (JSC::SyntaxChecker::UnaryExprContext::UnaryExprContext):
+        (JSC::SyntaxChecker::UnaryExprContext::~UnaryExprContext):
+        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2011-01-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Rolled back in r75886.
+        https://bugs.webkit.org/show_bug.cgi?id=52527
+        
+        r75886 broke the GTK Linux bot because Linux was -- quite surprisingly --
+        set up to use the constants for embedded devices.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::maybeModifyVMPoolSize): Separated Linux constants from embedded
+        constants.
+
+2011-01-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r75886.
+        http://trac.webkit.org/changeset/75886
+        https://bugs.webkit.org/show_bug.cgi?id=52526
+
+        "Broke GTK+ 64bit" (Requested by xan_ on #webkit).
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2011-01-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8870429> Shrink the executable pool on embedded devices
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp: Dropped the pool size from 32MB
+        to 16MB.
+
+2011-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Incorrect behavior changing attributes of an accessor
+        https://bugs.webkit.org/show_bug.cgi?id=52515
+
+        defineProperty doesn't correctly handle changing attributes of an accessor
+        property.  This is because we don't pass the full descriptor to the 
+        putDescriptor helper function, which means we have insufficient information
+        to do the right thing. Once that's passed the correct behavior is relatively
+        simple to implement.
+
+        * runtime/JSObject.cpp:
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+
+2011-01-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [jsfunfuzz] Incorrect handling of consecutive duplicate labels
+        https://bugs.webkit.org/show_bug.cgi?id=52505
+
+        Compare StringImpl*'s instead of Identifier*'s when looking for duplicate
+        labels.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+
+2011-01-14  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+        
+        Initialize m_operationInProgress after r75855.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+
+2011-01-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reverted accidentally committed code from my last checkin.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+
+2011-01-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Try to fix the GTK bot.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots): Kids, remember to initialize your data members.
+        Knowing is half the battle.
+
+2011-01-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        [jsfunfuzz] We should be clearing the lexers temporary character buffers when switching to strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=52501
+
+        Clear the temporary character buffers used for reading escaped characters and
+        numbers.
+
+        * parser/Lexer.h:
+        (JSC::Lexer::setOffset):
+
+2011-01-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix non-Dtrace builds: #include Tracing.h instead of TracingDtrace.h.
+
+        * runtime/Heap.cpp:
+
+2011-01-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Split out a MarkedSpace strategy object from Heap.
+        https://bugs.webkit.org/show_bug.cgi?id=52421
+        
+        SunSpider reports no change.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated our 7 build systems. Which is cool.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::recordExtraCost):
+        (JSC::Heap::allocate):
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::statistics):
+        (JSC::Heap::size):
+        (JSC::Heap::isBusy):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::primaryHeapBegin):
+        (JSC::Heap::primaryHeapEnd):
+        * runtime/Heap.h:
+        (JSC::Heap::globalData):
+        (JSC::Heap::markedSpace):
+        (JSC::Heap::isCellMarked):
+        (JSC::Heap::checkMarkCell):
+        (JSC::Heap::markCell): Moved all code pertaining to managing chunks of
+        collector memory out of this class. Heap now just delegates to MarkedSpace.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::Heap::heap): Updated for MarkedSpace delegation.
+
+        * runtime/JSValue.h: Moved the ValueStringPair typedef to help with #includes.
+
+        * runtime/MarkedSpace.cpp: Copied from runtime/Heap.cpp.
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::destroy):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::resizeBlocks):
+        (JSC::MarkedSpace::growBlocks):
+        (JSC::MarkedSpace::shrinkBlocks):
+        (JSC::MarkedSpace::markConservatively):
+        (JSC::MarkedSpace::clearMarkBits):
+        (JSC::MarkedSpace::markedCells):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::addToStatistics):
+        (JSC::MarkedSpace::statistics):
+        (JSC::MarkedSpace::size):
+        (JSC::MarkedSpace::reset):
+        (JSC::MarkedSpace::primaryHeapBegin):
+        (JSC::MarkedSpace::primaryHeapEnd):
+        * runtime/MarkedSpace.h: Copied from runtime/Heap.h.
+        (JSC::MarkedSpace::globalData):
+        (JSC::MarkedSpace::didShrink):
+        (JSC::MarkedSpace::cellBlock):
+        (JSC::MarkedSpace::cellOffset):
+        (JSC::MarkedSpace::isCellMarked):
+        (JSC::MarkedSpace::checkMarkCell):
+        (JSC::MarkedSpace::markCell): Moved all code pertaining to managing chunks of
+        collector memory into this class.
+
+        * runtime/MemoryStatistics.cpp:
+        (JSC::heapStatistics):
+        * runtime/MemoryStatistics.h: Updated for MarkedSpace delegation.
+
+2011-01-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] parser doesn't enforce continue restrictions correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=52493
+
+        This patch reworks handling of break, continue and label statements
+        to correctly handle all the valid and invalid cases.  Previously certain
+        errors would be missed by the parser in strict mode, but the bytecode 
+        generator needed to handle those cases for non-strict code so nothing
+        failed, it simply became non-standard behaviour.
+
+        Now that we treat break and continue errors as early faults in non-strict
+        mode as well that safety net has been removed so the parser bugs result in
+        crashes at codegen time.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::ScopeLabelInfo::ScopeLabelInfo):
+        (JSC::JSParser::next):
+        (JSC::JSParser::nextTokenIsColon):
+        (JSC::JSParser::continueIsValid):
+            Continue is only valid in loops so we can't use breakIsValid()
+        (JSC::JSParser::pushLabel):
+            We now track whether the label is for a loop (and is therefore a
+            valid target for continue.
+        (JSC::JSParser::popLabel):
+        (JSC::JSParser::getLabel):
+            Replace hasLabel with getLabel so that we can validate the target
+            when parsing continue statements.
+        (JSC::JSParser::Scope::continueIsValid):
+        (JSC::JSParser::Scope::pushLabel):
+        (JSC::JSParser::Scope::getLabel):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseBreakStatement):
+        (JSC::JSParser::parseContinueStatement):
+        (JSC::LabelInfo::LabelInfo):
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+            Consecutive labels now get handled iteratively so that we can determine
+            whether they're valid targets for continue.
+        * parser/Lexer.cpp:
+        (JSC::Lexer::nextTokenIsColon):
+        * parser/Lexer.h:
+        (JSC::Lexer::setOffset):
+
+2011-01-14  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Use the Windows thread pool instead of an extra thread for FastMalloc scavenging
+        https://bugs.webkit.org/show_bug.cgi?id=45186
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scheduleScavenger): Added missing this pointer to CreateTimerQueueTimer().
+
+2011-01-14  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Use the Windows thread pool instead of an extra thread for FastMalloc scavenging
+        https://bugs.webkit.org/show_bug.cgi?id=45186
+
+        r75819 accidentally changed the initial state of the scavenge timer.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Changed initial state of m_scavengingSuspended to true.
+
+2011-01-14  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed Windows Release build fix.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavengerTimerFired):
+
+2011-01-14  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed Windows Release build fix.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavengerTimerFired):
+
+2011-01-14  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Use the Windows thread pool instead of an extra thread for FastMalloc scavenging
+        https://bugs.webkit.org/show_bug.cgi?id=45186
+
+        Use CreateTimerQueueTimer() to start periodicScavenge() and stop it with DeleteTimerQueueTimer().
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+        (WTF::TCMalloc_PageHeap::isScavengerSuspended):
+        (WTF::TCMalloc_PageHeap::scheduleScavenger):
+        (WTF::TCMalloc_PageHeap::rescheduleScavenger):
+        (WTF::TCMalloc_PageHeap::suspendScavenger):
+        (WTF::scavengerTimerFired):
+        (WTF::TCMalloc_PageHeap::periodicScavenge):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+
+2011-01-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Align import/export directives
+        https://bugs.webkit.org/show_bug.cgi?id=52208
+
+        * API/JSBase.h: Align import/export directives with
+        WebKit2/Shared/API/c/WKBase.h
+
+2011-01-14  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Incorrect backtracking for nested alternatives
+        https://bugs.webkit.org/show_bug.cgi?id=52387
+
+        In the process of propigating a datalabel it wasn't getting connected
+        to a destination when the destination was an indirect jump.  Added
+        code to recognize a direct backtrack destination that was an indirect
+        jump and added mechanism to associate DataLabelPtrs with indirect
+        jump entries.
+        Removed dead method
+        BacktrackDestination::linkDataLabelToHereIfExists()
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::IndirectJumpEntry::IndirectJumpEntry):
+        (JSC::Yarr::YarrGenerator::IndirectJumpEntry::addDataLabel):
+        (JSC::Yarr::YarrGenerator::GenerationState::addIndirectJumpEntry):
+        (JSC::Yarr::YarrGenerator::GenerationState::emitIndirectJumpTable):
+        Changes to link indirect jumps with DataLabelPtr's.
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::clearSubDataLabelPtr):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists): 
+        Updated to handle immediate linking of indirect jumps to
+        DataLabelPtr.
+        (JSC::Yarr::YarrGenerator::generateParenthesesDisjunction): Changed to
+        reflect updated linkDataLabelToBacktrackIfExists().
+
+2011-01-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: provide script column offset to frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=52377
+
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+        (JSC::SourceCode::firstColumn):
+
+2011-01-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/5469576> Use __PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0 if available.
+
+        * DerivedSources.make: Create a header file, HeaderDetection.h, that tells
+        us whether pthread_machdep.h is available.
+        * wtf/FastMalloc.cpp: If __PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0 is available, then
+        don't do the pthread_getspecific_function_pointer trick.
+        (WTF::setThreadHeap): Ditto, but set thread-specific data.
+        (WTF::TCMalloc_ThreadCache::GetThreadHeap): Ditto, but get rather than set.
+
+2011-01-13  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JIT requires VM overcommit (particularly on x86-64), Linux does not by default support this without swap?
+        https://bugs.webkit.org/show_bug.cgi?id=42756
+
+        The FixedVMPool Allocator does not work well on systems where
+        allocating very large amounts of memory upfront is not reasonable,
+        like Linux without overcommit enabled. As a workaround, on Linux,
+        default to the values used in embedded environments (in the MB
+        range), and only jump to the GB range if we detect at runtime that
+        overcommit is enabled. Should fix crashes on Linux/x86_64 with
+        less than 3 or 4GB of RAM.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::free): use new variables for VM pool
+        size and coalesce limit.
+        (JSC::ExecutableAllocator::isValid): swap the variables from
+        embedded to generic values at runtime, on linux, if overcommit is
+        enabled.
+        (JSC::ExecutableAllocator::underMemoryPressure): use new variables
+        for VM pool size and coalesce limit.
+
+2011-01-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Add new Yarr.h header to the list file.
+
+        * GNUmakefile.am: ditto.
+
+2011-01-12  Martin Robinson  <mrobinson@igalia.com>
+
+        Missing Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h in WebKitGtk tarball
+        https://bugs.webkit.org/show_bug.cgi?id=52299
+
+        * GNUmakefile.am: Fix the GTK+ build on ARMv7 by including missing source
+        files in the source list.
+
+2011-01-12  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Add Yarr.h to YARR
+        https://bugs.webkit.org/show_bug.cgi?id=51021
+
+        Move other common constants and functions from YARR's different files
+        to Yarr.h.
+        Use Yarr.h header instead of including other YARR headers where it
+        is possible.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        * yarr/Yarr.h: Added.
+        * yarr/YarrInterpreter.cpp:
+        * yarr/YarrInterpreter.h:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::jitCompile):
+        (JSC::Yarr::execute):
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPattern::compile):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h:
+
+2011-01-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r75595.
+        http://trac.webkit.org/changeset/75595
+        https://bugs.webkit.org/show_bug.cgi?id=52286
+
+        It broke fast/regex/pcre-test-1.html (Requested by Ossy on
+        #webkit).
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        * yarr/Yarr.h: Removed.
+        * yarr/YarrInterpreter.cpp:
+        * yarr/YarrInterpreter.h:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::jitCompile):
+        * yarr/YarrJIT.h:
+        (JSC::Yarr::execute):
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::compile):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h:
+
+2011-01-12  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Add Yarr.h to YARR
+        https://bugs.webkit.org/show_bug.cgi?id=51021
+
+        Move other common constants and functions from YARR's different files
+        to Yarr.h.
+        Use Yarr.h header instead of including other YARR headers where it
+        is possible.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        * yarr/Yarr.h: Added.
+        * yarr/YarrInterpreter.cpp:
+        * yarr/YarrInterpreter.h:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::jitCompile):
+        (JSC::Yarr::execute):
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPattern::compile):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h:
+
+2011-01-11  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Missing call to popTempSortVector() for exception case in JSArray::sort.
+        https://bugs.webkit.org/show_bug.cgi?id=50718
+
+        Fix to patch of 50718 that added pushTempSortVector() and 
+        popTempSortVector() to JSArray::sort() to mark elements during sort.
+        Need to add popTempSortVector() for the return case if toString()
+        had an exception.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort): Added popTempSortVector()
+
+2011-01-11  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Darin Adler.
+
+        Microoptimization in ~JSString
+        https://bugs.webkit.org/show_bug.cgi?id=52222
+
+        The case where m_fibers is 0 seems to be the most common one
+        (almost 1/2 of the time, followed at some distance by m_fibers = 1
+        in 1/4 of the cases in a typical SunSpider execution). We can save
+        one comparison in this common case by doing a bit of refactoring
+        in the JSString destructor; overall a 0.3% progression, but only
+        the string tests show improvement.
+
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::~JSString):
+
+2011-01-10  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        ASSERTION Failure in JSC::binaryChop
+        https://bugs.webkit.org/show_bug.cgi?id=25614
+
+        Changed JITStubs::cti_register_file_check() to use the current stack's
+        return PC to find the bytecode for handling the exception in the prior
+        frame.  Also added the appropriate arrity check routine call to the
+        JIT to bytecode vector (m_callReturnIndexVector) in the CodeBlock.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile): Changed the arrity check call location
+        so that it gets added to the m_calls list so that it's included in
+        CodeBlock::m_callReturnIndexVector.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Use the current call frame's return PC.
+
+2011-01-10  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Martin Robinson.
+
+        Remove extraneous COMPILER(GCC) condition when checking GCC_VERSION_AT_LEAST()
+        https://bugs.webkit.org/show_bug.cgi?id=52178
+
+        It is sufficient to test GCC_VERSION_AT_LEAST() instead of both COMPILER(GCC) and
+        GCC_VERSION_AT_LEAST(). Notice GCC_VERSION_AT_LEAST() is defined to be 0 when we
+        are not compiling with GCC.
+
+        Fixes style issues at the callsites (i.e. replace comma with comma-space in
+        macro function argument list). Also, makes a spelling correction in a comment.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * wtf/Platform.h:
+
+2011-01-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: removed some uses of nextNumber that I missed last time.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset):
+        (JSC::Heap::collectAllGarbage):
+
+2011-01-10  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Use __builtin_expect when compiling using RVCT in GNU mode
+        https://bugs.webkit.org/show_bug.cgi?id=51866
+
+        We should only use __builtin_expect if we are compiling with GCC or RVCT 3 or higher in GNU mode
+        as pointed out by Siddharth Mathur per <http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0202h/Cjabddedbde.html>.
+
+        * wtf/AlwaysInline.h:
+        * wtf/Platform.h: Removed define WTF_COMPILER_RVCT4_OR_GREATER. Instead added macro
+        function RVCT_VERSION_AT_LEAST so that we can test for an arbitrary minimum RVCT
+        version.
+
+2011-01-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Moved Collector.* => Heap.*, since the file contains a class named "Heap".
+
+        * API/JSCallbackObject.cpp:
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        * interpreter/RegisterFile.h:
+        * jit/JITStubs.cpp:
+        * runtime/Collector.cpp: Removed.
+        * runtime/Collector.h: Removed.
+        * runtime/CollectorHeapIterator.h:
+        * runtime/GCActivityCallbackCF.cpp:
+        * runtime/Heap.cpp: Copied from JavaScriptCore/runtime/Collector.cpp.
+        * runtime/Heap.h: Copied from JavaScriptCore/runtime/Collector.h.
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+        * runtime/JSLock.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/MachineStackMarker.cpp:
+        * runtime/MemoryStatistics.h:
+        * runtime/Protect.h:
+        * runtime/UString.cpp:
+        * runtime/WeakGCMap.h:
+        * runtime/WeakGCPtr.h:
+
+2011-01-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove unused isString() case in JSString::toPrimitiveString()
+        https://bugs.webkit.org/show_bug.cgi?id=52167
+
+        We never call toPrimitiveString() with strings, so remove the
+        check and add an ASSERT ensuring this never happens. 0.7% overall
+        progression in sunspider, since one of the call sites is very hot.
+
+        * runtime/JSString.h:
+        (JSC::JSValue::toPrimitiveString):
+
+2011-01-10  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Rename the existing YARR files and classes
+        https://bugs.webkit.org/show_bug.cgi?id=51872
+
+        Replace the "Regex" prefix with "Yarr" in the name of YARR files and classes.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        (JSC::RegExp::printTraceData):
+        * yarr/YarrInterpreter.cpp: Renamed from Source/JavaScriptCore/yarr/RegexInterpreter.cpp.
+        (JSC::Yarr::Interpreter::appendParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::popParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::DisjunctionContext::DisjunctionContext):
+        (JSC::Yarr::Interpreter::DisjunctionContext::operator new):
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::operator new):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::restoreOutput):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::getDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::InputStream::InputStream):
+        (JSC::Yarr::Interpreter::InputStream::next):
+        (JSC::Yarr::Interpreter::InputStream::rewind):
+        (JSC::Yarr::Interpreter::InputStream::read):
+        (JSC::Yarr::Interpreter::InputStream::readPair):
+        (JSC::Yarr::Interpreter::InputStream::readChecked):
+        (JSC::Yarr::Interpreter::InputStream::reread):
+        (JSC::Yarr::Interpreter::InputStream::prev):
+        (JSC::Yarr::Interpreter::InputStream::getPos):
+        (JSC::Yarr::Interpreter::InputStream::setPos):
+        (JSC::Yarr::Interpreter::InputStream::atStart):
+        (JSC::Yarr::Interpreter::InputStream::atEnd):
+        (JSC::Yarr::Interpreter::InputStream::checkInput):
+        (JSC::Yarr::Interpreter::InputStream::uncheckInput):
+        (JSC::Yarr::Interpreter::InputStream::isNotAvailableInput):
+        (JSC::Yarr::Interpreter::testCharacterClass):
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::checkCasedCharacter):
+        (JSC::Yarr::Interpreter::checkCharacterClass):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::matchAssertionBOL):
+        (JSC::Yarr::Interpreter::matchAssertionEOL):
+        (JSC::Yarr::Interpreter::matchAssertionWordBoundary):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
+        (JSC::Yarr::Interpreter::matchCharacterClass):
+        (JSC::Yarr::Interpreter::backtrackCharacterClass):
+        (JSC::Yarr::Interpreter::matchBackReference):
+        (JSC::Yarr::Interpreter::backtrackBackReference):
+        (JSC::Yarr::Interpreter::recordParenthesesMatch):
+        (JSC::Yarr::Interpreter::resetMatches):
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
+        (JSC::Yarr::Interpreter::matchParenthesesTerminalEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalEnd):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionBegin):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionEnd):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionEnd):
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::Interpreter::lookupForBeginChars):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::matchNonZeroDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::Interpreter::Interpreter):
+        (JSC::Yarr::ByteCompiler::ParenthesesStackEntry::ParenthesesStackEntry):
+        (JSC::Yarr::ByteCompiler::ByteCompiler):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::checkInput):
+        (JSC::Yarr::ByteCompiler::assertionBOL):
+        (JSC::Yarr::ByteCompiler::assertionEOL):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
+        (JSC::Yarr::ByteCompiler::popParenthesesStack):
+        (JSC::Yarr::ByteCompiler::dumpDisjunction):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::regexEnd):
+        (JSC::Yarr::ByteCompiler::alternativeBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alternativeDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        (JSC::Yarr::byteCompile):
+        (JSC::Yarr::interpret):
+        * yarr/YarrInterpreter.h: Renamed from Source/JavaScriptCore/yarr/RegexInterpreter.h.
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BOL):
+        (JSC::Yarr::ByteTerm::CheckInput):
+        (JSC::Yarr::ByteTerm::EOL):
+        (JSC::Yarr::ByteTerm::WordBoundary):
+        (JSC::Yarr::ByteTerm::BackReference):
+        (JSC::Yarr::ByteTerm::BodyAlternativeBegin):
+        (JSC::Yarr::ByteTerm::BodyAlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::BodyAlternativeEnd):
+        (JSC::Yarr::ByteTerm::AlternativeBegin):
+        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::AlternativeEnd):
+        (JSC::Yarr::ByteTerm::SubpatternBegin):
+        (JSC::Yarr::ByteTerm::SubpatternEnd):
+        (JSC::Yarr::ByteTerm::invert):
+        (JSC::Yarr::ByteTerm::capture):
+        (JSC::Yarr::ByteDisjunction::ByteDisjunction):
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        (JSC::Yarr::BytecodePattern::~BytecodePattern):
+        * yarr/YarrJIT.cpp: Renamed from Source/JavaScriptCore/yarr/RegexJIT.cpp.
+        (JSC::Yarr::YarrGenerator::optimizeAlternative):
+        (JSC::Yarr::YarrGenerator::matchCharacterClassRange):
+        (JSC::Yarr::YarrGenerator::matchCharacterClass):
+        (JSC::Yarr::YarrGenerator::jumpIfNoAvailableInput):
+        (JSC::Yarr::YarrGenerator::jumpIfAvailableInput):
+        (JSC::Yarr::YarrGenerator::checkInput):
+        (JSC::Yarr::YarrGenerator::atEndOfInput):
+        (JSC::Yarr::YarrGenerator::notAtEndOfInput):
+        (JSC::Yarr::YarrGenerator::jumpIfCharEquals):
+        (JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
+        (JSC::Yarr::YarrGenerator::readCharacter):
+        (JSC::Yarr::YarrGenerator::storeToFrame):
+        (JSC::Yarr::YarrGenerator::storeToFrameWithPatch):
+        (JSC::Yarr::YarrGenerator::loadFromFrame):
+        (JSC::Yarr::YarrGenerator::loadFromFrameAndJump):
+        (JSC::Yarr::YarrGenerator::IndirectJumpEntry::IndirectJumpEntry):
+        (JSC::Yarr::YarrGenerator::IndirectJumpEntry::addJump):
+        (JSC::Yarr::YarrGenerator::AlternativeBacktrackRecord::AlternativeBacktrackRecord):
+        (JSC::Yarr::YarrGenerator::GenerationState::GenerationState):
+        (JSC::Yarr::YarrGenerator::GenerationState::addIndirectJumpEntry):
+        (JSC::Yarr::YarrGenerator::GenerationState::emitIndirectJumpTable):
+        (JSC::Yarr::YarrGenerator::GenerationState::incrementParenNestingLevel):
+        (JSC::Yarr::YarrGenerator::GenerationState::decrementParenNestingLevel):
+        (JSC::Yarr::YarrGenerator::GenerationState::addParenthesesTail):
+        (JSC::Yarr::YarrGenerator::GenerationState::emitParenthesesTail):
+        (JSC::Yarr::YarrGenerator::GenerationState::addJumpToNextInteration):
+        (JSC::Yarr::YarrGenerator::GenerationState::addJumpsToNextInteration):
+        (JSC::Yarr::YarrGenerator::GenerationState::addDataLabelToNextIteration):
+        (JSC::Yarr::YarrGenerator::GenerationState::linkToNextIteration):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::BacktrackDestination):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::clear):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::clearDataLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::hasDestination):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::isStackOffset):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::isLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::isJumpList):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::hasDataLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::copyTarget):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::copyTo):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::addBacktrackJump):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setStackOffset):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setNextBacktrackLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::copyBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setBacktrackJumpList):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setBacktrackSourceLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setDataLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setSubDataLabelPtr):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkToNextBacktrack):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::getStackOffset):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::getLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::getBacktrackJumps):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::getDataLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::jumpToBacktrack):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkDataLabelToHereIfExists):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::plantJumpToBacktrackIfExists):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkAlternativeBacktracks):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkAlternativeBacktracksTo):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::resetAlternative):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::alternativeValid):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::nextAlternative):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::alternative):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::isLastAlternative):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::resetTerm):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::termValid):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::nextTerm):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::term):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::isLastTerm):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::getSubParenNum):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::isMainDisjunction):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setParenthesesTail):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::getParenthesesTail):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::lookaheadTerm):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::isSinglePatternCharacterLookaheadTerm):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::inputOffset):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::clearBacktrack):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::jumpToBacktrack):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::plantJumpToBacktrackIfExists):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::addBacktrackJump):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setBacktrackDataLabel):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setBackTrackStackOffset):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setBacktrackLabel):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::linkAlternativeBacktracks):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::linkAlternativeBacktracksTo):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setBacktrackLink):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::chainBacktracks):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::chainBacktrackJumps):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::getBacktrackDestination):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::propagateBacktrackingFrom):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::ParenthesesTail):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::processBacktracks):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::setNextIteration):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::addAfterParenJump):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::YarrGenerator::generateAssertionBOL):
+        (JSC::Yarr::YarrGenerator::generateAssertionEOL):
+        (JSC::Yarr::YarrGenerator::matchAssertionWordchar):
+        (JSC::Yarr::YarrGenerator::generateAssertionWordBoundary):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterSingle):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterPair):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassSingle):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+        (JSC::Yarr::YarrGenerator::generateParenthesesGreedyNoBacktrack):
+        (JSC::Yarr::YarrGenerator::generateParentheticalAssertion):
+        (JSC::Yarr::YarrGenerator::generateTerm):
+        (JSC::Yarr::YarrGenerator::generateDisjunction):
+        (JSC::Yarr::YarrGenerator::generateEnter):
+        (JSC::Yarr::YarrGenerator::generateReturn):
+        (JSC::Yarr::YarrGenerator::YarrGenerator):
+        (JSC::Yarr::YarrGenerator::generate):
+        (JSC::Yarr::YarrGenerator::compile):
+        (JSC::Yarr::jitCompile):
+        * yarr/YarrJIT.h: Renamed from Source/JavaScriptCore/yarr/RegexJIT.h.
+        (JSC::Yarr::YarrCodeBlock::YarrCodeBlock):
+        (JSC::Yarr::YarrCodeBlock::~YarrCodeBlock):
+        (JSC::Yarr::YarrCodeBlock::setFallBack):
+        (JSC::Yarr::YarrCodeBlock::isFallBack):
+        (JSC::Yarr::YarrCodeBlock::set):
+        (JSC::Yarr::YarrCodeBlock::execute):
+        (JSC::Yarr::YarrCodeBlock::getAddr):
+        (JSC::Yarr::execute):
+        * yarr/YarrParser.h: Renamed from Source/JavaScriptCore/yarr/RegexParser.h.
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::begin):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::end):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::assertionWordBoundary):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBackReference):
+        (JSC::Yarr::Parser::Parser):
+        (JSC::Yarr::Parser::parseEscape):
+        (JSC::Yarr::Parser::parseAtomEscape):
+        (JSC::Yarr::Parser::parseCharacterClassEscape):
+        (JSC::Yarr::Parser::parseCharacterClass):
+        (JSC::Yarr::Parser::parseParenthesesBegin):
+        (JSC::Yarr::Parser::parseParenthesesEnd):
+        (JSC::Yarr::Parser::parseQuantifier):
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::Parser::parse):
+        (JSC::Yarr::Parser::saveState):
+        (JSC::Yarr::Parser::restoreState):
+        (JSC::Yarr::Parser::atEndOfPattern):
+        (JSC::Yarr::Parser::peek):
+        (JSC::Yarr::Parser::peekIsDigit):
+        (JSC::Yarr::Parser::peekDigit):
+        (JSC::Yarr::Parser::consume):
+        (JSC::Yarr::Parser::consumeDigit):
+        (JSC::Yarr::Parser::consumeNumber):
+        (JSC::Yarr::Parser::consumeOctal):
+        (JSC::Yarr::Parser::tryConsume):
+        (JSC::Yarr::Parser::tryConsumeHex):
+        (JSC::Yarr::parse):
+        * yarr/YarrPattern.cpp: Renamed from Source/JavaScriptCore/yarr/RegexPattern.cpp.
+        (JSC::Yarr::CharacterClassConstructor::CharacterClassConstructor):
+        (JSC::Yarr::CharacterClassConstructor::reset):
+        (JSC::Yarr::CharacterClassConstructor::append):
+        (JSC::Yarr::CharacterClassConstructor::putChar):
+        (JSC::Yarr::CharacterClassConstructor::isUnicodeUpper):
+        (JSC::Yarr::CharacterClassConstructor::isUnicodeLower):
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+        (JSC::Yarr::CharacterClassConstructor::charClass):
+        (JSC::Yarr::CharacterClassConstructor::addSorted):
+        (JSC::Yarr::CharacterClassConstructor::addSortedRange):
+        (JSC::Yarr::BeginCharHelper::BeginCharHelper):
+        (JSC::Yarr::BeginCharHelper::addBeginChar):
+        (JSC::Yarr::BeginCharHelper::merge):
+        (JSC::Yarr::BeginCharHelper::addCharacter):
+        (JSC::Yarr::BeginCharHelper::linkHotTerms):
+        (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
+        (JSC::Yarr::YarrPatternConstructor::~YarrPatternConstructor):
+        (JSC::Yarr::YarrPatternConstructor::reset):
+        (JSC::Yarr::YarrPatternConstructor::assertionBOL):
+        (JSC::Yarr::YarrPatternConstructor::assertionEOL):
+        (JSC::Yarr::YarrPatternConstructor::assertionWordBoundary):
+        (JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
+        (JSC::Yarr::YarrPatternConstructor::atomBuiltInCharacterClass):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassBegin):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassAtom):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassRange):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassBuiltIn):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassEnd):
+        (JSC::Yarr::YarrPatternConstructor::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::YarrPatternConstructor::atomParentheticalAssertionBegin):
+        (JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
+        (JSC::Yarr::YarrPatternConstructor::atomBackReference):
+        (JSC::Yarr::YarrPatternConstructor::copyDisjunction):
+        (JSC::Yarr::YarrPatternConstructor::copyTerm):
+        (JSC::Yarr::YarrPatternConstructor::quantifyAtom):
+        (JSC::Yarr::YarrPatternConstructor::disjunction):
+        (JSC::Yarr::YarrPatternConstructor::regexBegin):
+        (JSC::Yarr::YarrPatternConstructor::regexEnd):
+        (JSC::Yarr::YarrPatternConstructor::regexError):
+        (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):
+        (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets):
+        (JSC::Yarr::YarrPatternConstructor::setupOffsets):
+        (JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
+        (JSC::Yarr::YarrPatternConstructor::optimizeBOL):
+        (JSC::Yarr::YarrPatternConstructor::addBeginTerm):
+        (JSC::Yarr::YarrPatternConstructor::setupDisjunctionBeginTerms):
+        (JSC::Yarr::YarrPatternConstructor::setupAlternativeBeginTerms):
+        (JSC::Yarr::YarrPatternConstructor::setupBeginChars):
+        (JSC::Yarr::compile):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h: Renamed from Source/JavaScriptCore/yarr/RegexPattern.h.
+        (JSC::Yarr::CharacterRange::CharacterRange):
+        (JSC::Yarr::CharacterClassTable::create):
+        (JSC::Yarr::CharacterClassTable::CharacterClassTable):
+        (JSC::Yarr::CharacterClass::CharacterClass):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::PatternTerm::ForwardReference):
+        (JSC::Yarr::PatternTerm::BOL):
+        (JSC::Yarr::PatternTerm::EOL):
+        (JSC::Yarr::PatternTerm::WordBoundary):
+        (JSC::Yarr::PatternTerm::invert):
+        (JSC::Yarr::PatternTerm::capture):
+        (JSC::Yarr::PatternTerm::quantify):
+        (JSC::Yarr::PatternAlternative::PatternAlternative):
+        (JSC::Yarr::PatternAlternative::lastTerm):
+        (JSC::Yarr::PatternAlternative::removeLastTerm):
+        (JSC::Yarr::PatternAlternative::setOnceThrough):
+        (JSC::Yarr::PatternAlternative::onceThrough):
+        (JSC::Yarr::PatternDisjunction::PatternDisjunction):
+        (JSC::Yarr::PatternDisjunction::~PatternDisjunction):
+        (JSC::Yarr::PatternDisjunction::addNewAlternative):
+        (JSC::Yarr::TermChain::TermChain):
+        (JSC::Yarr::BeginChar::BeginChar):
+        (JSC::Yarr::YarrPattern::~YarrPattern):
+        (JSC::Yarr::YarrPattern::reset):
+        (JSC::Yarr::YarrPattern::containsIllegalBackReference):
+        (JSC::Yarr::YarrPattern::newlineCharacterClass):
+        (JSC::Yarr::YarrPattern::digitsCharacterClass):
+        (JSC::Yarr::YarrPattern::spacesCharacterClass):
+        (JSC::Yarr::YarrPattern::wordcharCharacterClass):
+        (JSC::Yarr::YarrPattern::nondigitsCharacterClass):
+        (JSC::Yarr::YarrPattern::nonspacesCharacterClass):
+        (JSC::Yarr::YarrPattern::nonwordcharCharacterClass):
+
+2011-01-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * parser/SyntaxChecker.h:
+
+2011-01-10  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add CTI ASM versions for RVCT ARM THUMB2 mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=52154
+
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
+
+2011-01-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Qt build fix.
+
+        * JavaScriptCore.pro:
+
+2011-01-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 52079 - Syntax errors should be early errors.
+
+        From chapter 16 the spec:
+            An implementation must report most errors at the time the relevant ECMAScript language construct is
+            evaluated. An early error is an error that can be detected and reported prior to the evaluation of
+            any construct in the Program containing the error. An implementation must report early errors in a
+            Program prior to the first evaluation of that Program. Early errors in eval code are reported at
+            the time eval is called but prior to evaluation of any construct within the eval code. All errors
+            that are not early errors are runtime errors.
+
+            An implementation must treat any instance of the following kinds of errors as an early error:
+                * Any syntax error."
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            Added new files.
+        * bytecode/CodeBlock.cpp:
+            Removed op_throw_syntax_error.
+        * bytecode/Opcode.h:
+            Removed op_throw_syntax_error.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+            If m_expressionTooDeep then throw a runtime error.
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+            Initialize m_expressionTooDeep.
+        (JSC::BytecodeGenerator::emitThrowExpressionTooDeepException):
+            Sets m_expressionTooDeep.
+        * bytecompiler/BytecodeGenerator.h:
+            Added m_expressionTooDeep, removed emitThrowSyntaxError.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+            Conditions that threw syntax error are now handled during parsing;
+            during bytecompilation these are now just ASSERTs.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+            Removed op_throw_syntax_error.
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createRegExp):
+            Renamed; added syntax check.
+        * parser/JSParser.cpp:
+        (JSC::JSParser::breakIsValid):
+        (JSC::JSParser::hasLabel):
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::setIsFunction):
+        (JSC::JSParser::Scope::isFunctionBoundary):
+        (JSC::JSParser::ScopeRef::hasContainingScope):
+        (JSC::JSParser::ScopeRef::containingScope):
+        (JSC::JSParser::AutoPopScopeRef::AutoPopScopeRef):
+        (JSC::JSParser::AutoPopScopeRef::~AutoPopScopeRef):
+        (JSC::JSParser::AutoPopScopeRef::setPopped):
+        (JSC::JSParser::popScopeInternal):
+        (JSC::JSParser::popScope):
+        (JSC::jsParse):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseBreakStatement):
+        (JSC::JSParser::parseContinueStatement):
+        (JSC::JSParser::parseReturnStatement):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+        (JSC::JSParser::parsePrimaryExpression):
+        * parser/JSParser.h:
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createRegExp):
+            Renamed; added syntax check.
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createOutOfMemoryError):
+        (JSC::throwOutOfMemoryError):
+        * runtime/ExceptionHelpers.h:
+            Broke out createOutOfMemoryError.
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+            Add check for exception after bytecode generation.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+            RegExp error prefixes not included in error string.
+        * yarr/RegexParser.h:
+        (JSC::Yarr::Parser::parse):
+            Removed regexBegin/regexEnd/regexError.
+        * yarr/RegexPattern.cpp:
+        (JSC::Yarr::RegexPatternConstructor::regexBegin):
+            Removed regexEnd/regexError.
+        (JSC::Yarr::compileRegex):
+            Add call to regexBegin (no longer called from the parser).
+        * yarr/YarrSyntaxChecker.cpp: Added.
+        (JSC::Yarr::SyntaxChecker::assertionBOL):
+        (JSC::Yarr::SyntaxChecker::assertionEOL):
+        (JSC::Yarr::SyntaxChecker::assertionWordBoundary):
+        (JSC::Yarr::SyntaxChecker::atomPatternCharacter):
+        (JSC::Yarr::SyntaxChecker::atomBuiltInCharacterClass):
+        (JSC::Yarr::SyntaxChecker::atomCharacterClassBegin):
+        (JSC::Yarr::SyntaxChecker::atomCharacterClassAtom):
+        (JSC::Yarr::SyntaxChecker::atomCharacterClassRange):
+        (JSC::Yarr::SyntaxChecker::atomCharacterClassBuiltIn):
+        (JSC::Yarr::SyntaxChecker::atomCharacterClassEnd):
+        (JSC::Yarr::SyntaxChecker::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::SyntaxChecker::atomParentheticalAssertionBegin):
+        (JSC::Yarr::SyntaxChecker::atomParenthesesEnd):
+        (JSC::Yarr::SyntaxChecker::atomBackReference):
+        (JSC::Yarr::SyntaxChecker::quantifyAtom):
+        (JSC::Yarr::SyntaxChecker::disjunction):
+        (JSC::Yarr::checkSyntax):
+        * yarr/YarrSyntaxChecker.h: Added.
+            Check RegExp syntax.
+
+2011-01-10  Adam Roben  <aroben@apple.com>
+
+        Roll out r75289
+
+        It was causing assertion failures. See <http://webkit.org/b/52156>.
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize):
+
+2011-01-08  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Unify string table adding in AtomicString
+        https://bugs.webkit.org/show_bug.cgi?id=51927
+
+        Move code for adding a string into a separate function.
+        This removes multiple occurrence of the same logic.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::addToStringTable): Added.
+        (WTF::AtomicString::add): Use addToStringTable().
+        (WTF::AtomicString::fromUTF8): Ditto.
+
+2011-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Split machine stack marking functions into their own class (MachineStackMarker)
+        https://bugs.webkit.org/show_bug.cgi?id=52088
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Moved registerThread()
+        call behind an #ifdef because we shouldn't be registering threads at all
+        if we don't support usage on multiple threads.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated projects.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots):
+        * runtime/Collector.h:
+        (JSC::Heap::machineStackMarker): Moved code to machineStackMarker.
+
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::makeUsableFromMultipleThreads): Removed an unnecessary
+        level of indirection, to make Heap less of a God class.
+
+        * runtime/MachineStackMarker.h: Copied from Source/JavaScriptCore/runtime/Collector.h.
+        * runtime/MachineStackMarker.cpp: Copied from Source/JavaScriptCore/runtime/Collector.cpp.
+        (JSC::MachineStackMarker::MachineStackMarker):
+        (JSC::MachineStackMarker::~MachineStackMarker):
+        (JSC::MachineStackMarker::makeUsableFromMultipleThreads):
+        (JSC::MachineStackMarker::registerThread):
+        (JSC::MachineStackMarker::unregisterThread):
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markCurrentThreadConservatively):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        (JSC::MachineStackMarker::markMachineStackConservatively): Moved code from Heap.
+
+2011-01-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 26276 - Need a mechanism to determine stack extent on WINDOWS, SOLARIS, OPENBSD, SYMBIAN, HAIKU, WINCE platforms
+
+        Fix for win32.  The base of the stack is stored in the "deallocation stack" field of the
+        Thread Information Block - see: http://en.wikipedia.org/wiki/Win32_Thread_Information_Block
+        for more information!
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize):
+
+2011-01-07  Adam Roben  <aroben@apple.com>
+
+        Update react-to-vsprops-changes.py after r74855
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+
+2011-01-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Port scrollbar painting to GtkStyleContext
+        https://bugs.webkit.org/show_bug.cgi?id=52051
+
+        * wtf/gobject/GTypedefs.h: Add GtkStyleContext forward
+        declaration.
+
+2011-01-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Martin Robinson.
+
+        Enable PCRE computed gotos when compiling with RCVT 4.0 or greater in GNU mode
+        https://bugs.webkit.org/show_bug.cgi?id=52034
+
+        Derived from a patch by Eli Fidler.
+
+        RVCT 4 or greater in GNU mode supports the computed goto GNU language extension
+        as per <http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0348c/ch03s07s12.html>.
+
+        * pcre/pcre_exec.cpp: Modified to check for feature, HAVE(COMPUTED_GOTO), instead
+        of hardcoding the GCC compiler.
+        * wtf/Platform.h: Define WTF_COMPILER_RVCT4_OR_GREATER if __ARMCC_VERSION >= 400000.
+
+2011-01-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 52035 - Unregistering DOMWrapperWorlds is unsafe
+
+        The method DOMWrapperWorld::unregisterWorld() effectively calls the DOMWrapperWorld's
+        destructor early, in order to release wrappers once we know we no longer intend to use them.
+        Whilst it is okay to have a method to throw away wrappers (assuming we know we're willing to
+        lose any state stored on them) it is not okay to deregister the world from the JSGlobalData.
+        A sequence of events that triggers the bug would look like this:
+
+        (1) Create a DOMWrapperWorld.
+        (2) Register a timer in the world.
+        (3) Call unregisterWorld() on the world.
+        (4) Timer goes off, code is executed in the world, creates a Node not attached to a Document.
+        (5) We attempt to lookup a wrapper map for the world on the JSGlobalData, but because we've
+            called forgetWorld() none exists.
+        (6) Attempt to add a wrapper to a NULL map.
+
+        Fix the problem by not removing the JSGlobalData's wrapper map until the world really goes away.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::clear):
+
+2011-01-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 52021 - zeroDouble broken on ARMv7
+
+        The bug here is that zeroDouble was working incorrectly,
+        leading to op_loop_if_true failing - specifically in the
+        case where the value being checked is 0.0 encoded as a
+        double (rather than an integer immediate).
+
+        Additionally this patch removes a redundant duplicate compare
+        in some (many) case.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::vcmp_F64):
+        (JSC::ARMv7Assembler::vcmpz_F64):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchDoubleNonZero):
+        (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchDouble):
+        (JSC::MacroAssemblerARMv7::branchDoubleNonZero):
+        (JSC::MacroAssemblerARMv7::branchDoubleZeroOrNaN):
+        (JSC::MacroAssemblerARMv7::compare32):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchDoubleNonZero):
+        (JSC::MacroAssemblerMIPS::branchDoubleZeroOrNaN):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchDoubleNonZero):
+        (JSC::MacroAssemblerX86Common::branchDoubleZeroOrNaN):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+
+2011-01-06  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Added debug code to compare the results of JIT regexp with 
+        interpreted regexp and displays discrepencies.  This debug code is
+        controlled by the ENABLE_YARR_JIT_DEBUG macro in wtf/Platform.h and
+        is only valid if ENABLE_YARR_JIT is enabled.
+
+        Fixed a discovered problem in RegExp::printTraceData, changing
+        m_pattern to the getter pattern().
+        Also deleted an extraneous semicolon.
+
+        Enhancement: Add Regexp Debug Compare between JIT and Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=51834
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        (JSC::RegExp::printTraceData):
+        * wtf/Platform.h:
+
+2011-01-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [WINCE] Remove JSC::g_stackBase
+        https://bugs.webkit.org/show_bug.cgi?id=51779
+
+        * wtf/StackBounds.cpp:
+
+2011-01-06  Joone Hur  <joone.hur@collabora.co.uk>
+
+        Reviewed by Eric Seidel.
+
+        WML Parser should treat line/column number in a consistent way
+        https://bugs.webkit.org/show_bug.cgi?id=51601
+
+        Add the equality operators to TextPosition class.
+
+        * wtf/text/TextPosition.h:
+        (WTF::TextPosition::operator==): Added.
+        (WTF::TextPosition::operator!=): Added.
+        (WTF::TextPosition::belowRangePosition): Use belowBase() instead of base().
+        (WTF::ZeroBasedNumber::operator==): Added.
+        (WTF::ZeroBasedNumber::operator!=): Added.
+        (WTF::OneBasedNumber::operator==): Added.
+        (WTF::OneBasedNumber::operator!=): Added.
+
+2011-01-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        [WINCE] Determine stack extent
+        https://bugs.webkit.org/show_bug.cgi?id=26276
+
+        Scan the stack for writeable pages and use the limits.
+
+        * wtf/StackBounds.cpp:
+        (WTF::detectGrowingDownward):
+        (WTF::isPageWritable):
+        (WTF::getLowerStackBound):
+        (WTF::getUpperStackBound):
+        (WTF::StackBounds::initialize):
+
+2011-01-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Revert change to additional library search path needed to find ICU.
+
+2011-01-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Debug and Release builds on Windows clobber each other
+        https://bugs.webkit.org/show_bug.cgi?id=49185
+        
+        Changes the structure of WebKitBuild build products directory so we
+        completely separate each build configuration into independent directories.
+        
+        Although we previously had per-configuration directories for obj, this change adds
+        per-configuration directories for bin, lib, obj, and include. Each configuration's
+        build products are stored within a directory inside of WebKitBuild.
+        
+        Most use of $(WebKitOutputDir) in the build files has been replaced by $(ConfigurationBuildDir),
+        defined in common.vsprops to be $(WebKitOutputDir)\$(ConfigurationName).
+        
+        For PGO, $(ConfigurationBuildDir) points to the same directory (Release_PGO) to allow
+        for proper operation of the instrumentation/optimization scripts.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePGOOptimize.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd:
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd:
+        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd:
+        * JavaScriptCore.vcproj/jsc/jscPreBuild.cmd:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiPostBuild.cmd:
+        * JavaScriptCore.vcproj/testapi/testapiPreBuild.cmd:
+
+2011-01-05  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix.
+
+        * wtf/Encoder.h: Add <stdint.h> include for systems that
+        do not natively know about uint8_t, etc.
+
+2011-01-05  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [CMake] Fix the usage of SOURCE_GROUP
+        https://bugs.webkit.org/show_bug.cgi?id=51739
+
+        * CMakeLists.txt:
+
+2011-01-05  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt][V8] Fix the build after recent changes.
+
+        * pcre/pcre.pri: Correct the path after Source was introduced.
+
+2011-01-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix. Update path to FindSafari after source code reorganization.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+
+2011-01-04  Daniel Bates  <dbates@rim.com>
+
+        Fix the Android build after changeset 74975 <http://trac.webkit.org/changeset/74975>
+        (https://bugs.webkit.org/show_bug.cgi?id=51855).
+
+        * wtf/ThreadingPthreads.cpp: Add include of PassOwnPtr.h.
+        (WTF::runThreadWithRegistration): Use -> instead of . to dereference pointer.
+
+2011-01-04  Martin Robinson  <mrobinson@igalia.com>
+
+        Try to fix the EFL build.
+
+        * wtf/CMakeLists.txt: Remove PlatformRefPtr from the CMake source list.
+
+2011-01-04  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        StackBounds initialization in WTFThreadData should be guarded by #if USE(JSC)
+        https://bugs.webkit.org/show_bug.cgi?id=51881
+
+        The StackBounds class is only used by JavaScriptCore.
+
+        * wtf/WTFThreadData.cpp:
+        (WTF::WTFThreadData::WTFThreadData):
+        * wtf/WTFThreadData.h:
+        (WTF::WTFThreadData::resetCurrentIdentifierTable):
+
+2011-01-03  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove the last non-GObject usage of PlatformRefPtr and move the code to GRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=51846
+
+        * GNUmakefile.am: Remove PlatformRefPtr.h from the sources list.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * jit/ExecutableAllocator.h: Change references to PlatformRefPtr to RefPtr.
+        (JSC::ExecutableAllocator::cacheFlush): Ditto.
+        * wtf/PlatformRefPtr.h: Removed.
+        * wtf/RandomNumber.cpp: Change references to PlatformRefPtr to RefPtr.
+        (WTF::randomNumber): Ditto.
+        * wtf/brew/RefPtrBrew.h: Ditto.
+        (WTF::refIfNotNull): Added.
+        (WTF::derefIfNotNull): Added.
+        * wtf/brew/ShellBrew.h: Change references to PlatformRefPtr to RefPtr.
+        (WTF::createRefPtrInstance): Modified to return a RefPtr.
+        * wtf/gobject/GRefPtr.cpp: 
+        (WTF::refGPtr): Moved from PlatformRefPtr here.
+        (WTF::derefGPtr): Ditto.
+        * wtf/gobject/GRefPtr.h: Ditto.
+        (WTF::GRefPtr::GRefPtr): Ditto.
+        (WTF::GRefPtr::~GRefPtr): Ditto.
+        (WTF::GRefPtr::clear): Ditto.
+        (WTF::GRefPtr::isHashTableDeletedValue): Ditto.
+        (WTF::GRefPtr::get): Ditto.
+        (WTF::GRefPtr::operator*): Ditto.
+        (WTF::GRefPtr::operator->): Ditto.
+        (WTF::GRefPtr::operator!): Ditto.
+        (WTF::GRefPtr::operator UnspecifiedBoolType): Ditto.
+        (WTF::GRefPtr::hashTableDeletedValue): Ditto.
+        (WTF::::operator): Ditto.
+        (WTF::::swap): Ditto.
+        (WTF::swap): Ditto.
+        (WTF::operator==): Ditto.
+        (WTF::operator!=): Ditto.
+        (WTF::static_pointer_cast): Ditto.
+        (WTF::const_pointer_cast): Ditto.
+        (WTF::getPtr): Ditto.
+        (WTF::adoptGRef): Ditto.
+        (WTF::refGPtr): Ditto.
+        (WTF::derefGPtr): Ditto.
+
+2011-01-04  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Roben.
+
+        LEAK: Deallocate instance of ThreadFunctionInvocation if thread creation fails
+        https://bugs.webkit.org/show_bug.cgi?id=51860
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::createThreadInternal):
+
+2011-01-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt][Symbian] Make sure that WebKit headers are included before platform headers on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=31273
+
+        On Symbian PREPEND_INCLUDEPATH is the best way to make sure that WebKit headers
+        are included before platform headers. On all other platforms continue to use
+        INCLUDEPATH (as before). This is a continuation of r65877.
+
+        No new tests as there is no new functionality.
+
+        * JavaScriptCore.pri:
+
+2011-01-04  Darin Adler  <darin@apple.com>
+
+        Try to fix Windows build.
+
+        * wtf/ThreadingWin.cpp: Added include of PassOwnPtr.h. Fixed paragraphing
+        of conditional includes.
+        (WTF::wtfThreadEntryPoint): Use -> instead of . to dereference pointer.
+        (WTF::createThreadInternal): Tweaked #if to not need separate macro.
+
+2011-01-04  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Roben.
+
+        Extract ThreadFunctionInvocation into separate file and share between Apple Windows and Android
+        https://bugs.webkit.org/show_bug.cgi?id=51855
+
+        Both the Apple Windows and Android ports implement a similar adapter structure,
+        called ThreadFunctionInvocation and ThreadData respectively, as part of
+        their thread creation process. Instead, we should share such an adapter
+        structure and remove duplicate code.
+
+        * JavaScriptCore.gypi: Added header wtf/ThreadFunctionInvocation.h.
+        * wtf/ThreadFunctionInvocation.h: Added.
+        (WTF::ThreadFunctionInvocation::ThreadFunctionInvocation):
+        * wtf/ThreadingPthreads.cpp: Removed Android-specific structure ThreadData; Instead, use ThreadFunctionInvocation.
+        (WTF::runThreadWithRegistration):
+        (WTF::createThreadInternal): 
+        * wtf/ThreadingWin.cpp: Moved structure ThreadFunctionInvocation to its own file so that
+        it can be shared with the Android implementation of createThreadInternal().
+        (WTF::wtfThreadEntryPoint): Use OwnPtr to hold passed instance of ThreadFunctionInvocation.
+
+2011-01-04  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Use __builtin_expect when compiling using RVCT in GNU mode
+        https://bugs.webkit.org/show_bug.cgi?id=51866
+
+        Derived from a patch by Dave Tapuska.
+
+        * wtf/AlwaysInline.h:
+
+2011-01-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        * wtf/Forward.h: Added Decoder and Encoder.
+
+2011-01-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add Encode/Decode machinery Darin and I plan to work with for back/forward stuff in WebKit2.
+
+        Starting out with a pure virtual interface to be implemented in WK2, but we might change that later.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+
+        * wtf/Decoder.h: Added.
+        * wtf/Encoder.h: Added.
+
+2011-01-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] Add NullPtr.cpp introduced in r71155 to the Qt build system.
+
+        This fix is required for builds where HAVE(NULLPTR) is false
+        (e.g. some MSVC and Symbian builds).
+
+        * wtf/wtf.pri:
+
+2011-01-02  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Simon Fraser.
+
+        <rdar://problem/8812159> Update copyright strings
+
+        * Info.plist:
+
+2011-01-02  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix GTK+ build after r74855.
+
+        Reviewed by Xan Lopez.
+
+        * GNUmakefile.am: Fix include pathes.
+
+2011-01-02  Adam Barth  <abarth@webkit.org>
+
+        One more .. missing in the Qt build.
+
+        * jsc.pro:
+
+2011-01-02  Xan Lopez  <xlopez@igalia.com>
+
+        Fix GTK+ build.
+
+        * GNUmakefile.am: add -I$(srcdir)/Source to the JSC cppflags so
+        that anyone can include its headers without adding the prefix
+        'Source/'.
+
+2011-01-02  Carl Lobo  <carllobo@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        Fix Windows Build for non-production where VSPropsRedirectionDir is not defined.
+        https://bugs.webkit.org/show_bug.cgi?id=51797
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+2011-01-01  Adam Barth  <abarth@webkit.org>
+
+        Fix relative include paths in an attempt to fix the Qt build.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2011-01-01  Adam Barth  <abarth@webkit.org>
+
+        Another speculative build fix for GTK.
+
+        * GNUmakefile.am:
+
+2011-01-01  Adam Barth  <abarth@webkit.org>
+
+        Speculative build fix for GTK.  Update the paths in GNUmakefile to
+        include "Source".
+
+        * GNUmakefile.am:
+
+2011-01-01  Adam Barth  <abarth@webkit.org>
+
+        Update relative paths in JavaScriptCore.gyp to account for the extra
+        level of directories.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2010-12-31  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add a fast case for ASCII strings in HashAndUTF8CharactersTranslator::equal
+        https://bugs.webkit.org/show_bug.cgi?id=50517
+
+        This change shows about 2% performance win on the xml-parser benchmark.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::HashAndUTF8CharactersTranslator::equal):
+
+2010-12-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        [CMake] Add WTF_HEADERS
+        https://bugs.webkit.org/show_bug.cgi?id=51741
+
+        Add the WTF headers to show them in Visual Studio.
+
+        * wtf/CMakeLists.txt:
+        * wtf/CMakeListsWinCE.txt:
+
+2010-12-30  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Reviewed by David Kilzer.
+
+        [Qt] Don't build wtf/TCSystemAlloc.cpp if --system-malloc option is
+        used
+        https://bugs.webkit.org/show_bug.cgi?id=51672
+
+        * wtf/wtf.pri: Replaced USE_SYSTEM_MALLOC with USE_SYSTEM_MALLOC=1
+
+2010-12-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use OS(WINDOWS) instead of COMPILER(MSVC) in FastMalloc.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=51743
+
+        Most of the ifdefs belong to windows and not to the MSVC compiler.
+
+        * wtf/FastMalloc.cpp:
+
+2010-12-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 51724 - In strict mode string literals should allow \0, but disallow \8 and \9.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseString):
+
+2010-12-29  Helder Correia  <helder@sencha.com>
+
+        Reviewed by Eric Seidel.
+
+        <VT> and <FF> are not valid JSON whitespace characters
+        https://bugs.webkit.org/show_bug.cgi?id=51671
+
+        Vertical Tab and Form Feed are not allowed white spaces by the JSON
+        RFC 4627: http://www.ietf.org/rfc/rfc4627.txt (2. JSON Grammar).
+
+        Tests: ietestcenter/Javascript/15.12.1.1-0-2.html
+               ietestcenter/Javascript/15.12.1.1-0-3.html
+
+        * runtime/LiteralParser.cpp:
+        (JSC::isJSONWhiteSpace):
+        (JSC::LiteralParser::Lexer::lex):
+
+2010-12-28  Helder Correia  <helder@sencha.com>
+
+        Reviewed by Eric Seidel.
+
+        JSON.stringify must exist as a function taking 3 parameters
+        https://bugs.webkit.org/show_bug.cgi?id=51667
+
+        The reported function length is 1 instead.
+
+        Test: ietestcenter/Javascript/15.12.3-0-2.html
+
+        * runtime/JSONObject.cpp:
+
+2010-12-28  Helder Correia  <helder@sencha.com>
+
+        Reviewed by Sam Weinig.
+
+        JSON.parse must exist as a function taking 2 parameters
+        https://bugs.webkit.org/show_bug.cgi?id=51666
+
+        Support for revivers was introduced in bug 26591, but the function
+        length has since remained unchanged.
+
+        Test: ietestcenter/Javascript/15.12.2-0-2.html
+
+        * runtime/JSONObject.cpp:
+
+2010-12-27  Jake Helfert  <jake@jakeonthenet.com>
+
+        Reviewed and reworked by Darin Adler.
+
+        Building WebKit with Visual Studio 2010 fails due
+        to ambiguous assignment operator errors.
+        https://bugs.webkit.org/show_bug.cgi?id=51116
+
+        * wtf/NullPtr.h: Added a HAVE(NULLPTR) definition for use with
+        Platform.h HAVE macro, and included the Visual Studio 2010 compiler
+        as one of the ones that has nullptr.
+        * wtf/NullPtr.cpp: Updated condition to match.
+        
+        * wtf/PassOwnArrayPtr.h: Don't include the operator=(nullptr_t)
+        overload if we are compiling in loose mode and the compiler has
+        nullptr, because assignment of 0 will otherwise encounter
+        ambiguitity with this overload and the overload for loose mode
+        that takes a raw pointer. The conditional can be removed when we
+        get rid of loose mode.
+        * wtf/PassOwnPtr.h: Ditto.
+
+        * wtf/PassRefPtr.h: Don't include the operator=(nullptr_t) overload
+        if the compiler has nullptr, because assignment of 0 would be
+        ambiguous with the overload that takes a raw pointer. The conditional
+        can be removed if we ever decide we no longer need to support
+        assigning 0, but might need a way to catch that usage on older compilers.
+        * wtf/RefPtr.h: Ditto.
+        * wtf/RetainPtr.h: Ditto
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added NullPtr.cpp,
+        accidentally omitted when the file was first added.
+
+2010-12-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] Add standalone target for JSC
+        https://bugs.webkit.org/show_bug.cgi?id=51607
+
+        * GNUmakefile.am: add convenience target to only build jsc and its
+        dependencies.
+
+2010-12-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [WINCE] Add CPU(MIPS) detection
+        https://bugs.webkit.org/show_bug.cgi?id=51342
+
+        WinCE usually defines MIPS and _MIPS_.
+
+        * wtf/Platform.h:
+
+2010-12-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename RegexCompiler.cpp to RegexPattern.cpp.
+        Implicitly call compileRegex from RegexPattern's constructor.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        * yarr/RegexCompiler.cpp: Removed.
+        * yarr/RegexCompiler.h: Removed.
+        * yarr/RegexInterpreter.cpp:
+        * yarr/RegexJIT.cpp:
+        * yarr/RegexPattern.cpp: Copied from JavaScriptCore/yarr/RegexCompiler.cpp.
+        (JSC::Yarr::compileRegex):
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        * yarr/RegexPattern.h:
+
+2010-12-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix for WinCE after r74360.
+
+        Move the OS(WINDOWS) section after the OS(WINCE) section
+        and add missing argument to the getStackMax call.
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize):
+
+2010-12-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        [Symbian] Make sure OSAllocatorSymbian builds
+
+        This patch only addresses the build problem.
+
+        https://bugs.webkit.org/show_bug.cgi?id=51128 tracks the full
+        (re)implementation of the Symbian allocator.
+
+        * wtf/OSAllocatorSymbian.cpp:
+        (WTF::OSAllocator::reserveUncommitted):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit):
+
+2010-12-22  Dan Bernstein  <mitz@apple.com>
+
+        Changed WebKitTools to Tools.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+
+2010-12-22  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Changed WebKitTools to Tools in script build phases.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-12-22  Andrei Popescu  <andreip@google.com>
+
+        Unreviewed build fix.
+
+        Fix Chromium Linux shared library build.
+        [Chromium] r74431 broke the Chromium Linux shared library build
+        https://bugs.webkit.org/show_bug.cgi?id=51462
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+
+2010-12-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r74462.
+        http://trac.webkit.org/changeset/74462
+        https://bugs.webkit.org/show_bug.cgi?id=51449
+
+        broke chromium win (Requested by tonyg-cr on #webkit).
+
+        * JavaScriptCore.gypi:
+
+2010-12-21  Tony Gentilcore  <tonyg@chromium.org>
+
+        Unreviewed build fix.
+
+        [chromium] Build fix after r74431
+        https://bugs.webkit.org/show_bug.cgi?id=51447
+
+        * JavaScriptCore.gypi:
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative build fix.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::underMemoryPressure):
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26276 - Need a mechanism to determine stack extent
+
+        This patch adds accurate stack size calculation for:
+            DARWIN, QNX, UNIX
+        We still need to fix:
+            WINDOWS, SOLARIS, OPENBSD, SYMBIAN, HAIKU, WINCE
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize):
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+         Reviewed by Geoff Garen.
+ 
+        <rdar://problem/8765333> CRASH running out of executable memory, loading io9.com
+        https://bugs.webkit.org/show_bug.cgi?id=51443
+
+        The problem here is that each page uses a reasonable amount of memory, (~4Mb),
+        and that when miultiple pages are open we keep all JIT code for all functions
+        in all pages alive.
+
+        Add a check to detect high memory pressure situations in the executable allocator
+        (>50% of available memory allocated), and upon a top level entry into JSC (no code
+        running on the stack) in this situation throw away all JIT code.
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): stop passing exec to recompile.
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutablePool::systemAlloc): Count allocations.
+        (JSC::ExecutablePool::systemRelease): Count deallocations.
+        (JSC::ExecutablePool::underMemoryPressure): Check memory pressure.
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::underMemoryPressure): Stub out; only meaningful with FixedVMPool.
+        * jit/ExecutableAllocatorWin.cpp:
+        (JSC::ExecutablePool::underMemoryPressure): Stub out; only meaningful with FixedVMPool.
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::recompile): Remove ExecState argument to recompile.
+        * runtime/Executable.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::recompileAllJSFunctions): throws away all JIT code.
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): add check / call to throw away.
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/8241425> JIT executable memory excessive usage due to regex caching
+        https://bugs.webkit.org/show_bug.cgi?id=51434
+
+        Reduce the amount of memory the RegExpCache can hold on to on iOS.
+        Currently the RegExpCache can hold 256 RegExp objects. If each falls into a separate
+        ExecutablePool, with a common size of 16Kb, this means we end up holding onto 4Mb of
+        memory. Firstly, we can reduce this by simply reducing the size of the cache to 32
+        entries. Secondly, we can use a separate set of ExecutablePools for JIT code generated
+        from RegExp objects. This helps in two ways (1) it increases the probability that
+        RegExps in the cache share the same pool, and (2) it means that a RegExp can't end
+        up holding on to a large ExecutablePool containing a translation of JS code.
+        (A RegExp could end up keeping a larger RegExp alive that happened to be sharing the
+        same pool, but large RegExp patterns are less common).
+
+        * runtime/JSGlobalData.h:
+        * runtime/RegExpCache.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Eeeep! build fix!
+
+        * wtf/OSAllocator.h:
+        (WTF::OSAllocator::decommitAndRelease):
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Ooops, fixed typo in comment.
+
+        * wtf/OSAllocator.h:
+
+2010-12-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough & Oliver Hunt.
+
+        Added PageAllocationAligned, a cross-platform abstraction for memory allocations with arbitrary alignment requirements
+        https://bugs.webkit.org/show_bug.cgi?id=51359
+        
+        I think this patch fixes <rdar://problem/8107952> [5.0.1] WER crash in
+        Heap::allocateBlock (1902752929), and some other leaks and crashes as well.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated build files.
+
+        * runtime/AlignedMemoryAllocator.h: Removed. Supplanted by
+        PageAllocationAligned.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::addWeakGCHandle):
+        * runtime/Collector.h: Switched from AlignedMemoryAllocator to
+        PageAllocationAligned.
+
+        * runtime/GCHandle.cpp:
+        * runtime/GCHandle.h: Ditto.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::PageAllocation): Removed aligned memory allocation
+        functions. Supplanted by PageAllocationAligned.
+
+        * wtf/PageAllocationAligned.cpp: Added.
+        (WTF::PageAllocationAligned::allocate):
+        (WTF::PageAllocationAligned::deallocate):
+        * wtf/PageAllocationAligned.h: Added.
+        (WTF::PageAllocationAligned::PageAllocationAligned): New cross-platform
+        class for doing aligned memory allocation. This class properly matches
+        allocation and deallocation library calls, fixing a long-standing bug
+        in PageAllocation.
+
+        * wtf/Platform.h: Removed some defunction VM platform defines.
+
+        * wtf/wtf.pri: Updated build files.
+
+2010-12-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        ASSERTION FAILED: base->index() == m_codeBlock->argumentsRegister() while loading taobao.com
+        https://bugs.webkit.org/show_bug.cgi?id=49006
+
+        This problem was caused by having a parameter named 'arguments'.
+        The fix is to treat parameters named 'arguments' as shadowing
+        the actual arguments property, and so logically turn the function
+        into one that doesn't "use" arguments.
+
+        This required a bit of fiddling in the parser to ensure we correctly
+        propagate the 'feature' of shadowing is set correctly.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+          Change assertion to an early return as we may now reference
+          a property named 'arguments' without being in a function that
+          has the ArgumentsFeature
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::declareParameter):
+        (JSC::JSParser::Scope::shadowsArguments):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionInfo):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::usesArguments):
+
+2010-12-21  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel and Darin Adler.
+
+        Deallocate GregorianDateTime.timeZone (if allocated) when copying so that we don't leak memory.
+        https://bugs.webkit.org/show_bug.cgi?id=51367
+
+        Inspired by a patch by George Staikos.
+
+        * wtf/DateMath.cpp:
+        (JSC::msToGregorianDateTime): Modified to set timeZone to nullptr since timeZone is now
+        of type OwnPtrArray<char>.
+        * wtf/DateMath.h: Change timeZone to type OwnArrayPtr<char>; Removed destructor since it is no longer needed.
+        (JSC::GregorianDateTime::GregorianDateTime): Modified to use OwnPtrArray semantics for timeZone.
+        (JSC::GregorianDateTime::operator tm): Ditto.
+        (JSC::GregorianDateTime::copyFrom): Ditto.
+
+2010-12-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r74402.
+        http://trac.webkit.org/changeset/74402
+        https://bugs.webkit.org/show_bug.cgi?id=51402
+
+        This patch broke the Windows 7 Release Layout Tests (Requested
+        by jessieberlin on #webkit).
+
+        * wtf/StackBounds.cpp:
+        (WTF::estimateStackBound):
+        (WTF::StackBounds::initialize):
+
+2010-12-21  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Unify the name of parentheses in YARR: rename parenthesis to
+        parentheses.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
+
+2010-12-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Set BUILDING_QT__ consistently
+        https://bugs.webkit.org/show_bug.cgi?id=51341
+
+        * JavaScriptCore.pri: Remove the definition of BUILDING_QT__ as it
+        is already defined in WebKit.pri.
+
+2010-12-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26276 - Need a mechanism to determine stack extent
+
+        This patch adds accurate stack size calculation for:
+            DARWIN, WINDOWS, QNX, UNIX
+        We still need to fix:
+            SOLARIS, OPENBSD, SYMBIAN, HAIKU, WINCE
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize):
+
+2010-12-20  Gavin Barraclough  <barraclough@apple.com>
+
+        PPC build fix; stop using std::swap on PageAllocation/PageReservation,
+        this was failing on some compilers since the lack of default construction
+        for the m_executable/m_writable fields meant the value being swapped may
+        not have been fully initialized.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::deallocate):
+        * wtf/PageBlock.h:
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::deallocate):
+
+2010-12-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        |delete name| in strict mode code should be an early error
+        https://bugs.webkit.org/show_bug.cgi?id=50431
+
+        Disallow the |delete IDENTIFIER| production in strict mode, and removed
+        a bunch of now unnecessary code.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::collectFreeVariables):
+        (JSC::jsParse):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseUnaryExpression):
+        * parser/JSParser.h:
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+
+2010-12-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olver Hunt.
+
+        Bug 51358 - Should check stack depth rather than using recursion limits in byte compilation
+
+        The current implementation of recursion limit checking is not safe on smaller stacks.
+        Switch to using a common mechanism, shared with the parser, to check recursion limits.
+
+        Make bytecompiler use StackBounds. Empirical testing shows emitStrcat to have the largest
+        footprint on the stack, at just under 1k on x86-64.  Given this, the default recursion
+        check (requiring 4k of available space to recurse) seems reasonable.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BinaryOpNode::emitStrcat):
+
+2010-12-20  Tony Gentilcore  <tonyg@chromium.org>
+
+        Unreviewed build fix.
+
+        Include pthread to fix chromium mac build (broken by r74360)
+        https://bugs.webkit.org/show_bug.cgi?id=51356
+
+        * wtf/StackBounds.cpp:
+
+2010-12-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        * GNUmakefile.am: add missing files.
+
+2010-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26276 - Need a mechanism to determine stack extent
+
+        This patch adds a class 'StackBounds', to hold information about the machine stack.
+        The implementation of this class broadly adheres to the current implmentation of
+        stack limit checking, and as such does not solve the problem of determining stack
+        extent, but gives us a common place to do so.
+
+        Currently two mechanism are provided to determine the stack origin (the point the
+        stack is growing away from). currentThreadStackBase() in Collector provides a
+        more accurate determination of the stack origin, so use this to calculate
+        StackBounds::m_origin; WTFThreadData::approximatedStackStart is less accurate, and
+        as such can be removed.  Cache the StackBounds on WTFThreadData such that they
+        need only be determined once per thread, and for non-API contexts cache this
+        information in JSGlobalData, to save a thread-specific access.
+
+        For the time being retain the estimate of stack size used by JSC's parser
+        (128 * sizeof(void*) * 1024), with a view to replacing this with something more
+        accurate in the near future.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::canRecurse):
+        (JSC::JSParser::JSParser):
+            Change to use StackBounds.
+        * runtime/Collector.cpp:
+        (JSC::Heap::registerThread):
+        (JSC::Heap::markCurrentThreadConservativelyInternal):
+            Change to use StackBounds, cached on JSGlobalData.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::stack):
+            Add a cached copy of StackBounds.
+        * wtf/StackBounds.cpp: Copied from JavaScriptCore/runtime/Collector.cpp.
+        (WTF::estimateStackBound):
+        (WTF::StackBounds::initialize):
+        (WTF::getStackMax):
+            Copy code from Collector.cpp to determine stack origin.
+        * wtf/StackBounds.h: Added.
+        (WTF::StackBounds::StackBounds):
+            No argument constructor; returns a null StackBounds.
+        (WTF::StackBounds::currentThreadStackBounds):
+            Returns a StackBounds object representing the stack limits
+            of the current thread.
+        (WTF::StackBounds::origin):
+            Returns to stack origin (the point the stack is growing away
+            from; the highest extent of the stack on machines where the
+            stack grows downwards.
+        (WTF::StackBounds::recursionLimit):
+            Returns a limit value that is 'a comfortable distance from
+            the end of the stack'. Our concept of this is currently 1 page
+            away from the end, however the default value may be tuned in
+            the future, and clients may override passing a larger delta;
+            should only be called on StackBounds object representing the
+            stack of the thread this method is called on (checked by
+            checkConsistency).
+        (WTF::StackBounds::recursionCheck):
+            Checks whether we are currently 'a comfortable distance from
+            the end of the stack'. Our concept of this is currently 1 page
+            away from the end, however the default value may be tuned in
+            the future, and clients may override passing a larger delta
+            to apply when checking, if they wish to do so. This method
+            should only be called on StackBounds object representing the
+            stack of the thread this method is called on (checked by
+            checkConsistency).
+        (WTF::StackBounds::current):
+            Approximate current stack position. On machines where the stack
+            is growing downwards this is the lowest address that might need
+            conservative collection.
+        (WTF::StackBounds::isGrowingDownward):
+            True for all platforms other than WINCE, which has to check.
+        (WTF::StackBounds::checkConsistency):
+            This is called in methods that shoulds only be operating on a
+            valid set of bounds; as such we expect m_origin != m_bounds
+            (i.e. stack size != zero) - we're really testing that this
+            object is not null (the constructor initializes both fields
+            to zero).  Also checks that current() is within the stack's
+            bounds.
+        * wtf/WTFThreadData.cpp:
+        (WTF::WTFThreadData::WTFThreadData):
+        * wtf/WTFThreadData.h:
+        (WTF::WTFThreadData::stack):
+            Add the StackBounds member variable.
+
+2010-12-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Factored common page set management into a new PageBlock base class
+        https://bugs.webkit.org/show_bug.cgi?id=51285
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        * wtf/PageAllocation.cpp: Removed.
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::deallocate):
+        (WTF::PageAllocation::PageAllocation):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::deallocate):
+        (WTF::PageReservation::PageReservation):
+        * wtf/wtf.pri:
+
+2010-12-17  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        RegExp Jit'ed expression crashes clicking link on yelp.com
+        https://bugs.webkit.org/show_bug.cgi?id=51284
+
+        When transitioning between an non-repeating beginning of line
+        anchored expression and the remaining refactored repeating 
+        expression, we should not clear any residual datalabel in 
+        state's m_backtrack.  It will be resolved and cleared in subsequent
+        code when linkAlternativeBacktracks() is called for the repeating
+        alternative(s).
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::clear):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::clearBacktrack):
+
+2010-12-17  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Updated for the renaming of WebKitTools to Tools
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+
+2010-12-17  Ariya Hidayat  <ariya@sencha.com>
+
+        Reviewed by Oliver Hunt.
+
+        [JSC] parseAssignmentExpression should use TreeBuilder::CreatesAST
+        https://bugs.webkit.org/show_bug.cgi?id=51268
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseAssignmentExpression):
+
+2010-12-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed RChunk from PageAllocation/PageReservation, since it's now unused.
+        https://bugs.webkit.org/show_bug.cgi?id=51276
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::PageAllocation):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::PageReservation):
+
+2010-12-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect encoding of some constants in ARMv7 JIT
+        https://bugs.webkit.org/show_bug.cgi?id=51273
+        <rdar://problem/8650210>
+
+        When using immediate encoding 3 we need to write the byte
+        that holds a duplicated value.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::makeEncodedImm):
+
+2010-12-16  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] useless warnings when building on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=50985
+
+        Disable some compiler warnings that aren't indicative of real problems.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2010-12-16  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=51166
+        ExecutableAllocator::cacheFlush should call sys_cache_control
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush): Use the more correct and forward looking API -
+        sys_cache_control(kCacheFunctionPrepareForExecution,...).
+
+2010-12-16  Ariya Hidayat  <ariya@sencha.com>
+
+        Reviewed by Andreas Kling.
+
+        [JSC] Const correctness in ASTBuilder and SyntaxChecker
+        https://bugs.webkit.org/show_bug.cgi?id=51141
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::getName):
+        (JSC::ASTBuilder::getType):
+        (JSC::ASTBuilder::isResolve):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2010-12-15  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        Web Audio API: port FFTFrame to MKL
+        https://bugs.webkit.org/show_bug.cgi?id=50986
+
+        Fixed bug in log2 emulation function provided for Windows port of
+        Web Audio API.
+
+        * wtf/MathExtras.h:
+        (log2):
+
+2010-12-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <http://webkit.org/b/51064> Reproducible crash inside WebCore::MediaPlayerPrivateQTKit::createQTMovie when loading <video>
+
+        * wtf/text/WTFString.h: Prevent String from being implicitly convertable to bool.
+        It was previously implicitly convertible to bool on Mac via operator NSString*,
+        but since that always has a non-zero return value it would give unexpected results.
+
+2010-12-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] [Symbian] Do not use pkg-config on Symbian as it is not supported
+        https://bugs.webkit.org/show_bug.cgi?id=50231
+
+        Guard CONFIG+=link_pkgconfig with !symbian.
+
+        * jsc.pro:
+
+2010-12-14  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Revert accidental change disabling the JIT for most platforms.
+
+        * wtf/Platform.h:
+
+2010-12-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Clang fails to build the JSC interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=51016
+
+        Clang does not allow indirect gotos out of scopes with cleanup. GCC 4.2 allows
+        them, but it does not correctly generate the cleanup, causing a leak if the
+        cleanup decrements a reference count.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Put an Identifier into its own scope.
+
+2010-12-14  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Simplify context-menu handling code
+        https://bugs.webkit.org/show_bug.cgi?id=49658
+
+        * wtf/PlatformRefPtr.h: Add leakRef()
+
+2010-12-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JavaScriptCore should not use "asm volatile" outside of a function
+        https://bugs.webkit.org/show_bug.cgi?id=50991
+
+        * jit/JITStubs.cpp: Remove the volatile keyword from asm statements.
+
+2010-12-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows production build fix.
+        Try copying ICU 4.6 in addition to 4.4 and 4.2.
+
+        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd:
+
+2010-12-13  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION: mobileme mail viewing is broken
+        https://bugs.webkit.org/show_bug.cgi?id=50884
+
+        Fixed problem where simple parenthesis (those without capture and
+        with a fixed count) where not propagating backtrack to labels for 
+        nested parentheses.  Also added the nesting level for the parentheses 
+        state created in that case as well.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::copyBacktrackToLabel):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastTerm):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+
+2010-12-13  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Reduce the size of the RegexStackSpaceForBackTrackInfoParentheses in YARR
+        https://bugs.webkit.org/show_bug.cgi?id=49385
+
+        Remove the BackTrackInfoParentheses struct prevBegin and prevEnd members.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        * yarr/RegexPattern.h:
+
+2010-12-10  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION Hang inside Yarr::RegexCodeBlock::execute when visiting
+        bugs.webkit.org
+        https://bugs.webkit.org/show_bug.cgi?id=50816
+
+        First nested parentheses of the second or greater alternative
+        where backtracking to the prior parentheses.  Changed the default
+        handling of initial parentheses for all alternatives to go back
+        to the immediate outer paren.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::GenerationState::addParenthesesTail):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::getTermIndex):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setParenthesesTail):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::getParenthesesTail):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::ParenthesesTail):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::processBacktracks):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+
+2010-12-11  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add an overload to makeString for Vector<char>
+        https://bugs.webkit.org/show_bug.cgi?id=50123
+
+        Also cleanup StringTypeAdapter.
+
+        * wtf/text/StringConcatenate.h:
+
+2010-12-10  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Build fix for Symbian: don't compile POSIX memory management implementation 
+        https://bugs.webkit.org/show_bug.cgi?id=50707
+
+        * wtf/wtf.pri:
+
+2010-12-10  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows production build fix.
+        
+        Don't stop if react-to-vsprops-changes.py exits with an error,
+        since this will occur in production builds.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2010-12-10  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Turn on USE(CROSS_PLATFORM_CONTEXT_MENUS) for Windows.
+
+        * wtf/Platform.h:
+
+2010-12-10  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed, rolling out r73703.
+        http://trac.webkit.org/changeset/73703
+        https://bugs.webkit.org/show_bug.cgi?id=49658
+
+        This patch is causing crashes on the GTK+ bots.
+
+        * wtf/PlatformRefPtr.h:
+
+2010-12-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Cleanup StringWx.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=50525
+
+        Use StringImpl::createUninitialized to avoid memcpy and fix style issues.
+
+        * wtf/wx/StringWx.cpp:
+        (WTF::String::String):
+
+2010-12-10  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Simplify context-menu handling code
+        https://bugs.webkit.org/show_bug.cgi?id=49658
+
+        * wtf/PlatformRefPtr.h:
+
+2010-12-09  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION (r73065?): A regex no longer works 
+        https://bugs.webkit.org/show_bug.cgi?id=50570
+
+        Changed the handling of adjacent parentheses backtracks in two ways.
+        First, only outer most paren backtracks default to back tracking
+        to the "next character" looping code.  Second, added a jump around 
+        backtracks that fall through to the next backtrack where the
+        second backtrack has some greedy processing before the backtracking
+        from outside the parentheses code.
+        Also cleaned up extraneous white spce, removing white space at the
+        end of or that makes up a whole line.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::GenerationState::GenerationState):
+        (JSC::Yarr::RegexGenerator::GenerationState::incrementParenNestingLevel):
+        (JSC::Yarr::RegexGenerator::GenerationState::decrementParenNestingLevel):
+        (JSC::Yarr::RegexGenerator::GenerationState::addParenthesesTail):
+        (JSC::Yarr::RegexGenerator::GenerationState::emitParenthesesTail):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::ParenthesesTail):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::setNextIteration):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+
+2010-12-09  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Addressed the "FIXME" issues in array sort for toString() methods that
+        mutate the array in either size or contents.  The change is to mark
+        the temporary array contents so that they are not garbage collected
+        and to make sure the array is large enough to hold the contents
+        of the sorted temporary vector.
+        https://bugs.webkit.org/show_bug.cgi?id=50718
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::addTempSortVector):
+        (JSC::Heap::removeTempSortVector):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/Collector.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort):
+        * runtime/JSValue.h:
+
+2010-12-09  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Changed setting of backtrack labels to not overwrite a prior
+        label.  Where losing prior labe which then reverted back to 
+        next character label.
+        https://bugs.webkit.org/show_bug.cgi?id=50579
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setBacktrackToLabel):
+
+2010-12-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Permit Character Class Escape in CharacterRange in Character Class.
+        https://bugs.webkit.org/show_bug.cgi?id=50483
+        https://bugs.webkit.org/show_bug.cgi?id=50538
+        https://bugs.webkit.org/show_bug.cgi?id=50654
+        https://bugs.webkit.org/show_bug.cgi?id=50646
+
+        We recently tightened up our spec conformance in generating syntax
+        error in these cases, however testing in the wild has shown this
+        to be problematic. This reverts the previous change in allowing
+        class escapes (e.g. \d) in ranges in character classes ([]), but
+        does retain some closer conformance to the spec in only allowing
+        ranges that would be permitted per the grammar rules in the spec
+        (e.g. in /[\d-a-z]/ "a-z" cannot be considered as a range).
+
+        * yarr/RegexParser.h:
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
+        (JSC::Yarr::Parser::parse):
+
+2010-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Try to fix crash-on-launch seen on Windows builder.
+
+        * wtf/OSAllocatorWin.cpp:
+        (WTF::OSAllocator::release): Disabled an ASSERT, because it checks for
+        a bug that hasn't been fixed yet.
+
+2010-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated .def file.
+
+2010-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated .def
+        file to remove a symbol -- the next build failure will say which symbol
+        to add back.
+
+2010-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated .def file.
+
+2010-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix GTK Linux build.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/AlignedMemoryAllocator.h:
+        (JSC::::AlignedMemoryAllocator): Updated for Usage enum moving to OSAllocator.
+
+2010-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Migrated OS-specific allocation code from PageReservation and PageAllocation to OSAllocator
+        https://bugs.webkit.org/show_bug.cgi?id=50653
+
+        * JavaScriptCore.exp: Updated for new function signature.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator): Removed checkAllocatedOkay.
+        OSAllocator is now the central location for verifying that allocation succeeds.
+        This allowed me to remove some complicating cross-platform cruft.
+
+        * runtime/AlignedMemoryAllocator.h:
+        (JSC::::allocate): Updated for code motion.
+
+        * wtf/OSAllocator.h: Added Usage, writable, and executable parameters, to
+        support VM features required by clients of PageAllocation and PageReservation.
+
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit): Moved PageAllocation support for randomizing
+        executable memory here.
+
+        * wtf/OSAllocatorSymbian.cpp:
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit): Updated for new function signatures.
+
+        * wtf/OSAllocatorWin.cpp:
+        (WTF::protection):
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::release): Updated for new function signatures. Moved
+        some protection-related and WINCE-related code from PageAllocation here.
+
+        * wtf/PageAllocation.cpp: Nixed cross-platform lastError abstraction, since
+        it was only used by checkAllocatedOkay, which is now gone.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::allocate):
+        (WTF::PageAllocation::allocateAligned):
+        (WTF::PageAllocation::deallocate):
+        (WTF::PageAllocation::isPowerOfTwo):
+        (WTF::PageAllocation::systemAllocateAligned): Removed system* functions,
+        and replaced calls to them with calls to OSAllocator.
+
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::reserve):
+        (WTF::PageReservation::deallocate):
+        (WTF::PageReservation::PageReservation): Ditto. Added m_writable and
+        m_executable because these flags are now required when committing memory.
+
+2010-12-08  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add web audio files to mac port Xcode projects
+        https://bugs.webkit.org/show_bug.cgi?id=50721
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-12-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Marking the active global object re-enters through markConservatively
+        https://bugs.webkit.org/show_bug.cgi?id=50711
+
+        draining of the MarkStack is not allowed to be re-entrant, we got away
+        with this simply due to the logic in MarkStack::drain implicitly handling
+        changes that could be triggered by the re-entry.
+
+        Just to be safe this patch removes the re-entry through markConservatively
+        so we don't accidentally introduce such an issue in future.  I've also
+        added an assertion to catch such errors.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::markCurrentThreadConservativelyInternal):
+        (JSC::Heap::markOtherThreadConservatively):
+        * runtime/JSArray.h:
+        (JSC::MarkStack::drain):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+
+2010-12-08  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Share code between Mac (CA) and Windows (CACF) GraphicsLayer implementations
+        https://bugs.webkit.org/show_bug.cgi?id=49388
+
+        Added a WTF_PLATFORM_CA flag. Set when platform is MAC or IOS or (WINDOWS AND CG)
+        which was decided was the best way to identify a build with CoreAnimation
+
+        * wtf/Platform.h:
+
+2010-12-07  Anders Carlsson  <andersca@apple.com>
+
+        Build fix follow up build fix.
+
+        * pcre/pcre_ucp_searchfuncs.cpp:
+        (jsc_pcre_ucp_othercase):
+
+2010-12-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix clang++ build
+        https://bugs.webkit.org/show_bug.cgi?id=50645
+
+        Explicitly cast offset to int.
+
+        * pcre/pcre_ucp_searchfuncs.cpp:
+        (jsc_pcre_ucp_othercase):
+
+2010-12-07  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by David Levin.
+
+        Fix compilation of core web audio files on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=50603
+
+        Added log2 definition to MathExtras.h on Windows platform.
+
+        * wtf/MathExtras.h:
+        (log2):
+
+2010-12-07  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=50412
+        http://www.wunderground.com/US/CA/Hayward.html causes big memory spike during page loading 
+        
+        Creating a substring caused the original string be flattened if it was in the rope form. This could use
+        significant amount of memory by reducing buffer sharing between strings.
+        
+        Add a rope specific substring function that constructs the substring by reusing the rope fibers
+        instead of flattening the rope.
+        
+        No change observed in SunSpider.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::substringFromRope):
+        * runtime/JSString.h:
+        (JSC::jsSubstring):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+
+2010-12-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Simplified some ASLR-related code in PageAllocation/Reservation
+        https://bugs.webkit.org/show_bug.cgi?id=50599
+        
+        Removed reserveAt, allocateAt, and friends, since they all existed to
+        serve one feature: ASLR for executable memory on x86_64 on Mac. Moved
+        ASLR code down into systemAllocate -- now, any time you allocate
+        executable memory on a supporting platform, the memory's location is
+        randomized.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator): No need for the caller
+        to randomize anything.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::systemAllocate): Removed some *At() functions, and
+        beefed up executable allocation with randomization.
+
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::systemReserve): Removed some *At() functions.
+
+2010-12-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        reserveAndCommit doesn't commit on MADVISE_FREE_REUSE systems
+        https://bugs.webkit.org/show_bug.cgi?id=50588
+        
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit): Tightened up some comments. Changed
+        reserveAndCommit to actually commit on MADVISE_FREE_REUSE systems.
+
+2010-12-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [WINCE] Add build system
+        https://bugs.webkit.org/show_bug.cgi?id=50522
+
+        * CMakeListsWinCE.txt: Added.
+        * shell/CMakeListsWinCE.txt: Added.
+        * wtf/CMakeListsWinCE.txt: Added.
+
+2010-12-06  John Tantalo  <john.tantalo@gmail.com>
+
+        Reviewed by Geoffrey Garen.
+
+        jsc does not ignore shebang
+        https://bugs.webkit.org/show_bug.cgi?id=49576
+
+        * jsc.cpp:
+        (fillBufferWithContentsOfFile):
+          - translate shebang into a valid JavaScript comment so the lexer ignores it
+
+2010-12-05  Adam Roben  <aroben@apple.com>
+
+        Windows production build fix
+
+        Put spaces after trailing backslashes when setting
+        %WebKitVSPropsRedirectionDir%. According to MSDN
+        <http://msdn.microsoft.com/en-us/library/2kzfk8c7(v=VS.80).aspx>:
+
+           A backslash ( \ ) followed by a newline character is interpreted as
+           a space in the command; use a backslash at the end of a line to
+           continue a command onto the next line. NMAKE interprets the
+           backslash literally if any other character, including a space or
+           tab, follows the backslash.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2010-12-04  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed, build fix after r69132.
+
+        * shell/CMakeLists.txt: Fix directory name (jsc -> shell).
+
+2010-12-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Drop GdkDrawable usage, it's deprecated in GTK+3.x and we can use GdkWindow
+        https://bugs.webkit.org/show_bug.cgi?id=50451
+
+        * wtf/gobject/GTypedefs.h: add GdkWindow defines.
+
+2010-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Bug 50509 - set* methods on MacroAssembler are awfully named.
+
+        Methods set32 and setTest32 compare 32-bit operands, and set a 32-bit results based on the comparison.
+        set8 compares 32-bit operands, and sets an 8-bit result based on the comparison.
+        setTest8 compares 8-bit operands, and sets a 32-bit result based on the comparison.
+
+        Rename to clarify.
+
+        set32 -> set32Compare32
+        setTest32 -> set32Test32
+        set8 -> set8Compare32
+        setTest8 -> set32Test8
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::setPtr):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::set32Compare32):
+        (JSC::MacroAssemblerARM::set8Compare32):
+        (JSC::MacroAssemblerARM::set32Test32):
+        (JSC::MacroAssemblerARM::set32Test8):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::set32Compare32):
+        (JSC::MacroAssemblerARMv7::set8Compare32):
+        (JSC::MacroAssemblerARMv7::set32Test32):
+        (JSC::MacroAssemblerARMv7::set32Test8):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::set8Compare32):
+        (JSC::MacroAssemblerMIPS::set32Compare32):
+        (JSC::MacroAssemblerMIPS::set32Test8):
+        (JSC::MacroAssemblerMIPS::set32Test32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::set8Compare32):
+        (JSC::MacroAssemblerX86Common::set32Compare32):
+        (JSC::MacroAssemblerX86Common::set32Test8):
+        (JSC::MacroAssemblerX86Common::set32Test32):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+
+2010-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Incorrect logic for returning memory at the end of linking.
+        Reviewed by Geoff Garen.
+
+        At the end of linking we return any space at the end of the
+        allocated executable region that was saved due to branch
+        compaction.  This is currently by done by subtracting the
+        different from the m_freePtr in the allocation pool.  This
+        can be incorrect if your allocation was made from a new
+        page that was not selected for subsequent allocations.
+
+        This patch corrects this behaviour by verifying that the
+        memory being returned actually comes from the current
+        allocation pool.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::linkCode):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::tryShrink):
+
+2010-12-03  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough
+
+        Changes to significantly reduce branches to branches in JIT'ed
+        parentheses backtrack processing.  The changes include the following:
+        - Taking the backtracking processing out of line and adding it as
+          code at the end of the JIT'ed routine.
+        - Allow backtracks to be direct via an indirect branch for an address
+          pushed onto the stack.  If the use of an indirect branch is from a
+          conditional jump, then we emit a trampoline at the end of the 
+          routine.
+        - Propogate backtracks instead of adding trampolines.  Backtracks are
+          propogated to where they are used.  This change also eliminated 
+          trampoline branch code that aren't used.
+        - Added global expression state to keep track of parentheses tail
+          code and indirect branches.
+        Other changes made to support these changes.
+        - Split invertOrCapture flag on Patterns to two separate flags.  Added
+          getters for these flags.  Rippled these changes to both the JIT 
+          and interpreter code.
+        - Split BacktrackDestination out off TermGenerationState struct.
+          This is done to hold references to a backtrack for later code
+          generation.
+        https://bugs.webkit.org/show_bug.cgi?id=50295
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::JmpDst::isSet):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::JmpDst::isSet):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Label::isSet):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::isUsed):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::used):
+        (JSC::AbstractMacroAssembler::JumpList::clear):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::JmpDst::isSet):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpDst::isSet):
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomParentheticalAssertionBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeBeginTerms):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BackReference):
+        (JSC::Yarr::ByteTerm::invert):
+        (JSC::Yarr::ByteTerm::capture):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::IndirectJumpEntry::IndirectJumpEntry):
+        (JSC::Yarr::RegexGenerator::IndirectJumpEntry::addJump):
+        (JSC::Yarr::RegexGenerator::GenerationState::GenerationState):
+        (JSC::Yarr::RegexGenerator::GenerationState::addIndirectJumpEntry):
+        (JSC::Yarr::RegexGenerator::GenerationState::emitIndirectJumpTable):
+        (JSC::Yarr::RegexGenerator::GenerationState::addParenthesesTail):
+        (JSC::Yarr::RegexGenerator::GenerationState::emitParenthesesTail):
+        (JSC::Yarr::RegexGenerator::GenerationState::addJumpToNextInteration):
+        (JSC::Yarr::RegexGenerator::GenerationState::addJumpsToNextInteration):
+        (JSC::Yarr::RegexGenerator::GenerationState::addDataLabelToNextIteration):
+        (JSC::Yarr::RegexGenerator::GenerationState::linkToNextIteration):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::BacktrackDestination):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::clear):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::clearDataLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::haveDestination):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::isStackOffset):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::isLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::isJumpList):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::haveDataLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::copyTarget):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::copyTo):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::addBacktrackJump):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setStackOffset):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setNextBacktrackLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setBacktrackToLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setBacktrackJumpList):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setBacktrackSourceLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setDataLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setSubDataLabelPtr):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::linkToNextBacktrack):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::getStackOffset):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::getLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::getBacktrackJumps):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::getDataLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::jumpToBacktrack):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::linkDataLabelToHereIfExists):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::plantJumpToBacktrackIfExists):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::linkAlternativeBacktracks):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::linkAlternativeBacktracksTo):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::clearBacktrack):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::jumpToBacktrack):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::plantJumpToBacktrackIfExists):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::addBacktrackJump):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setDataLabelPtr):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setBackTrackStackOffset):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setBacktrackLabel):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracks):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracksTo):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setBacktrackLink):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::chainBacktracks):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::chainBacktrackJumps):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::getBacktrackDestination):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::propagateBacktrackingFrom):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::ParenthesesTail):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::processBacktracks):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::setNextIteration):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::RegexGenerator::generateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::generateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::generateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        (JSC::Yarr::RegexGenerator::compile):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::PatternTerm::invert):
+        (JSC::Yarr::PatternTerm::capture):
+
+2010-12-03  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        First steps to adding web audio files to build systems
+        https://bugs.webkit.org/show_bug.cgi?id=49952
+
+        * wtf/Complex.h:
+
+2010-12-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Move StringWx.cpp into wtf directory
+        https://bugs.webkit.org/show_bug.cgi?id=50060
+
+        * wtf/wx/StringWx.cpp: Renamed from WebCore/platform/text/wx/StringWx.cpp.
+        (WTF::String::String):
+
+2010-12-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Move StringBrew.cpp into wtf directory
+        https://bugs.webkit.org/show_bug.cgi?id=50058
+
+        * wtf/brew/StringBrew.cpp: Renamed from WebCore/platform/text/brew/StringBrew.cpp.
+        (WTF::String::String):
+
+2010-12-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Move StringHaiku.cpp into wtf directory
+        https://bugs.webkit.org/show_bug.cgi?id=50057
+
+        * wtf/haiku/StringHaiku.cpp: Renamed from WebCore/platform/text/haiku/StringHaiku.cpp.
+        (WTF::String::String):
+        (WTF::String::operator BString):
+
+2010-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build.
+
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::synchronize): Added a non-CF implementation.
+
+2010-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed <rdar://problem/8310571> CrashTracer: 60 crashes in Photo Booth at
+        com.apple.JavaScriptCore: JSC::Heap::markRoots + 746
+        
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Call our new
+        synchronize() function.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::activityCallback):
+        * runtime/Collector.h: Added an activityCallback() accessor, for the
+        call above.
+
+        * runtime/GCActivityCallback.h:
+        (JSC::GCActivityCallback::synchronize):
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::operator()):
+        (JSC::DefaultGCActivityCallback::synchronize): Track the run loop we're
+        scheduled in. If we begin/resume execution within a new run loop, reschedule
+        on it. This prevents a crash when using a lockless context group on
+        multiple threads -- the crash would happen if the GC timer scheduled on
+        thread A, then you continued execution on thread B, then the thread A
+        timer fired.
+
+2010-12-02  Darin Adler  <darin@apple.com>
+
+        * wtf/ASCIICType.h: Fix wrong type from last check-in.
+
+2010-12-02  Darin Adler  <darin@apple.com>
+
+        Try to fix certain builds (Qt Windows).
+
+        * wtf/ASCIICType.h: Added an overload for unsigned because in obsolete
+        versions of ICU, UChar32 can be a typedef for unsigned. Adding this
+        overload should make us compatible with these old ICUs.
+
+2010-12-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add AtomicString::fromUTF8
+        https://bugs.webkit.org/show_bug.cgi?id=45594
+
+        Unicode::calculateStringHashFromUTF8 creates a StringHash out of UTF8 input data and
+        calculates the required length for the UTF16 conversation in one step.
+        This is then used in a specialized translator for the string table of AtomicString.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::CStringTranslator::equal):
+        (WTF::HashAndUTF8CharactersTranslator::hash):
+        (WTF::HashAndUTF8CharactersTranslator::equal):
+        (WTF::HashAndUTF8CharactersTranslator::translate):
+        (WTF::AtomicString::add):
+        (WTF::AtomicString::addSlowCase):
+        (WTF::AtomicString::find):
+        (WTF::AtomicString::fromUTF8):
+        * wtf/text/AtomicString.h:
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.h:
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::readUTF8Sequence):
+        (WTF::Unicode::convertUTF8ToUTF16):
+        (WTF::Unicode::calculateStringHashFromUTF8):
+        (WTF::Unicode::equalUTF16WithUTF8):
+        * wtf/unicode/UTF8.h:
+
+2010-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added a little hardening to OSAllocator.
+
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::release):
+        * wtf/OSAllocatorWin.cpp:
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+        (WTF::OSAllocator::release): CRASH() if the OS's virtual memory system
+        reports an error.
+
+2010-12-02  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        [Qt] Make platform managing of OSAllocator better than r73106
+        https://bugs.webkit.org/show_bug.cgi?id=50385
+
+        * wtf/OSAllocatorPosix.cpp: Remove platform specific guard.
+        * wtf/OSAllocatorSymbian.cpp: Remove platform specific guard.
+        * wtf/OSAllocatorWin.cpp: Remove platform specific guard.
+        * wtf/wtf.pri: Add the correct platform specific source file instead of all of them.
+
+2010-12-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [WINCE] Use GetTickCount() for srand()
+        https://bugs.webkit.org/show_bug.cgi?id=50338
+
+        time() is not a native function on WinCE, so use GetTickCount() instead.
+
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+
+2010-12-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] [Symbian] Reintroduce compiler optimizations for JSC
+        https://bugs.webkit.org/show_bug.cgi?id=50270
+
+        Add compiler optimization (symbian ARM target) which was lost after split from WebCore.
+        Tested via Sunspider and V8 - both of which show significant performance improvement.
+
+        * JavaScriptCore.pro:
+
+2010-12-02  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Move regex parsing and fallback handling to runtime/RegExp.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=50015
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        (JSC::RegExp::printTraceData):
+        * runtime/RegExp.h:
+        (JSC::RegExp::pattern):
+        * yarr/RegexInterpreter.cpp:
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::setFallBack):
+        (JSC::Yarr::RegexCodeBlock::isFallBack):
+        (JSC::Yarr::executeRegex):
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the GTK build.
+
+        * GNUmakefile.am: Use a full path to OSAllocator*.cpp.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the EFL Linux build.
+
+        * CMakeListsEfl.txt: Added OSAllocator to the project.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt build: Include all OS files for Qt's sake, and then
+        use #ifdefs in the files to exclude things based on OS.
+        
+        This is a pretty bad way to manage platforms -- hopefully we can
+        fix the Qt build system and move away from this in the future.
+
+        * wtf/OSAllocatorPosix.cpp:
+        * wtf/OSAllocatorSymbian.cpp:
+        * wtf/OSAllocatorWin.cpp:
+        * wtf/wtf.pri:
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Chromium build.
+        
+        * JavaScriptCore.gypi: This is a Windows build file, so use OSAllocatorWin.cpp.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the GTK build.
+
+        * GNUmakefile.am: Added OSAllocator to another project.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the GTK Linux build.
+
+        * JavaScriptCore.gypi: Added OSAllocator to the project.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt Linux build.
+
+        * wtf/OSAllocatorPosix.cpp: Use the right errno.h.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build: export some more symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt Linux build.
+
+        * wtf/wtf.pri: Use the POSIX OSAllocator for Qt Linux.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: commit doesn't have a return value.
+
+        * wtf/OSAllocatorWin.cpp:
+        (WTF::OSAllocator::commit):
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Export some symbols.
+
+        * JavaScriptCore.exp:
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Export OSAllocator.h as private
+        so other projects can see it.
+
+        * wtf/OSAllocatorPosix.cpp: #include UnusedParam.h for UNUSED_PARAM.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Baby step toward a cross-platform virtual memory abstraction: created
+        an all-static OSAllocator class and changed MarkStack to use it.
+
+        * JavaScriptCore.exp: These functions are inlined now.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added OSAllocatorWin.cpp.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added OSAllocatorPosix.cpp.
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack): Use OSAllocator instead of rolling our
+        own platform-specific code.
+
+        * runtime/MarkStackNone.cpp: Removed. Nothing used this.
+
+        * runtime/MarkStackPosix.cpp: 
+        * runtime/MarkStackSymbian.cpp:
+        * runtime/MarkStackWin.cpp: Removed custom platform-specific code, since
+        we use the OSAllocator abstraction now.
+
+        * wtf/OSAllocator.h: Added.
+        * wtf/OSAllocatorPosix.cpp: Added.
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+        (WTF::OSAllocator::release):
+        * wtf/OSAllocatorSymbian.cpp: Added.
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+        (WTF::OSAllocator::release):
+        * wtf/OSAllocatorWin.cpp: Added.
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+        (WTF::OSAllocator::release): The new OSAllocator abstraction.
+
+        * wtf/wtf.pri: Added OSAllocatorSymbian.cpp.
+
+2010-12-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WinCairo build should not use link-time code generation (LTCG)
+        https://bugs.webkit.org/show_bug.cgi?id=50353
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+010-12-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        vcproj changes can't be applied cleanly by the Windows EWS bot
+        https://bugs.webkit.org/show_bug.cgi?id=50328
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Added property svn:eol-style.
+
+2010-12-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 50298 - /()()()()()()()()()(?:(\10a|b)(X|Y))+/.exec("bXXaYYaY") ASSERTs
+
+        For unmatched subpattens we previously used to set the subpattern end to -1,
+        but now we only set the start value. E.g. consider the following:
+            /a(b)?c/.exec("ac");
+        Previously we would generate an internal results array of:
+            [ 0, 2, -1, -1 ]
+        Since fairly recently we have generated results of:
+            [ 0, 2, -1, ??? ]
+        (With the end index of the subpattern uninitialized).
+
+        Update these ASSERTs to account for this.
+
+        Also, when stripping out self-referencing backreferences, (e.g. /(\1)/) we
+        were checking the wrong property on the pattern term. We should have been
+        looking at term.parentheses.subpatternId, but instead were checking
+        term.subpatternId. The latter is actually only the subpatternId for
+        back reference terms. Rename this to backReferenceSubpatternId.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchBackReference):
+        (JSC::Yarr::Interpreter::backtrackBackReference):
+
+2010-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Bug 50297 - \s in YARR should match BOMs.
+
+        From section 15.10.2.12 CharacterClassEscape contains:
+
+        The production CharacterClassEscape :: s evaluates by returning the set of characters containing the
+        characters that are on the right-hand side of the WhiteSpace (7.2) or LineTerminator (7.3) productions.
+
+        Table 2 in section 7.2 contains:
+
+        \uFEFF Byte Order Mark <BOM>
+
+        * create_regex_tables:
+            Add BOM to spaces table.
+
+2010-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed review comments following bug #48101.
+        Mostly typos, plus gave quantifyInfinite a symbolic name.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        (JSC::Yarr::RegexPatternConstructor::checkForTerminalParentheses):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalEnd):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassGreedy):
+        * yarr/RegexParser.h:
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::parse):
+
+2010-11-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WTF project missing build-stopping code from its pre-build event
+        https://bugs.webkit.org/show_bug.cgi?id=50281
+
+        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd:
+
+2010-11-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Cleanup UTF8.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=49581
+
+        Use macros and functions instead of range values directly.
+
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::inlineUTF8SequenceLength):
+        (WTF::Unicode::UTF8SequenceLength):
+        (WTF::Unicode::convertUTF16ToUTF8):
+        (WTF::Unicode::readUTF8Sequence):
+        (WTF::Unicode::convertUTF8ToUTF16):
+        * wtf/unicode/UnicodeMacrosFromICU.h: Added U_IS_SUPPLEMENTARY macro.
+
+2010-11-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed a crash seen when using a PageAllocation to store itself.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::systemDeallocate): Zero out m_base before unmapping
+        it, in case unmapping m_base unmaps the PageAllocation.
+
+        * wtf/BumpPointerAllocator.h:
+        (WTF::BumpPointerPool::destroy): Now this work-around isn't needed!
+
+2010-11-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Darin Adler.
+
+        m_hasNonEnumerableProperties is never initialized in Structure
+        https://bugs.webkit.org/show_bug.cgi?id=50266
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): initialize member variable.
+
+2010-11-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix (part 1). Use correct environment variable syntax in cmd files.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreLink.cmd:
+        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd:
+        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd:
+        * JavaScriptCore.vcproj/jsc/jscPreBuild.cmd:
+        * JavaScriptCore.vcproj/jsc/jscPreLink.cmd:
+        * JavaScriptCore.vcproj/testapi/testapiPostBuild.cmd:
+        * JavaScriptCore.vcproj/testapi/testapiPreBuild.cmd:
+        * JavaScriptCore.vcproj/testapi/testapiPreLink.cmd:
+
+2010-11-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WTF support for <rdar://problem/8650085> adding word-prefix search options to the text search API.
+        https://bugs.webkit.org/show_bug.cgi?id=50038
+
+        * wtf/unicode/UnicodeMacrosFromICU.h: Copied additional macros from icu/unicode/utf16.h.
+
+2010-11-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        JavaScriptCore projects on Windows should use cmd files for build events
+        https://bugs.webkit.org/show_bug.cgi?id=50193
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreLink.cmd: Added.
+        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd: Added.
+        * JavaScriptCore.vcproj/jsc/jscPreBuild.cmd: Added.
+        * JavaScriptCore.vcproj/jsc/jscPreLink.cmd: Added.
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiPostBuild.cmd: Added.
+        * JavaScriptCore.vcproj/testapi/testapiPreBuild.cmd: Added.
+        * JavaScriptCore.vcproj/testapi/testapiPreLink.cmd: Added.
+
+2010-11-29  Dai Mikurube  <dmikurube@google.com>
+
+        Reviewed by Kent Tamura.
+
+        when empty, clicking "down" on outer-spin-button returns "max value"
+        https://bugs.webkit.org/show_bug.cgi?id=45491
+
+        It is required to calculate UTC/DST offsets to retrieve the current local milliseconds for
+        date/time type inputs. WTF::currentTimeMS() returns a UTC time, and WTF::getLocalTime()
+        returns a struct tm, not milliseconds.
+
+        Calculating milliseconds from a struct tm is not simple since timegm() cannot be used in all
+        environments. This calculation is already done in calculateUTCOffset(), and complicated.
+        Duplicating this complicated calculation is unreasonable because of maintainability.
+        To achieve this without duplication, we must call calculate{UTC|DST}Offset in some way.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp: Changed calculateUTCOffset() and calculateDSTOffset() to external functions.
+        (WTF::calculateUTCOffset):
+        (WTF::calculateDSTOffset):
+        * wtf/DateMath.h:
+
+2010-11-29  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Switch web audio code to use FloatPoint3D instead of Vector3
+        https://bugs.webkit.org/show_bug.cgi?id=50186
+
+        * wtf/Vector3.h: Removed.
+
+2010-11-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a mechanism for Windows pre-build/pre-link/post-build events to be separated into individual cmd files
+        https://bugs.webkit.org/show_bug.cgi?id=49858
+
+        We're migrating our prebuild/prelink/postbuild steps out of vcproj and vsprops files:
+        - To simplify editing (editing vsprops build steps is confusing).
+        - For more readable diffs.
+
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd: Added.
+        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd: Added.
+
+2010-11-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improved accuracy of command-line SunSpider.
+
+        * jsc.cpp:
+        (functionRun): Changed the "run" function to run a given test in
+        its own global object. Previously, all tests ran in the same global
+        object, which created name conflicts, and made globals from previous
+        tests artificially survive into later tests.
+        
+        Also changed "run" to return the elapsed milliseconds when running a
+        given test, for slightly more accurate numbers.
+
+        (functionCheckSyntax): Ditto on returning elapsed milliseconds.
+
+2010-11-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Andreas Kling.
+
+        Remove a couple unneeded overflow checks
+        https://bugs.webkit.org/show_bug.cgi?id=49816
+
+        * wtf/text/CString.cpp:
+        (WTF::CString::init): Use an ASSERT instead of
+        an overflow check with CRASH.
+
+2010-11-29  Adam Roben  <aroben@apple.com>
+
+        Robustify react-to-vsprops-changes.py against changes to its location
+        or the location of the .vsprops files
+
+        Suggested by John Sullivan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        Removed file_modification_times.
+        (main): Use glob.glob to find the .vsprops files and assert that we found some.
+
+2010-11-29  Adam Roben  <aroben@apple.com>
+
+        Touch wtf/Platform.h whenever any .vsprops file changes
+
+        This will cause all files to be recompiled, which will make changes to
+        preprocessor macros (e.g., ENABLE_*) actually take effect.
+
+        Fixes <http://webkit.org/b/50167> Windows build fails when ENABLE_*
+        macros are changed (because not enough files are rebuilt)
+
+        Reviewed by John Sullivan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        (main): Touch wtf/Platform.h if it's older than any .vsprops file. Also
+        added some comments and logging to make it clearer what the script is
+        doing and why.
+
+2010-11-29  Adam Roben  <aroben@apple.com>
+
+        Update react-to-vsprops-changes.py after r72555
+
+        .vsprops files are no longer accessed relative to $WebKitLibrariesDir.
+
+        Fixes <http://webkit.org/b/50166> REGRESSION (r72555):
+        react-to-vsprops-changes.py no longer works for people with a
+        non-default $WebKitLibrariesDir
+
+        Reviewed by John Sullivan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        (main): Always look in WebKitLibraries/win for .vsprops files, not in
+        $WebKitLibrariesDir.
+
+2010-11-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 48100 - YARR allows what seems like a bogus character-class range
+
+        Per ECMA-262 character classes containing character ranges containing
+        character classes are invalid, eg:
+            /[\d-x]/
+            /[x-\d]/
+            /[\d-\d]/
+        These should throw a syntax error.
+
+        * yarr/RegexParser.h:
+
+2010-11-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 48101 - Yarr gives different results for /(?:a*?){2,}/
+
+        The test cases in the linked mozilla bug demonstrate a couple of
+        problems in subpattern matching. These bugs lie in the optimized
+        cases - for matching parentheses with a quantity count of 1, and
+        for matching greedy quantified parentheses at the end of a regex
+        (which do not backtrack).
+
+        In both of these cases we are failing to correctly handle empty
+        matches. In the case of parentheses-single matches (quantity count
+        one) we are failing to test for empty matches at all. In the case
+        of terminal subpattern matches we do currently check, however there
+        is a subtler bug here too. In the case of an empty match we will
+        presently immediately fall through to the next alternative (or
+        complete the regex match), whereas upon a failed match we should
+        be backtracking into the failing alternative, to give it a chance
+        to match further (e.g. consider /a??b?|a/.exec("ab") - upon first
+        attempting to match the first alternative this will match the empty
+        string - since a?? is non-greedy, however rather than moving on to
+        the second alternative we should be re-matching the first one, at
+        which point the non-greedy a?? will match, and as such the result
+        should be "ab", not "a").
+
+        Terminal subpattern matching contains a second bug, too. The frame
+        location values in the subpattern should be being allocated with
+        the outer disjunction's frame (as we do for the parentheses-single
+        optimization). Consider the following three regexes:
+            /a*(?:b*)*c*/
+            /a*(?:b*)c*/
+            /a*(?:b*)*/
+        Considering only the frame location required by the atoms a,b, and
+        c, (ignoring space associated with the nested subpattern) the first
+        regex (a normal subpattern match) requires a frame size of 2 for
+        the outer disjunction, (to backtrack terms a & c), with each
+        iteration of the subpattern requiring a frame of size 1 (in order
+        to backtrack b). In the case of the second regex (where the
+        parentheses-single optimization will kick in) the outer frame must
+        be set up with a frame size of 3, since the outer frame will also
+        be used when running the nested subpattern. We will currently only
+        allocate a farme of size 1 for the outer disjuntion (to contain a),
+        howver the frame size should be 2 (since the subpattern will be
+        evaluated in the outer frame). In addition to failing to allocate
+        frame space the frame offsets are also presently invalid - in the
+        case of the last regex b's frame location will be set assuming it
+        to be the first term in the frame, whereas in this case b lies
+        after the term a, and should be taking a separate frame location.
+
+        In order to correctly allocate the frame for terminal subpattern
+        matches we must move this optimization back up from the JIT into
+        the compiler (and thus interpreter too), since this is where the
+        frame allocation takes place.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        (JSC::Yarr::RegexPatternConstructor::checkForTerminalParentheses):
+        (JSC::Yarr::compileRegex):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
+        (JSC::Yarr::Interpreter::matchParenthesesTerminalEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalEnd):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::PatternTerm):
+
+2010-11-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Remove Bakefile build system files
+        https://bugs.webkit.org/show_bug.cgi?id=49983
+
+        r53757 only removed the content, but not the files.
+        This patch removes that empty files.
+
+        * JavaScriptCoreSources.bkl: Removed.
+        * jscore.bkl: Removed.
+
+2010-11-24  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Merge the usage of jumps and calls at ARM-JIT
+        https://bugs.webkit.org/show_bug.cgi?id=50008
+
+        Those JmpSrc objects which represent jumps (not calls) should point to
+        after the jump instruction.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::blx):
+        (JSC::ARMAssembler::loadBranchTarget):
+        (JSC::ARMAssembler::getAbsoluteJumpAddress):
+        (JSC::ARMAssembler::linkJump):
+        (JSC::ARMAssembler::relinkJump):
+        (JSC::ARMAssembler::linkCall):
+        (JSC::ARMAssembler::relinkCall):
+        (JSC::ARMAssembler::getRelocatedAddress):
+        (JSC::ARMAssembler::getDifferenceBetweenLabels):
+        (JSC::ARMAssembler::getCallReturnOffset):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::call):
+
+2010-11-24  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Optimize foldCase, toLower and toUpper methods in glib unicode backend
+        https://bugs.webkit.org/show_bug.cgi?id=48625
+
+        GLib methods use UTF-8 strings, so we have to convert from UTF-16 to
+        UTF-8 to perform the case operations and then convert back the result to
+        UTF-16. GLib conversion methods return a new allocated string, so we
+        have to memcpy the result into the destination buffer too. Using our
+        own methods to convert between UTF-8 and UTF-16 from wtf/unicode/UTF8.h
+        we don't need such memcpy, since they take an already allocated buffer
+        rather than returning a new one. There's another optimization for the
+        case when the destination buffer is not large enough. In that case,
+        methods should return the expected destination buffer size and are
+        called again with a new buffer. We can avoid the conversion to UTF-16 by
+        pre-calculating the required size for the destination buffer.
+
+        * wtf/unicode/glib/UnicodeGLib.cpp:
+        (WTF::Unicode::getUTF16LengthFromUTF8):
+        (WTF::Unicode::convertCase):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+
+2010-11-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Use WTF::StringHasher directly in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=49893
+
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::Hash::hash):
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierCStringTranslator::hash):
+        (JSC::IdentifierUCharBufferTranslator::hash):
+
+2010-11-22  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Add WTF::FixedArray::size()
+        https://bugs.webkit.org/show_bug.cgi?id=49891
+
+        Add a method to get the size of a FixedArray.
+
+        * wtf/FixedArray.h:
+        (WTF::FixedArray::size):
+
+2010-11-22  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WINCE] Set correct preprocessor definitions
+        https://bugs.webkit.org/show_bug.cgi?id=49887
+
+        * wtf/Platform.h:
+
+2010-11-22  Adam Roben  <aroben@apple.com>
+
+        Use paths relative to $WebKitVSPropsRedirectionDir to access shared .vsprops files
+
+        Apple's Windows build allows placing header files and import libraries for WebKit's
+        dependencies (CoreGraphics, CFNetwork, SQLite, etc.) outside the source tree via the
+        $WebKitLibrariesDir environment variable. This is both required for production builds and
+        convenient for Apple-internal developer builds. Apple's production builds also require that
+        WebKit's shared .vsprops files be accessed relative to $WebKitLibrariesDir. In production
+        builds, the files are copied into that directory tree by the
+        WebKitLibraries/win/tools/WinTools.make file. In Apple-internal developer builds, the
+        copying is done by
+        JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make.
+
+        This .vsprops copying is problematic in one very important case: when a developer updates
+        their source tree and then tries to build. Visual Studio only reads .vsprops files when a
+        project is first loaded. So, when Visual Studio is first opened after the .vsprops files are
+        updated, it reads in the old files that were already residing in $WebKitLibrariesDir. When a
+        build is started, JavaScriptCoreGenerated.make copies the new .vsprops files into
+        $WebKitLibrariesDir, but Visual Studio will not pick up the changes.  The rest of the build
+        will proceed with out-of-date .vsprops files, which will likely result in a build failure.
+
+        To fix this, we now use normal relative paths to access the .vsprops files in the source
+        tree rather than in $WebKitLibrariesDir, but prefix those paths with a new environment
+        variable, $WebKitVSPropsRedirectionDir. In developer builds, this environment variable is
+        unset, so the normal relative paths are used to read the .vsprops files out of the source
+        tree directly. In production builds, this environment variable is set to a fake directory
+        that will cause the .vsprops files in $WebKitLibrariesDir to be found when the relative path
+        is resolved.
+        
+        For example, JavaScriptCore.vcproj uses this path for FeatureDefines.vsprops:
+
+        $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops
+
+        In developer builds, where $WebKitVSPropsRedirectionDir is unset, this will point to the
+        files in WebKitLibraries\win\tools\vsprops in the source tree. In production builds,
+        JavaScriptCore.make sets $WebKitVSPropsRedirectionDir to
+        "$(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\1\2\3\", so the full path for
+        FeatureDefines.vsprops becomes:
+
+        $(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\1\2\3\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops
+
+        which resolves to:
+
+        $(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops
+
+        (We rely on the fact that Windows doesn't care whether the directories "1", "2", and "3"
+        actually exist since they are matched by an equal number of ".." path components.)
+
+        Note that Visual Studio still won't pick up changes made to .vsprops files while Visual
+        Studio is open, but that problem hasn't seemed to cause developers many headaches so far.
+
+        Fixes <http://webkit.org/b/49181> Windows build fails mysteriously when .vsprops files are
+        updated
+
+        Reviewed by Dave Hyatt.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Set $WebKitVSPropsRedirectionDir so that
+        production builds can find the .vsprops files.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Stopy copying the
+        .vsprops files. It isn't needed anymore.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        Changed to use paths relative to $WebKitVSPropsRedirectionDir to access shared .vsprops
+        files.
+
+2010-11-19  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        YARR JIT should fallback to YARR Interpreter instead of PCRE.
+        https://bugs.webkit.org/show_bug.cgi?id=46719
+
+        Remove the ENABLE_YARR macro and the option of matching regular
+        expressions with PCRE from JavaScriptCore.
+
+        * runtime/JSGlobalData.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * tests/mozilla/expected.html:
+        * wtf/Platform.h:
+        * yarr/RegexCompiler.cpp:
+        * yarr/RegexCompiler.h:
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::byteCompileRegex):
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::getFallback):
+        (JSC::Yarr::RegexCodeBlock::isFallback):
+        (JSC::Yarr::RegexCodeBlock::setFallback):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexParser.h:
+        * yarr/RegexPattern.h:
+
+2010-11-20  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by David Kilzer.
+
+        [BREWMP] Replace DBGPRINTF and DBGPRINTF_FATAL with dbg_Message
+        https://bugs.webkit.org/show_bug.cgi?id=49520
+
+        DBGPRINTF and DBGPRINTF_FATAL macros are prohibited in Mod1. Use dbg_Message instead.
+
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+
+2010-11-20  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Support JIT_OPTIMIZE_MOD on Thumb-2
+        https://bugs.webkit.org/show_bug.cgi?id=49432
+
+        Rewrite the soft modulo operation into macroassembler form, and move it
+        to JSValue32_64 section.
+        Add support for soft modulo on Thumb-2 JIT also.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::clz):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::countLeadingZeros32):
+        (JSC::MacroAssemblerARM::relativeTableJump):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::countLeadingZeros32):
+        (JSC::MacroAssemblerARMv7::relativeTableJump):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::softModulo):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * wtf/Platform.h:
+
+2010-11-20  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/49848> Make it possible to display the last character of a secure text field unobscured
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.exp:
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::secure): Added argument that controls whether
+        the last character is obscured or not.  Implemented behavior.
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::LastCharacterBehavior): Added enum.
+        (WTF::StringImpl::secure): Updated method signature.
+
+2010-11-19  William Chan  <willchan@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add USE(CHROMIUM_NET)
+
+        Indicates the use of Chromium's network stack.  Chromium's network
+        stack performs better when it has full view of all resource requests,
+        so USE(CHROMIUM_NET) can be used to bypass throttles.
+
+        https://bugs.webkit.org/show_bug.cgi?id=49778
+
+        * wtf/Platform.h:
+
+2010-11-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add Debug_Cairo_CFLite and Release_Cairo_CFLite configurations for all vcproj files
+        https://bugs.webkit.org/show_bug.cgi?id=49819
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+2010-11-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Don't check for constant registers when we can guarantee that the register won't be in the constant pool
+        https://bugs.webkit.org/show_bug.cgi?id=49814
+
+        Add uncheckedR(int) to CallFrame, and replace all the uses of r() with uncheckedR()
+        when we can guarantee that the register is not referring to a constant.
+        This makes the interpreter about 0.5% faster, and makes the CallFrame initialisation
+        logic correct when we're using a faked callframe (as in the case of the globalExec).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::createActivation):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::thisObject):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::uncheckedR):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+
+2010-11-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Normalize Cairo/CFLite project/solution configuration names
+        https://bugs.webkit.org/show_bug.cgi?id=49818
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+2010-11-18  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Windows vcproj configuration names should be normalized across projects
+        https://bugs.webkit.org/show_bug.cgi?id=49776
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+
+2010-11-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed, build fix after r72360.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+
+2010-11-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        Bug 49577 - Function.prototype should be non-configurable
+
+        Ooops, Function.prototype should not be enumerable!
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+
+2010-11-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 49708 - Stop recompiling functions to regenerate exception info.
+
+        Instead only hold info as necessary – keep divot info is the inspector
+        is enabled, line number info is debugging or profiling, and handler
+        info for functions with try/catch.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpStatistics):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::addExpressionInfo):
+        (JSC::CodeBlock::addLineInfo):
+        (JSC::CodeBlock::hasExpressionInfo):
+        (JSC::CodeBlock::hasLineInfo):
+        (JSC::CodeBlock::needsCallReturnIndices):
+        (JSC::CodeBlock::callReturnIndexVector):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        (JSC::BytecodeGenerator::emitExpressionInfo):
+        (JSC::BytecodeGenerator::addLineInfo):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::jitThrow):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Collector.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::usingAPI):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::supportsRichSourceInfo):
+        (JSC::JSGlobalObject::globalData):
+
+2010-11-18  Adam Roben  <aroben@apple.com>
+
+        Add a script to delete manifest-related files when they are older than
+        any .vsprops file
+
+        Changes to .vsprops files can cause the manifest files to become
+        invalid, and Visual Studio doesn't always figure out that it needs to
+        rebuild them.
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        Call the new script.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        Added the new script.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py: Added.
+        (file_modification_times): Generator to return the modification time of
+        each file in a directory hierarchy.
+        (main): Get the modification time of the newest vsprops file, then find
+        all manifest-related files in the obj directory. Delete all
+        manifest-related files that are older than the newest vsprops file.
+
+2010-11-18  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        <rdar://problem/8602509&8602717&8602724> Enable compaction support.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2010-11-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 49635 - Profiler implementation is fragile
+
+        The profile presently requires the exception handling mechanism to explicitly
+        remove all stack frames that are exited during the exception unwind mechanism.
+        This is fragile in a number of ways:
+          * We have to change bytecode register allocation when compiling code to run
+            when profiling, to preserve the callee function (this is also required to
+            call did_call after the call has returned).
+          * In the JIT we have to maintain additional data structures
+            (CodeBlock::RareData::m_functionRegisterInfos) to map back to the register
+            containing the callee.
+          * In the interpreter we use 'magic values' to offset into the instruction
+            stream to rediscover the register containing the function.
+
+        Instead, move profiling into the head and tail of functions.
+          * This correctly accounts the cost of the call itself to the caller.
+          * This allows us to access the callee function object from the callframe.
+          * This means that at the point a call is made we can track the stack depth
+            on the ProfileNode.
+          * When unwinding we can simply report the depth at which the exception is
+            being handled - all call frames above this level are freed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::methodCallLinkInfo):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        (JSC::ProfileGenerator::exceptionUnwind):
+        (JSC::ProfileGenerator::stopProfiling):
+        * profiler/ProfileGenerator.h:
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::ProfileNode):
+        (JSC::ProfileNode::willExecute):
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::create):
+        (JSC::ProfileNode::callerCallFrame):
+        * profiler/Profiler.cpp:
+        (JSC::dispatchFunctionToProfiles):
+        (JSC::Profiler::_willExecute):
+        (JSC::Profiler::_didExecute):
+        (JSC::Profiler::exceptionUnwind):
+        * profiler/Profiler.h:
+
+2010-11-18  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Remove leftover Windows Debug_Internal configurations
+        https://bugs.webkit.org/show_bug.cgi?id=49758
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+2010-11-18  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Avoid increasing required alignment of target type warning
+        https://bugs.webkit.org/show_bug.cgi?id=43963
+
+        * runtime/UString.h:
+        (JSC::UStringHash::equal):
+        * wtf/StdLibExtras.h:
+
+2010-11-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add stubbed out ScrollAnimator for the Mac
+        https://bugs.webkit.org/show_bug.cgi?id=49678
+
+        * wtf/Platform.h: Enable SMOOTH_SCROLLING on the Mac, this has no
+        change in behavior at the moment.
+
+2010-11-17  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/49634> Make overflow guards in WTF::String::utf8 explicit
+
+        Reviewed by Darin Adler.
+
+        Add an explicit overflow check prior to allocating our buffer,
+        rather than implicitly relying on the guard in convertUTF16ToUTF8.
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::utf8):
+
+2010-11-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r72197.
+        http://trac.webkit.org/changeset/72197
+        https://bugs.webkit.org/show_bug.cgi?id=49661
+
+        broke fast/regex/test1.html (Requested by stampho on #webkit).
+
+        * runtime/JSGlobalData.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExpRepresentation::~RegExpRepresentation):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * tests/mozilla/expected.html:
+        * wtf/Platform.h:
+        * yarr/RegexCompiler.cpp:
+        * yarr/RegexCompiler.h:
+        * yarr/RegexInterpreter.cpp:
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::getFallback):
+        (JSC::Yarr::RegexCodeBlock::setFallback):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexParser.h:
+        * yarr/RegexPattern.h:
+
+2010-11-17  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        YARR JIT should fallback to YARR Interpreter instead of PCRE.
+        https://bugs.webkit.org/show_bug.cgi?id=46719
+
+        Remove the ENABLE_YARR macro and the option of matching regular
+        expressions with PCRE from JavaScriptCore.
+
+        * runtime/JSGlobalData.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * tests/mozilla/expected.html:
+        * wtf/Platform.h:
+        * yarr/RegexCompiler.cpp:
+        * yarr/RegexCompiler.h:
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::byteCompileRegex):
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::getFallback):
+        (JSC::Yarr::RegexCodeBlock::isFallback):
+        (JSC::Yarr::RegexCodeBlock::setFallback):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexParser.h:
+        * yarr/RegexPattern.h:
+
+2010-11-17  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Extend YARR Interpreter with beginning character look-up optimization
+        https://bugs.webkit.org/show_bug.cgi?id=45751
+
+        Add beginning character look-up optimization which sets the start
+        index to the first possible successful pattern match.
+        Extend YARR Interpreter with lookupForBeginChars function which
+        implements the beginning character look-up optimization.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::InputStream::readPair):
+        (JSC::Yarr::Interpreter::InputStream::isNotAvailableInput):
+        (JSC::Yarr::Interpreter::lookupForBeginChars):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+
+2010-11-17  Alexis Menard  <alexis.menard@nokia.com>, Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Christiansen, Tor Arne Vestbø.
+
+        [Qt] Add support for use GStreamer with the Qt build
+
+        Enable the build/inclusion of the wtf/QObject convenience classes.
+
+        * JavaScriptCore.pri:
+        * wtf/wtf.pri:
+
+2010-11-17  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Collect the beginning characters in a RegExp pattern for look-up
+        optimization
+        https://bugs.webkit.org/show_bug.cgi?id=45748
+
+        Extend the YARR's parser with an algorithm which collects the potential
+        beginning characters from a RegExp pattern for later look-up optimization.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::BeginCharHelper::BeginCharHelper):
+        (JSC::Yarr::BeginCharHelper::addBeginChar):
+        (JSC::Yarr::BeginCharHelper::merge):
+        (JSC::Yarr::BeginCharHelper::addCharacter):
+        (JSC::Yarr::BeginCharHelper::linkHotTerms):
+        (JSC::Yarr::RegexPatternConstructor::RegexPatternConstructor):
+        (JSC::Yarr::RegexPatternConstructor::addBeginTerm):
+        (JSC::Yarr::RegexPatternConstructor::setupDisjunctionBeginTerms):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeBeginTerms):
+        (JSC::Yarr::RegexPatternConstructor::setupBeginChars):
+        (JSC::Yarr::compileRegex):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::TermChain::TermChain):
+        (JSC::Yarr::BeginChar::BeginChar):
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+
+2010-11-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r72160.
+        http://trac.webkit.org/changeset/72160
+        https://bugs.webkit.org/show_bug.cgi?id=49646
+
+        Broke lots of fast/profiler tests, among others (Requested by
+        aroben on #webkit).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFunctionRegisterInfo):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::profileHookRegister):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        (JSC::ProfileGenerator::stopProfiling):
+        * profiler/ProfileGenerator.h:
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::ProfileNode):
+        (JSC::ProfileNode::willExecute):
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::create):
+        (JSC::ProfileNode::operator==):
+        * profiler/Profiler.cpp:
+        (JSC::dispatchFunctionToProfiles):
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        * profiler/Profiler.h:
+
+2010-11-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 49635 - Profiler implementation is fragile
+
+        The profile presently requires the exception handling mechanism to explicitly
+        remove all stack frames that are exited during the exception unwind mechanism.
+        This is fragile in a number of ways:
+          * We have to change bytecode register allocation when compiling code to run
+            when profiling, to preserve the callee function (this is also required to
+            call did_call after the call has returned).
+          * In the JIT we have to maintain additional data structures
+            (CodeBlock::RareData::m_functionRegisterInfos) to map back to the register
+            containing the callee.
+          * In the interpreter we use 'magic values' to offset into the instruction
+            stream to rediscover the register containing the function.
+
+        Instead, move profiling into the head and tail of functions.
+          * This correctly accounts the cost of the call itself to the caller.
+          * This allows us to access the callee function object from the callframe.
+          * This means that at the point a call is made we can track the stack depth
+            on the ProfileNode.
+          * When unwinding we can simply report the depth at which the exception is
+            being handled - all call frames above this level are freed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::methodCallLinkInfo):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::count):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        * interpreter/Interpreter.cpp:
+        (JSC::ProfileHostCall::ProfileHostCall):
+        (JSC::ProfileHostCall::~ProfileHostCall):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_has_called):
+        (JSC::JIT::emit_op_profile_will_return):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_has_called):
+        (JSC::JIT::emit_op_profile_will_return):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        (JSC::ProfileGenerator::exceptionUnwind):
+        (JSC::ProfileGenerator::stopProfiling):
+        * profiler/ProfileGenerator.h:
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::ProfileNode):
+        (JSC::ProfileNode::willExecute):
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::create):
+        (JSC::ProfileNode::operator==):
+        (JSC::ProfileNode::exec):
+        * profiler/Profiler.cpp:
+        (JSC::dispatchFunctionToProfiles):
+        (JSC::Profiler::hasCalled):
+        (JSC::Profiler::willEvaluate):
+        (JSC::Profiler::willReturn):
+        (JSC::Profiler::didEvaluate):
+        (JSC::Profiler::exceptionUnwind):
+        * profiler/Profiler.h:
+
+2010-11-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben and Steve Falkenburg.
+
+        Touch Platform.h to force a rebuild for Windows.
+
+        * wtf/Platform.h:
+
+2010-11-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Disable LTCG for Windows Release builds. Add new Release_LTCG configuration.
+        https://bugs.webkit.org/show_bug.cgi?id=49632
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+2010-11-16  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The number of recursive match calls isn't limited in YARR Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=47906
+
+        Check the number of the matchDisjunction recursive calls to avoid unbounded
+        recursion.
+        Now the matchDisjunction function returns JSRegExpResult instead of bool.
+        The JSRegExpResult enum contains the result of matching or the error code
+        of the failure (like HitLimit) which terminates the matching.
+        The error codes are based on pcre's jsRegExpExecute error codes.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::matchNonZeroDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::Interpreter::Interpreter):
+        * yarr/RegexInterpreter.h:
+
+2010-11-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Rest of the Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-11-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix pt 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-11-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=49606
+
+        The bug here is that we read the prototype from the RHS argument using a regular
+        op_get_by_id before op_instanceof has checked that this is an object implementing
+        HasInstance. This incorrect behaviour gives rise to further unnecessary complexity
+        in the code base, since we have additional logic (implemented using the
+        GetByIdExceptionInfo data structures on CodeBlock) to convert not an object errors
+        from the get_by_id into invalid parameter errors. Having fixed this bug this code
+        is all redundant, since in these cases the get_by_id will never have been reached.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addExpressionInfo):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCheckHasInstance):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_check_has_instance):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_check_has_instance):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createInterruptedExecutionException):
+        (JSC::createTerminatedExecutionException):
+        (JSC::createUndefinedVariableError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toPrimitive):
+        (JSC::JSNotAnObject::getPrimitiveNumber):
+        (JSC::JSNotAnObject::toBoolean):
+        (JSC::JSNotAnObject::toNumber):
+        (JSC::JSNotAnObject::toString):
+        (JSC::JSNotAnObject::toObject):
+        (JSC::JSNotAnObject::getOwnPropertySlot):
+        (JSC::JSNotAnObject::getOwnPropertyDescriptor):
+        (JSC::JSNotAnObject::put):
+        (JSC::JSNotAnObject::deleteProperty):
+        (JSC::JSNotAnObject::getOwnPropertyNames):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::JSNotAnObject):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isActivationObject):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::synthesizeObject):
+        (JSC::JSValue::synthesizePrototype):
+
+2010-11-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Harden additional string functions against large lengths
+        https://bugs.webkit.org/show_bug.cgi?id=49574
+
+        * wtf/text/CString.cpp:
+        (WTF::CString::init): Check for length that is too large for CString.
+        (WTF::CString::newUninitialized): Ditto.
+        (WTF::CString::copyBufferIfNeeded): Fix types so the length stays
+        in a size_t.
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::append): Check for length that is too large.
+
+2010-11-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 49577 - Function.prototype should be non-configurable
+
+        JSC lazily allocates the prototype property of Function objects.
+
+        We check the prototype exists on 'get', but not on 'put'.
+        If you 'put' without having first done a 'get' you can end up with a configurable
+        prototype (prototype should only ever be non-configurable).
+
+        This is visible in a couple of ways:
+          * 'delete' on the property may succeed. (the next access will result in a new,
+          reset prototype object).
+          * the prototype may be set to a getter.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyNames):
+            Reify the prototype property before allowing an enumerate including don't enum properties.
+        (JSC::JSFunction::put):
+            Reify the prototype property before any put to it.
+
+2010-11-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 49488 - Only add source specific information to exceptions in Interpreter::throwException
+
+        Three types of source location information are added to errors.
+
+        (1) Divot information.
+
+        This was added with the intention of using it to provide better source highlighting in the inspector.
+        We may still want to do so, but we probably should not be exposing these values in a manner visible to
+        user scripts – only through an internal C++ interface. The code adding divot properties to objects has
+        been removed.
+
+        (2) Line number information.
+
+        Line number information is presently sometimes added at the point the exception is created, and sometimes
+        added at the point the exception passes through throwException. Change this so that throwException has
+        the sole responsibility for adding line number and source file information.
+
+        (3) Source snippets in the message of certain type errors (e.g. 'doc' in `Result of expression 'doc' [undefined] is not an object.`).
+
+        These messages are currently created at the point the exceptions is raised. Instead reformat the message
+        such that the source snippet is located at the end (`Result of expression 'b1' [undefined] is not an object.`
+        becomes `'undefined' is not an object (evaluating 'b1.property')`), and append these to the message at
+        the in throw Exception. This presents a number of advantages:
+          * we no longer need to have source location information to create these TypeErrors.
+          * we can chose to append source location information in other error messages, including those where
+            passing source location to the point of construction would be inconvenient.
+          * we can chose in future to omit to append source location information when running in a non-debug mode.
+
+        This also cleans up some error output, e.g. removing double brackets ('[[]]') around objects in output,
+        removing double periods (..) at end of lines, and adding slightly more context to some errors.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+            - Separated called to access line and range information.
+
+        * bytecode/CodeBlock.h:
+            - Separated called to access line and range information.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::isInvalidParamForIn):
+        (JSC::isInvalidParamForInstanceOf):
+            - Update parameters passed to error constructors.
+        (JSC::appendSourceToError):
+            - Update message property to add location information (previously added in createErrorMessage, in ExceptionHelpers)
+        (JSC::Interpreter::throwException):
+            - Updated to call appendSourceToError. 
+        (JSC::Interpreter::privateExecute):
+            - Update parameters passed to error constructors.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - Update parameters passed to error constructors.
+
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        (JSC::hasErrorInfo):
+            - Removed divot properties.
+
+        * runtime/Error.h:
+            - Removed divot properties.
+
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+            - Initialize new property.
+
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::appendSourceToMessage):
+        (JSC::ErrorInstance::setAppendSourceToMessage):
+        (JSC::ErrorInstance::clearAppendSourceToMessage):
+            - Added flag to check for errors needing location information appending.
+        (JSC::ErrorInstance::isErrorInstance):
+            - Added virtual method to check for ErrorInstances.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+            - Update parameters passed to error constructors, stopped adding line number information early, changed TypeError messages.
+
+        * runtime/ExceptionHelpers.h:
+            - Updated function signatures.
+
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+            - Update parameters passed to error constructors.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::isErrorInstance):
+            - Added virtual method to check for ErrorInstances.
+
+2010-11-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        CString(const char*) crashes when passed a null pointer
+        https://bugs.webkit.org/show_bug.cgi?id=49450
+
+        * wtf/text/CString.cpp:
+        (WTF::CString::CString):
+        Return early if str is null.
+
+2010-11-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 49420 - Clean up syntax/reference error throw.
+
+        Some errors detected at compile time are thrown at runtime. We currently do so using a op_new_error/op_throw bytecode pair.
+        This is not ideal. op_throw is used for explicit user throw statements, and has different requirements in terms or meta data
+        attached to the exception (controlled by the explicitThrow parameter passed to Interpreter::throwException). To work around
+        this, op_new_error has to add the meta data at an early stage, which is unlike other VM exceptions being raised.
+
+        We can simplify this and bring into line with other exception behaviour by changing new_error from just allocating an
+        Exception instance to also throwing it – but as a regular VM throw, correctly passing explicitThrow as false.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitThrowReferenceError):
+        (JSC::BytecodeGenerator::emitThrowSyntaxError):
+        (JSC::BytecodeGenerator::emitThrowExpressionTooDeepException):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThrowableExpressionData::emitThrowReferenceError):
+        (JSC::ThrowableExpressionData::emitThrowSyntaxError):
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::PostfixErrorNode::emitBytecode):
+        (JSC::PrefixErrorNode::emitBytecode):
+        (JSC::AssignErrorNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw_reference_error):
+        (JSC::JIT::emit_op_throw_syntax_error):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_throw_reference_error):
+        (JSC::JIT::emit_op_throw_syntax_error):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * parser/Nodes.h:
+
+2010-11-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Harden some string functions against large lengths
+        https://bugs.webkit.org/show_bug.cgi?id=49293
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::create): Fix incorrect use of PassRefPtr. Check for
+        strlen results that are too large for StringImpl.
+        (WTF::StringImpl::lower): Check for lengths that are too large for
+        int32_t.
+        (WTF::StringImpl::upper): Fix incorrect use of PassRefPtr. Check for
+        lengths that are too large for int32_t.
+        (WTF::StringImpl::secure): Fix incorect use of PassRefPtr. Use unsigned
+        rather than int and int32_t so we can handle any length.
+        (WTF::StringImpl::foldCase): Fix incorrect use of PassRefPtr. Check for
+        lengths that are too large for int32_t.
+        (WTF::StringImpl::find): Check for strlen results that are too large for
+        StringImpl.
+        (WTF::StringImpl::findIgnoringCase): Ditto.
+        (WTF::StringImpl::replace): Fix incorrect use of PassRefPtr.
+        (WTF::StringImpl::createWithTerminatingNullCharacter): Check before
+        incrementing length.
+
+2010-11-11  Dan Horák  <dan@danny.cz>
+
+        Reviewed by Andreas Kling.
+
+        Add support for the s390/s390x architectures, it's big-endian
+        with s390 being 32-bit and s390x being 64-bit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34786
+
+        * wtf/Platform.h:
+
+2010-11-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        HTML5 Ruby support should be mandatory feature
+        https://bugs.webkit.org/show_bug.cgi?id=49272
+
+        Remove Ruby as optional feature.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * JavaScriptCorePrefix.h:: Touch it to avoid incremental build failure on Windows.
+
+2010-11-10  Peter Rybin  <peter.rybin@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        HTML parser should provide script column position within HTML document to JavaScript engine
+        https://bugs.webkit.org/show_bug.cgi?id=45271
+
+        Adds TextPosition* classes -- a structure that stores line/column/generation
+        level coordinates inside text document. Adds *BasedNumber classes -- typesafe int
+        wrappers that emphasize whether int number is used as zero-based or
+        one-based.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Added.
+        (WTF::TextPosition::TextPosition):
+        (WTF::TextPosition::minimumPosition):
+        (WTF::TextPosition::belowRangePosition):
+        (WTF::ZeroBasedNumber::fromZeroBasedInt):
+        (WTF::ZeroBasedNumber::ZeroBasedNumber):
+        (WTF::ZeroBasedNumber::zeroBasedInt):
+        (WTF::ZeroBasedNumber::base):
+        (WTF::ZeroBasedNumber::belowBase):
+        (WTF::OneBasedNumber::fromOneBasedInt):
+        (WTF::OneBasedNumber::OneBasedNumber):
+        (WTF::OneBasedNumber::oneBasedInt):
+        (WTF::OneBasedNumber::convertAsZeroBasedInt):
+        (WTF::OneBasedNumber::convertToZeroBased):
+        (WTF::OneBasedNumber::base):
+        (WTF::OneBasedNumber::belowBase):
+        (WTF::toZeroBasedTextPosition):
+        (WTF::toOneBasedTextPosition):
+        (WTF::ZeroBasedNumber::convertToOneBased):
+
+2010-11-09  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        ARM JIT asserts when loading http://reader.google.com in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=48912
+
+        There are several cases when the uninterrupted sequence is larger than
+        maximum required offset for pathing the same sequence. Eg.: if in a
+        uninterrupted sequence the last macroassembler's instruction is a stub
+        call, it emits store instruction(s) which should not be included in the
+        calculation of length of uninterrupted sequence. So, the insnSpace and
+        constSpace should be upper limit instead of hard limit.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::endUninterruptedSequence):
+
+2010-11-09  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/49279> Fix include statements for local headers
+
+        Reviewed by Gavin Barraclough.
+
+        Use "Foo.h" instead of <Foo.h> for local headers.
+
+        * assembler/AbstractMacroAssembler.h: Also fixed sort order.
+        * assembler/CodeLocation.h:
+        * yarr/RegexJIT.h:
+        * yarr/RegexParser.h:
+
+2010-11-08  Adam Roben  <aroben@apple.com>
+
+        Roll out r71532
+
+        It broke the build for Cygwin 1.7 installs. Cygwin 1.7's default
+        .bashrc unsets %TEMP%, which broke copy-tools.cmd.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-tools.cmd: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/show-alert.js: Removed.
+
+2010-11-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        >=webkitgtk-1.2.5: parallel build fails with libtool: link: cannot find the library `libwebkit-1.0.la' or unhandled argument `libwebkit-1.0.la'
+        https://bugs.webkit.org/show_bug.cgi?id=49128
+
+        r59042 introduced a C++-style comment in Platform.h, which is often
+        included in C source files. Change it to a C-style comment.
+
+        * wtf/Platform.h: Fix the C++-style comment.
+
+2010-11-08  Adam Roben  <aroben@apple.com>
+
+        Show a message and cause the build to immediately fail when any
+        .vsprops files are copied
+
+        When $WebKitLibrariesDir is set to a non-standard location, the
+        .vsprops files have to be copied from WebKitLibraries/win to
+        $WebKitLibrariesDir. When this happens, Visual Studio doesn't pick up
+        changes to the .vsprops files until the next time it opens the solution
+        file. Before this patch, the build would soldier on with the old
+        .vsprops files, leading to strange build failures. Now we detect that
+        the .vsprops files have been updated, display a message to the user
+        telling them what to do, and make the build fail immediately.
+
+        Fixes <http://webkit.org/b/49181> Windows build fail mysteriously when
+        .vsprops files are updated
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        Moved code to copy the tools directory to the new copy-tools.cmd
+        script. Moved that after the command that writes the buildfailed file
+        so the build will be considered a failure if copy-tools.cmd fails.
+        Changed to write the project name into buildfailed like all our other
+        projects do, so those other projects will know that the failure was due
+        to this project.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        Added new scripts.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-tools.cmd: Added. Copies
+        the tools directory to $WebKitLibrariesDir. If any files were copied,
+        we display a message to the user and exit with error code 1 to cause
+        the build to fail. In non-interactive builds, we just print the message
+        to the build log. In interactive builds, we show the message in an
+        alert.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/show-alert.js: Added. Uses
+        Windows Scripting Host to display a message in an alert.
+
+2010-11-07  Sam Magnuson  <smagnuson@netflix.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] make install does not cause JavaScriptCore to be built
+        https://bugs.webkit.org/show_bug.cgi?id=49114
+
+        * JavaScriptCore.pro:
+
+2010-11-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Website consistently crashing TOT in JIT::execute() on news.com.au
+        https://bugs.webkit.org/show_bug.cgi?id=48954
+
+        The problem here was the strict pass of this conversion was loading the
+        this structure into one register but doing the flags check off a different
+        register.  This is clearly wrong.  I have been unable to trigger the crash
+        with a reduction, but I've added an assertion to the this conversion to
+        attempt to make it more readily catchable in future.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_convert_this_strict):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_convert_this_strict):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-11-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Adam Barth.
+
+        Use leakRef instead of releaseRef
+        https://bugs.webkit.org/show_bug.cgi?id=48974
+
+        Use leakRef instead of the deprecated releaseRef. This was renamed
+        some time ago because 'releaseRef' is too close to 'release',
+        which does something completely different.
+
+2010-11-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION(49798): Crash in HTMLObjectElement::parseMappedAttribute
+        https://bugs.webkit.org/show_bug.cgi?id=48789
+
+        The contract for all String/AtomicString methods seems to be that it's
+        safe to call them, even when the String is null (impl() returns 0).
+        This contract was broken by r49798 (unintentionally) when optimizing
+        for dromeo.
+        This patch adds a null check to AtomicString::lower() fixing this
+        crash and preventing future confusion.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::lower):
+
+2010-11-04  Adam Barth  <abarth@webkit.org>
+
+        Enabled ICCJPEG on Chromium Mac
+        https://bugs.webkit.org/show_bug.cgi?id=48977
+
+        * wtf/Platform.h:
+
+2010-11-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Crash in Function.prototype.call.apply
+        https://bugs.webkit.org/show_bug.cgi?id=48485
+
+        The problem here was op_load_varargs failing to ensure that
+        there was sufficient space for the entire callframe prior to
+        op_call_varargs.  This meant that when we then re-entered the
+        VM it was possible to stomp over an earlier portion of the
+        stack, so causing sub-optimal behaviour.
+
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoadVarargs):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_load_varargs):
+
+2010-11-03  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Chris Marrin.
+
+        Redesign extension mechanism in GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=46894
+
+        * JavaScriptCore.exp:
+         - Exposed String::split(const String&, Vector<String>).
+
+2010-11-03  Adam Roben  <aroben@apple.com>
+
+        Bring WTF.vcproj up to date
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added filters for the text and
+        unicode directories, added new files, removed old files.
+
+2010-11-03  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Remove unused initializeWeakRandomNumberGenerator
+        https://bugs.webkit.org/show_bug.cgi?id=48899
+
+        WeakRandom class is used instead of weakRandomNumber and its initializer.
+
+        * wtf/RandomNumberSeed.h:
+
+2010-11-03  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Unused class: JSFastMath with JSValue64
+        https://bugs.webkit.org/show_bug.cgi?id=48835
+
+        Remove unused JSFastMath class.
+
+        * runtime/JSImmediate.h:
+
+2010-11-02  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r71127
+
+        MSVC isn't smart enough to figure out that the definition of the global
+        nullptr variable isn't needed, so we provide one for it.
+
+        Fixes <http://webkit.org/b/48862> Windows build is broken due to
+        undefined symbol nullptr
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export nullptr.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added NullPtr.cpp and let VS
+        resort the files.
+
+        * wtf/NullPtr.cpp: Added.
+
+2010-11-02  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        Remove special handling of HashTableDeletedValue in PlatformRefPtr and manually manage memory that cannot be controlled by HashTraits
+        https://bugs.webkit.org/show_bug.cgi?id=48841
+
+        Remove special handling of HashTableDeletedValue in PlatformRefPtr.
+        This is better handled on a case-by-case basis, when HashTraits
+        cannot account for it.
+
+        * wtf/PlatformRefPtr.h:
+        (WTF::PlatformRefPtr::~PlatformRefPtr):
+        (WTF::PlatformRefPtr::clear):
+        (WTF::::operator):
+
+2010-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: r69429-r69611: Crash in JSC::Interpreter::privateExecute
+        https://bugs.webkit.org/show_bug.cgi?id=47573
+
+        I think the interpreter portion of this was introduced by
+        an incorrect but silent merge when I updated prior to committing.
+        The JIT change is basically just a correctness fix, but it is
+        needed to prevent the testcase from asserting in debug builds.
+
+        The basic problem is incorrectly setting the activation object
+        on an arguments object.  The crash was due to us setting a null
+        activation in the interpreter, in the jit we were setting the
+        activation of a strict mode arguments object.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * wtf/Platform.h:
+
+2010-10-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Adam Roben and David Kilzer.
+
+        Fix and cleanup of build systems
+        https://bugs.webkit.org/show_bug.cgi?id=48342
+
+        * Configurations/FeatureDefines.xcconfig: Add missing ENABLE_FULLSCREEN_API
+
+2010-10-28  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Include stddef.h unconditionally in Assertions.h
+        https://bugs.webkit.org/show_bug.cgi?id=48573
+
+        There is no reason to have stddef.h include be MSVC-only.
+
+        * wtf/Assertions.h:
+
+2010-10-28  Herczeg Zoltan  <zherczeg@webkit.org>
+
+        Rubber stamped by Csaba Osztrogonác.
+
+        Try to fix interpreter build.
+
+        Needed parentheses around assignment to avoid GCC warning after
+        http://trac.webkit.org/changeset/70703
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-10-28  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Csaba Osztrogonác.
+
+        resetAssertionMatches() is an unused function in YARR Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=48503
+
+        The resetAssertionMatches() function is removed from YARR Interpreter
+        because it's never called.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::resetMatches):
+
+2010-10-28  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Wrong instruction form for BKPT
+        https://bugs.webkit.org/show_bug.cgi?id=48427
+
+        One '0' is missing from BKPT instruction.
+        Thanks for Jacob Bramley for reporting this error.
+
+        * assembler/ARMAssembler.h:
+
+2010-10-28  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix Snow Leopard build.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::testPrototype):
+
+2010-10-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Do not have two different asCell APIs in JSValue
+        https://bugs.webkit.org/show_bug.cgi?id=47979
+
+        Remove JSCell* asCell(JSValue) in favor of only using
+        JSValue::asCell().
+
+        * API/APICast.h:
+        (toRef):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::testPrototype):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/GetterSetter.h:
+        (JSC::asGetterSetter):
+        * runtime/JSByteArray.h:
+        (JSC::asByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::getCallData):
+        (JSC::JSCell::getConstructData):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::asString):
+        * runtime/JSValue.h:
+        * runtime/Operations.cpp:
+        (JSC::jsIsObjectType):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+
+2010-10-27  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Support emit_op_mod() for MIPS on JSVALUE32_64
+        https://bugs.webkit.org/show_bug.cgi?id=46511
+
+        This patch uses MIPS div instructions for op_mod to improve performance.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+
+2010-10-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction.
+
+        * wtf/Platform.h: Make sure ACCELERATED_COMPOSITING is
+        turned off in the WinCairo port.  This isn't supported (yet.)
+
+2010-10-27  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Chris Marrin.
+
+        Add ENABLE_WEB_AUDIO feature enable flag (initially disabled) to build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=48279
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-10-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Windows build fix.
+
+        * jit/JITStubs.cpp:
+        (JSC::jitThrow):
+
+2010-10-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 48365 - Remove output parameters from JITStackFrame
+
+        The JIT stub functions presently use the stackframe to provide a couple of additional return values.
+          * In the case of uncaught exceptions the exception value is returned on the stackframe.exception property.
+          * In the case of caught exceptions the updated value for the callFrame register is returned on the stackframe.callFrame property.
+
+        Change exception returns such that exceptions are always returned on JSGlobalData::exception.
+        Change op_catch such that the new CallFrame value is returned from op_throw / vm_throw in regT0.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JITCode.h:
+        (JSC::JITCode::execute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::jitThrow):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createErrorForInvalidGlobalAssignment):
+        (JSC::throwOutOfMemoryError):
+        (JSC::throwStackOverflowError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2010-10-27  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48060
+        Speed up op_jeq_null and op_jneq_null.
+
+        For both opcodes the NullTag and UndefinedTag are checked to control the
+        jump. These values can be simply checked by AboveOrEqual or Below
+        condition if they are the two highest unsigned integers from JSValue's
+        Tag field.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        * runtime/JSValue.h:
+
+2010-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41948
+        REGRESSION(r60392): Registerfile can be unwound too far following an exception
+        
+        SunSpider reports no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Walk the stack to calculate the high
+        water mark currently in use. It's not safe to assume that the current
+        CallFrame's high water mark is the highest high water mark because
+        calls do not always set up at the end of a CallFrame. A large caller
+        CallFrame can encompass a small callee CallFrame.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall): Make sure to set a 0 CodeBlock
+        in the CallFrame of a host call, like the Interpreter does, instead of
+        leaving the CodeBlock field uninitialized. The backtracing code requires
+        a valid CodeBlock field in each CallFrame.
+
+2010-10-27  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Add cmn to branch32(reg, imm) on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=48062
+
+        The conditional comparison can be done with cmn if the imm value is
+        negative and can fit into the cmn instruction.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch32):
+
+2010-10-26  Oliver Hunt  <oliver@apple.com>
+
+        Interpreter build fix.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-10-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove exec and globalData arguments from jsNumber
+        https://bugs.webkit.org/show_bug.cgi?id=48270
+
+        Remove the now unused exec and globalData arguments from jsNumber
+        and mechanically update all users of jsNumber.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (functionRun):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/CachedTranscendentalFunction.h:
+        (JSC::CachedTranscendentalFunction::operator()):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/Error.cpp:
+        (JSC::addErrorSourceInfo):
+        (JSC::addErrorDivotInfo):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::getIndex):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        (JSC::jsNaN):
+        (JSC::JSValue::toJSNumber):
+        * runtime/JSONObject.cpp:
+        (JSC::unwrapBoxedPrimitive):
+        (JSC::PropertyNameForFunctionCall::value):
+        (JSC::JSONStringify):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/JSValue.h:
+        (JSC::jsDoubleNumber):
+        (JSC::jsNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::toJSNumber):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        (JSC::constructWithNumberConstructor):
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsAdd):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectLastIndex):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncLocaleCompare):
+
+2010-10-25  David Tapuska  <dtapuska@rim.com>
+
+        Reviewed by David Kilzer.
+
+        Enable VFP if our compiler settings indicated we had a hardware
+        VFP.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46096
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::isVFPPresent):
+
+2010-10-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70451.
+        http://trac.webkit.org/changeset/70451
+        https://bugs.webkit.org/show_bug.cgi?id=48249
+
+        Broke set-unloaded-frame-location.html under Qt (Requested by
+        caseq on #webkit).
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Removed.
+
+2010-10-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Replace _countof with WTF_ARRAY_LENGTH
+        https://bugs.webkit.org/show_bug.cgi?id=48229
+
+        * wtf/Platform.h:
+
+2010-10-25  Peter Rybin  <peter.rybin@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        HTML parser should provide script column position within HTML document to JavaScript engine
+        https://bugs.webkit.org/show_bug.cgi?id=45271
+
+        Adds TextPosition* classes -- a structure that stores line/column/generation
+        level coordinates inside text document. Adds *BasedNumber classes -- typesafe int
+        wrappers that emphasize whether int number is used as zero-based or
+        one-based.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Added.
+        (WTF::TextPosition::TextPosition):
+        (WTF::TextPosition::minimumPosition):
+        (WTF::TextPosition::belowRangePosition):
+        (WTF::ZeroBasedNumber::fromZeroBasedInt):
+        (WTF::ZeroBasedNumber::ZeroBasedNumber):
+        (WTF::ZeroBasedNumber::zeroBasedInt):
+        (WTF::ZeroBasedNumber::base):
+        (WTF::ZeroBasedNumber::belowBase):
+        (WTF::OneBasedNumber::fromOneBasedInt):
+        (WTF::OneBasedNumber::OneBasedNumber):
+        (WTF::OneBasedNumber::oneBasedInt):
+        (WTF::OneBasedNumber::convertAsZeroBasedInt):
+        (WTF::OneBasedNumber::convertToZeroBased):
+        (WTF::OneBasedNumber::base):
+        (WTF::OneBasedNumber::belowBase):
+        (WTF::toZeroBasedTextPosition):
+        (WTF::toOneBasedTextPosition):
+        (WTF::ZeroBasedNumber::convertToOneBased):
+
+2010-10-24  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by David Kilzer.
+
+        Check endianness with __BIG_ENDIAN in RVCT.
+        https://bugs.webkit.org/show_bug.cgi?id=46122
+
+        RVCT defines __BIG_ENDIAN if compiling for a big-endian target.
+
+        * wtf/Platform.h:
+
+2010-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Dave Kilzer.
+
+        Removed empty directories.
+
+        * JavaScriptCore: Removed.
+        * JavaScriptCore/runtime: Removed.
+
+2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed, fix typo of last build fix.
+
+        * wtf/DateMath.cpp:
+
+2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix for chromium.
+
+        * wtf/DateMath.cpp: Added missing include.
+
+2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Add WTF_ARRAY_LENGTH macro to WTF
+        https://bugs.webkit.org/show_bug.cgi?id=32828
+
+        Unify the different implementations and usages.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendQuotedString):
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        * wtf/StdLibExtras.h:
+
+2010-10-24  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Filter example Chiseled from SVG Wow! is slow
+        https://bugs.webkit.org/show_bug.cgi?id=48174
+
+        Added 'using WTF::ByteArray;' at the end of ByteArray.h
+
+        * wtf/ByteArray.h:
+
+2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Inline WTF::bitwise_cast and fix style
+        https://bugs.webkit.org/show_bug.cgi?id=48208
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitwise_cast):
+        (WTF::bitCount):
+
+2010-10-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Sam Weinig.
+
+        Unify globalData APIs
+        https://bugs.webkit.org/show_bug.cgi?id=47969
+
+        Make JSGlobalObject::globalData return a reference and adapt
+        callers. This unifies the API with the existing
+        CallFrame::globalData, which also returns a reference.
+
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        * jsc.cpp:
+        (runWithScripts):
+        * parser/JSParser.cpp:
+        (JSC::jsParse):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * runtime/Error.cpp:
+        (JSC::createError):
+        (JSC::createEvalError):
+        (JSC::createRangeError):
+        (JSC::createReferenceError):
+        (JSC::createSyntaxError):
+        (JSC::createTypeError):
+        (JSC::createURIError):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::globalData):
+
+2010-10-23  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, rolling out r70369.
+        http://trac.webkit.org/changeset/70369
+        https://bugs.webkit.org/show_bug.cgi?id=47974
+
+        Caused weird artifacts in expected results.
+
+        * wtf/Platform.h:
+
+2010-10-23  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        Crashes randomly in cairo_scaled_font_destroy
+        https://bugs.webkit.org/show_bug.cgi?id=46794
+
+        Make PlatformRefPtr aware of hashTableDeletedValue. When PlatformRefPtr
+        goes away this should probably be handled in the future via some special
+        hooks in RefCounted (or its contained type).
+
+        * wtf/PlatformRefPtr.h:
+        (WTF::PlatformRefPtr::~PlatformRefPtr):
+        (WTF::PlatformRefPtr::clear):
+        (WTF::::operator):
+
+2010-10-22  Adam Roben  <aroben@apple.com>
+
+        Remove the QuartzCorePresent.h mechanism
+
+        This header was used to detect whether QuartzCore headers were present
+        on the system. Everyone should have these headers now so we no longer
+        need to detect.
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Remove
+        code to generate QuartzCorePresent.h.
+
+        * wtf/Platform.h: Stop including QuartzCorePresent.h on Windows and
+        collapse all USE_ACCELERATED_COMPOSITING settings into one #ifdef.
+
+2010-10-22  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed, rolling out r70290.
+        http://trac.webkit.org/changeset/70290
+        https://bugs.webkit.org/show_bug.cgi?id=48111
+
+        Undelete Android build files.
+
+        * Android.mk: Added.
+
+2010-10-22  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        JSC interpreter regressions after r69940
+        https://bugs.webkit.org/show_bug.cgi?id=47839
+
+        Wrong "if": It should test whether the result exists,
+        and not the opposite. It is an interpreter bug, hence
+        the bots does not capture it.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveBase):
+
+2010-10-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        Remove Android build system
+        https://bugs.webkit.org/show_bug.cgi?id=48111
+
+        * Android.mk: Removed.
+
+2010-10-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Add a String constructor which takes AECHAR*
+        https://bugs.webkit.org/show_bug.cgi?id=45043
+
+        Add String(const AECHAR*) constructor for convenience.
+
+        * wtf/text/WTFString.h:
+
+2010-10-21  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Use GCharsetConverter instead of g_iconv in TextCodecGtk
+        https://bugs.webkit.org/show_bug.cgi?id=47896
+
+        * wtf/gobject/GTypedefs.h:
+
+2010-10-21  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed, rolling out r70174.
+        http://trac.webkit.org/changeset/70174
+        https://bugs.webkit.org/show_bug.cgi?id=41948
+
+        This patch reverts a change that causes
+        http/tests/xmlhttprequest/origin-whitelisting-removal.html to crash.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2010-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the EFL build.
+
+        * wtf/CMakeLists.txt:
+
+2010-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build: export needed symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47851
+        
+        Add methods to DecimalNumber to return the buffer length
+        required for decimal and exponential output.
+        
+        Make some of the DecimalNumber code non-inline (no
+        effect on Sunspider), adding DecimalNumber.cpp to various
+        build systems.
+        
+        Make some DecimalNumber methods 'const'.
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * wtf/DecimalNumber.cpp: Added.
+        (WTF::DecimalNumber::bufferLengthForStringDecimal):
+        (WTF::DecimalNumber::bufferLengthForStringExponential):
+        (WTF::DecimalNumber::toStringDecimal):
+        (WTF::DecimalNumber::toStringExponential):
+        * wtf/DecimalNumber.h:
+        (WTF::DecimalNumber::sign):
+        (WTF::DecimalNumber::exponent):
+        (WTF::DecimalNumber::significand):
+        (WTF::DecimalNumber::precision):
+        * wtf/dtoa.cpp:
+        (WTF::dtoa):
+        * wtf/dtoa.h:
+        * wtf/wtf.pri:
+
+2010-10-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70165.
+        http://trac.webkit.org/changeset/70165
+        https://bugs.webkit.org/show_bug.cgi?id=48007
+
+        It broke tests on Qt bot (Requested by Ossy on #webkit).
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Removed.
+
+2010-10-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix the Windows build after r70165. Move the copying of JavaScript headers from JavaScriptCore's post-build
+        step to JavaScriptCoreGenerated, so the copying is done even when a cpp file in JavaScriptCore is changed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2010-10-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Unreviewed, fixing the Win build.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2010-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=41948
+        REGRESSION(r60392): Registerfile can be unwound too far following an exception
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Walk the stack to calculate the high
+        water mark currently in use. It's not safe to assume that the current
+        CallFrame's high water mark is the highest high water mark because
+        calls do not always set up at the end of a CallFrame. A large caller
+        CallFrame can encompass a small callee CallFrame.
+
+2010-10-20  Peter Rybin  <peter.rybin@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        HTML parser should provide script column position within HTML document to JavaScript engine
+        https://bugs.webkit.org/show_bug.cgi?id=45271
+
+        Adds TextPosition* classes -- a structure that stores line/column/generation
+        level coordinates inside text document. Adds *BasedNumber classes -- typesafe int
+        wrappers that emphasize whether int number is used as zero-based or
+        one-based.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Added.
+        (WTF::TextPosition::TextPosition):
+        (WTF::TextPosition::minimumPosition):
+        (WTF::TextPosition::belowRangePosition):
+        (WTF::ZeroBasedNumber::fromZeroBasedInt):
+        (WTF::ZeroBasedNumber::ZeroBasedNumber):
+        (WTF::ZeroBasedNumber::zeroBasedInt):
+        (WTF::ZeroBasedNumber::base):
+        (WTF::ZeroBasedNumber::belowBase):
+        (WTF::OneBasedNumber::fromOneBasedInt):
+        (WTF::OneBasedNumber::OneBasedNumber):
+        (WTF::OneBasedNumber::oneBasedInt):
+        (WTF::OneBasedNumber::convertAsZeroBasedInt):
+        (WTF::OneBasedNumber::convertToZeroBased):
+        (WTF::OneBasedNumber::base):
+        (WTF::OneBasedNumber::belowBase):
+        (WTF::toZeroBasedTextPosition):
+        (WTF::toOneBasedTextPosition):
+        (WTF::ZeroBasedNumber::convertToOneBased):
+
+2010-10-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by David Kilzer.
+
+        [BREWMP] Turn off JIT for simulator build
+        https://bugs.webkit.org/show_bug.cgi?id=47937
+
+        We don't need to test x86 JIT.
+
+        * wtf/Platform.h:
+
+2010-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove support for JSVALUE32 from JSC
+        https://bugs.webkit.org/show_bug.cgi?id=47948
+
+        Remove all the code for supporting JSVALUE32 from JSC.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_urshift):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_jless):
+        (JSC::JIT::emit_op_jlesseq):
+        (JSC::JIT::emitSlow_op_jlesseq):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_next_pname):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        * jit/JITStubs.h:
+        * jit/JSInterfaceJIT.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::tagReturnAsInt32):
+        * jit/ThunkGenerators.cpp:
+        (JSC::sqrtThunkGenerator):
+        (JSC::powThunkGenerator):
+        * runtime/Collector.cpp:
+        (JSC::isPossibleCell):
+        (JSC::typeName):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeForLookup):
+        * runtime/JSImmediate.h:
+        (JSC::reinterpretIntptrToDouble):
+        (JSC::JSImmediate::isIntegerNumber):
+        (JSC::JSImmediate::isDouble):
+        (JSC::JSImmediate::areBothImmediateIntegerNumbers):
+        (JSC::JSImmediate::makeDouble):
+        (JSC::JSImmediate::doubleValue):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::fromNumberOutsideIntegerRange):
+        (JSC::JSImmediate::from):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject):
+        * runtime/JSValue.h:
+        * runtime/NumberObject.h:
+        * wtf/Platform.h:
+
+2010-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        BytecodeGenerator::m_lastOpcodePosition must be initialized in all constructors
+        https://bugs.webkit.org/show_bug.cgi?id=47920
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Add missing member initialization.
+
+2010-10-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by David Kilzer.
+
+        RVCT fails to compile DateMath.cpp due to overloaded function pow
+        https://bugs.webkit.org/show_bug.cgi?id=47844
+
+        Choose std::pow(double, double) among multiple overloaded pow functions
+        to fix build for RVCT.
+
+        * wtf/DateMath.cpp:
+        (WTF::parseES5DateFromNullTerminatedCharacters):
+
+2010-10-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Use UChar instead of wchar_t in UnicodeWinCE
+        https://bugs.webkit.org/show_bug.cgi?id=47904
+
+        Make UnicodeWinCE more portable, so we can use it for other ports too.
+
+        * wtf/unicode/wince/UnicodeWinCE.cpp:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isLetter):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isAlphanumeric):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::digitValue):
+        * wtf/unicode/wince/UnicodeWinCE.h:
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isHighSurrogate):
+        (WTF::Unicode::isLowSurrogate):
+        (WTF::Unicode::umemcasecmp):
+        (WTF::Unicode::surrogateToUcs4):
+
+2010-10-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix style of UnicodeWinCE
+        https://bugs.webkit.org/show_bug.cgi?id=47818
+
+        * wtf/unicode/wince/UnicodeWinCE.cpp:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        * wtf/unicode/wince/UnicodeWinCE.h:
+
+2010-10-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am: add missing file.
+
+2010-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Strict mode: Functions created with the function constructor don't implement strict mode semantics
+        https://bugs.webkit.org/show_bug.cgi?id=47860
+
+        When creating the FunctionExecutable for a new function the function constructor
+        was always passing false for whether or not a function was strict, rather than
+        using the information from the freshly parsed function itself.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::fromGlobalCode):
+
+2010-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Strict mode: |this| should be undefined if it is not explicitly provided
+        https://bugs.webkit.org/show_bug.cgi?id=47833
+
+        To make strict mode behave correctly we want to pass undefined instead of null
+        as the default this value.  This has no impact on behaviour outside of strict
+        mode as both values are replaced with the global object if necessary.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+
+2010-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Make a nullptr that works with OwnPtr and RefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=47756
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added NullPtr.h.
+
+        * wtf/NullPtr.h: Added.
+
+        * wtf/OwnArrayPtr.h: Add an overload of = taking nullptr.
+        * wtf/OwnPtr.h: Ditto.
+        * wtf/PassOwnArrayPtr.h: Ditto.
+        * wtf/PassOwnPtr.h: Ditto.
+        * wtf/PassRefPtr.h: Ditto.
+        * wtf/RefPtr.h: Ditto.
+        * wtf/RetainPtr.h: Ditto.
+
+2010-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Strict mode: JIT doesn't check for |this| being an immediate before dereferencing
+        https://bugs.webkit.org/show_bug.cgi?id=47826
+
+        There's no guarantee that |this| will be a cell in a strict mode function, so
+        don't claim that it is.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isKnownNotImmediate):
+
+2010-10-18  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        if (0) throw "x" ; else { } throws parse error after r69906
+        https://bugs.webkit.org/show_bug.cgi?id=47807
+
+        r69906 introduced a bug: the semicolon is not parsed after a throw
+        expression anymore. Thus, the semicolon terminates the "if" parsing
+        in the example above, and the else token results a parse error.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseThrowStatement):
+
+2010-10-18  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Andreas Kling.
+
+        Remove some unnecessary lines of code from Parser.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=47816
+
+        * parser/Parser.cpp:
+
+2010-10-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Build broken with JIT disabled
+        https://bugs.webkit.org/show_bug.cgi?id=47801
+
+        This is a regression caused by r69940.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveBase):
+
+2010-10-18  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Change FastAllocBase implementation into a macro
+        https://bugs.webkit.org/show_bug.cgi?id=42998
+
+        It was investigated in bug #33896 that inheriting classes from FastAllocBase 
+        can result in objects getting larger which leads to memory regressions. 
+        Using a macro instead of inheriting classes from FastAllocBase would solve the issue. 
+
+        * wtf/FastAllocBase.h: Add a WTF_MAKE_FAST_ALLOCATED macro
+
+2010-10-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Strict mode: arguments is not valid as the base expression for pre- or post-fix expressions
+        https://bugs.webkit.org/show_bug.cgi?id=47791
+
+        Simple fix, check for arguments in addition to eval.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseUnaryExpression):
+
+2010-10-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Strict mode: Assignment that would create a global should be a late ReferenceError, not a syntax failure
+        https://bugs.webkit.org/show_bug.cgi?id=47788
+
+        Fixing this required a couple of changes:
+         * resolve_base now has a flag to indicate whether it is being used for a put in strict mode.
+           this allows us to throw an exception when we're doing a completely generic resolve for
+           assignment, and that assignment would create a new global.
+         * There is a new opcode 'op_ensure_property_exists' that is used to determine whether
+           the property being assigned to already exists on the global object.  This currently
+           has no caching, but such caching could be added relatively trivially.  It is only used
+           in the case where we know that a property will be placed on the global object, and
+           we cannot verify that the property already exists.
+
+        In the jit we plant a call to cti_op_resolve_base_strict_put in the effected case rather
+        than making op_resolve_base have an additional runtime branch.
+
+        There's also a new helper function to create the exception for the invalid assignment.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveBaseForPut):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseProgram):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createErrorForInvalidGlobalAssignment):
+        * runtime/ExceptionHelpers.h:
+        * runtime/Operations.h:
+        (JSC::resolveBase):
+
+2010-10-17  Simon Fraser  <simon.fraser@apple.com>
+
+        First part of fix for Windows build failure. Will wait for the
+        next set of link errors to determine the mangled forms for dtoaRoundSF
+        and dtoaRoundDP.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-10-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Very large and small numbers fail to round-trip through CSS
+        https://bugs.webkit.org/show_bug.cgi?id=20674
+        
+        New exports required to use DecimalNumber in WebCore.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-10-16  Kyusun Kim  <maniagoon@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add using declarations for currentTimeMS() and parseDateFromNullTerminatedCharacters()
+        https://bugs.webkit.org/show_bug.cgi?id=47758
+
+        * wtf/CurrentTime.h:
+        * wtf/DateMath.h:
+
+2010-10-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename StringHasherFunctions.h to StringHasher.h
+        https://bugs.webkit.org/show_bug.cgi?id=47200
+
+        Now StringHasherFunctions.h only contains the StringHasher class, so rename it to the correct name.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/StringHashFunctions.h: Removed.
+        * wtf/StringHasher.h: Copied from JavaScriptCore/wtf/StringHashFunctions.h.
+        * wtf/text/StringHash.h:
+        * wtf/text/StringImpl.h:
+
+2010-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Automatic Semicolon Insertion incorrectly inserts semicolon after break, continue, and return followed by a newline
+        https://bugs.webkit.org/show_bug.cgi?id=47762
+
+        The old YACC parser depended on the lexer for some classes of semicolon insertion.
+        The new parser handles ASI entirely on its own so when the lexer inserts a semicolon
+        on its own the net result is a spurious semicolon in the input stream.  This can result
+        in incorrect parsing in some cases:
+
+        if (0)
+            break
+        ;else {}
+
+        Would result in a parse failure as the output from the lexer is essentially
+
+        if (0)
+             break
+        ;;else
+
+        So the second semicolon is interpreted as a empty statement, which terminates the if,
+        making the else an error.
+
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseThrowStatement):
+          Parsing of throw statement was wrong, and only worked due to the weird behaviour
+          in the lexer
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+          Remove bogus semicolon insertion from the newline handling
+
+2010-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Replace some String::format() usages by StringConcatenate in WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=47714
+
+        * wtf/text/StringConcatenate.h: Add UChar specific StringTypeAdapter, to accept single UChars in makeString().
+
+2010-10-15  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix for Debug Leopard which is failng to compile after r69842.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2010-10-15  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The parenthetical assertion checking isn't working in some cases with YARR
+        Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46893
+
+        Calculate the countToCheck value of a TypeParentheticalAssertion by
+        subtracting the number of characters which follows
+        a TypeParentheticalAssertion term with the number of characters which should
+        be matched by terms which are contained
+        in the TypeParentheticalAssertion term (minimumSize).
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2010-10-14  Nathan Vander Wilt  <nate@andyet.net>
+
+        Reviewed by Darin Adler.
+
+        Added parser for ECMAScript 5 standard date format, so Date.parse can handle RFC 3339 timestamps: https://bugs.webkit.org/show_bug.cgi?id=44632
+
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * wtf/DateMath.cpp:
+        (WTF::ymdhmsToSeconds):
+        (WTF::parseES5DateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+
+2010-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Replace lots of String::format() usages by StringConcatenate
+        https://bugs.webkit.org/show_bug.cgi?id=47664
+
+        Add StringTypeAdapter<char> to accept single characters for makeString().
+
+        * wtf/text/StringConcatenate.h:
+        (WTF::makeString):
+
+2010-10-14  David Goodwin  <david_goodwin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        need way to measure size of JITed ARM code
+        https://bugs.webkit.org/show_bug.cgi?id=47121
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::linkCode):
+        (JSC::LinkBuffer::dumpLinkStats):
+        (JSC::LinkBuffer::dumpCode):
+
+2010-10-14  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The backreference checking isn't working in some cases with YARR Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46904
+
+        The Interpreter::matchBackReference() function returns true without matching
+        when a backreference points to the same parentheses where it is.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchBackReference):
+
+2010-10-14  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Text breaking is slow: enable ICU as an opt-in
+        https://bugs.webkit.org/show_bug.cgi?id=40332
+
+        Added a config flag that enables ICU as an opt-in instead of the Qt specific code.
+        Because of the inclusion of ICU headers, some explicit casting was necessary in UnicodeQt4.h
+
+        * JavaScriptCore.pri:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::category):
+
+2010-10-14  Anton Faern  <anton@bladehawke.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47658
+        NetBSD was not included in the WTF_PLATFORM_FOO to WTF_OS_FOO
+        change.  This means that OS(NETBSD) is also undefined.
+
+        * wtf/Platform.h: s/_PLATFORM_/_OS_/ for NetBSD
+
+2010-10-13  David Goodwin  <david_goodwin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARMv7 JIT should generated conditional branches when possible
+        https://bugs.webkit.org/show_bug.cgi?id=47384
+
+        Use different jump padding sizes for conditional and unconditional
+        jumps (12 bytes and 10 bytes respectively). This allows the JIT to
+        include the IT instruction as part of the conditional jump sequence
+        which in turn allows it to optimize away the IT using an ARMv7 
+        conditional branch instruction. Use 2-byte B(T1) and 4-byte B(T3) for
+        conditional branches when displacement is in range. Also use IT/B(T4)
+        for conditional branch when displacement does not fit in B(T3).
+
+        For unconditional jump, instruction selection options are:
+        B(T2), B(T4), MOVW/MOVT/BX. For conditional jump, instruction selection
+        options are: B(T1), B(T3), IT/B(T4), ITTT/MOVW/MOVT/BX.
+
+        * assembler/ARMv7Assembler.cpp:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::JmpSrc::JmpSrc):
+        (JSC::ARMv7Assembler::ifThenElse):
+        (JSC::ARMv7Assembler::jumpSizeDelta):
+        (JSC::ARMv7Assembler::canCompact):
+        (JSC::ARMv7Assembler::computeJumpType):
+        (JSC::ARMv7Assembler::link):
+        (JSC::ARMv7Assembler::canBeJumpT1):
+        (JSC::ARMv7Assembler::canBeJumpT3):
+        (JSC::ARMv7Assembler::canBeJumpT4):
+        (JSC::ARMv7Assembler::linkJumpT1):
+        (JSC::ARMv7Assembler::linkJumpT3):
+        (JSC::ARMv7Assembler::linkJumpT4):
+        (JSC::ARMv7Assembler::linkConditionalJumpT4):
+        (JSC::ARMv7Assembler::linkBX):
+        (JSC::ARMv7Assembler::linkConditionalBX):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::linkCode):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::canCompact):
+        (JSC::MacroAssemblerARMv7::computeJumpType):
+        (JSC::MacroAssemblerARMv7::jumpSizeDelta):
+        (JSC::MacroAssemblerARMv7::jump):
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::ret):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+        (JSC::MacroAssemblerARMv7::makeJump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+
+2010-10-13  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Darin Adler.
+
+        Don't depend on Windows on sched_yield and sched.h
+        https://bugs.webkit.org/show_bug.cgi?id=45543
+
+        sched.h is part of pthreads and sched_yield is implemented
+        in pthreads-win32 as Sleep(0). This patch avoids a gratuitous
+        dependency on pthreads-win32 in this file.
+
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SlowLock):
+
+2010-10-13  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Port unicode
+        https://bugs.webkit.org/show_bug.cgi?id=45716
+
+        Brew MP port uses only the subset of ICU library to reduce the binary size.
+        Follow the WinCE's implementation.
+
+        * wtf/Platform.h:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/brew/UnicodeBrew.cpp: Added.
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isAlphanumeric):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::category):
+        (WTF::Unicode::decompositionType):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::digitValue):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isLetter):
+        * wtf/unicode/brew/UnicodeBrew.h: Added.
+        (WTF::Unicode::isArabicChar):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext):
+        (WTF::Unicode::hasLineBreakingPropertyComplexContextOrIdeographic):
+        (WTF::Unicode::umemcasecmp):
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        [WTFURL] Add URLQueryCanonicalizer
+        https://bugs.webkit.org/show_bug.cgi?id=45088
+
+        This class canonicalizes the query component of URLs.  The main tricky
+        bit there is the convertCharset function, which I've moved to a
+        templated dependency.  There'll likely be more about that in future
+        patches.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/url/src/URLEscape.cpp: Added.
+        * wtf/url/src/URLEscape.h: Added.
+        (WTF::appendEscapedCharacter):
+        * wtf/url/src/URLQueryCanonicalizer.h: Added.
+        (WTF::URLQueryCanonicalizer::canonicalize):
+        (WTF::URLQueryCanonicalizer::isAllASCII):
+        (WTF::URLQueryCanonicalizer::appendRaw8BitQueryString):
+        (WTF::URLQueryCanonicalizer::convertToQueryEncoding):
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43987 - Downloading using XHR is much slower than before
+        Change StringBuilder to use overcapacity in a StringImpl, rather than a Vector.
+        Fundamentally this should be the same (copies current contents to expand capacity,
+        rather than using a rope), but this approach allows the intermadiate state of the
+        String to be inspected in the buffer without copying to resolve.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendQuotedString):
+        (JSC::Stringifier::Holder::appendNextProperty):
+            Renamed StringBuilder::size() -> length() (to match other String types).
+
+        * runtime/UStringBuilder.h:
+        (JSC::UStringBuilder::append):
+        (JSC::UStringBuilder::toUString):
+            Update for changes in parent class, can just 'using' the append methods.
+
+        * wtf/text/StringBuilder.cpp: Added.
+        (WTF::StringBuilder::reifyString):
+        (WTF::StringBuilder::resize):
+        (WTF::StringBuilder::reserveCapacity):
+        (WTF::StringBuilder::allocateBuffer):
+        (WTF::StringBuilder::appendUninitialized):
+        (WTF::StringBuilder::append):
+        (WTF::StringBuilder::shrinkToFit):
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::StringBuilder):
+        (WTF::StringBuilder::append):
+        (WTF::StringBuilder::toString):
+        (WTF::StringBuilder::toStringPreserveCapacity):
+        (WTF::StringBuilder::length):
+        (WTF::StringBuilder::isEmpty):
+        (WTF::StringBuilder::operator[]):
+        (WTF::StringBuilder::clear):
+            Class updated to use overcapacity in a StringImpl, rather than a Vector.
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/wtf.pri:
+
+2010-10-13  Adam Roben  <aroben@apple.com>
+
+        Export tryFastRealloc for WebKit2's benefit
+
+        Rubber-stamped by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added
+        tryFastRealloc. Removed RegExpObject::info, which is now exported via
+        JS_EXPORTDATA.
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        [WTFURL] Add a mechanism for classifying types of characters
+        https://bugs.webkit.org/show_bug.cgi?id=45085
+
+        Various characters have different escaping rules depending on where
+        they are in URLs.  This patch adds a table containing that information.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/url/src/URLCharacterTypes.cpp: Added.
+        * wtf/url/src/URLCharacterTypes.h: Added.
+        (WTF::URLCharacterTypes::isQueryChar):
+        (WTF::URLCharacterTypes::isIPv4Char):
+        (WTF::URLCharacterTypes::isHexChar):
+        (WTF::URLCharacterTypes::isCharOfType):
+
+2010-10-13  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Missing parameters for bytecode dump of next_pname
+        https://bugs.webkit.org/show_bug.cgi?id=47590
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): add missing parameters to the dump.
+
+2010-10-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Add wtf/text/StringConcatenate
+        https://bugs.webkit.org/show_bug.cgi?id=47584
+
+        Move runtime/StringConcatenate.h to wtf/text, make it work for Strings too.
+        Add a special runtime/UStringConcatenate.h class that inherits from StringConcatenate, and extends it for use with UString.
+        Exactly the same design that has been followed while refactoring StringBuilder.
+
+        The UString variants can all be removed as soon as WTF::String & JSC::UString converge.
+
+        * GNUmakefile.am: Add wtf/text/StringConcatenate.h and runtime/UStringConcatenate.h.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * bytecode/CodeBlock.cpp: s/makeString/makeUString/
+        (JSC::escapeQuotes):
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpToSourceString):
+        (JSC::regexpName):
+        * bytecompiler/NodesCodegen.cpp: Ditto.
+        (JSC::substitute):
+        * profiler/Profiler.cpp: Ditto.
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/ExceptionHelpers.cpp: Ditto.
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        * runtime/FunctionConstructor.cpp: Ditto.
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp: Ditto.
+        (JSC::insertSemicolonIfNeeded):
+        * runtime/JSONObject.cpp: Ditto.
+        (JSC::Stringifier::indent):
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        * runtime/RegExpConstructor.cpp: Ditto.
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp: Ditto.
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp: Ditto.
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringConcatenate.h: Removed.
+        * runtime/UStringConcatenate.h: Added. Only contains the StringTypeAdapter<JSC::UString> code and the makeUString variants, the rest lives in wtf/text/StringConcatenate.h
+        (JSC::makeUString):
+        * wtf/text/StringConcatenate.h: Copied from runtime/StringConcatenate.h.
+        (WTF::makeString):
+
+2010-10-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::length):
+
+2010-10-12  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Unify JSC::StringBuilder & WebCore::StringBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=47538
+
+        Move runtime/StringBuilder.h to wtf/text/StringBuilder.h. Rename build() to toString() and return a WTF::String().
+        Move the append(const JSC::UString&) method into runtime/UStringBuilder.h.
+        UStringBuilder inherits from StringBuilder.h and adds append(const JSC::UString&) and UString toUString() functionality.
+
+        No new code, just move code around.
+
+        * GNUmakefile.am: Add wtf/text/StringBuilder.h / runtime/UStringBuilder.h. Remove runtime/StringBuilder.h.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString): Use UStringBuilder, instead of StringBuilder. Rename build() -> toUString().
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction): Ditto.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncUnescape): Ditto.
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify): Ditto.
+        (JSC::Stringifier::appendQuotedString): Ditto.
+        (JSC::Stringifier::appendStringifiedValue): Ditto.
+        (JSC::Stringifier::startNewLine): Ditto.
+        (JSC::Stringifier::Holder::appendNextProperty): Ditto.
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString): Ditto.
+        * runtime/NumberPrototype.cpp: Remove unneeded JSStringBuilder.h / StringBuilder.h include.
+        * runtime/StringBuilder.h: Removed.
+        * runtime/UStringBuilder.h: Added. Inherits from WTF::StringBuilder, extending it by two methods.
+        (JSC::UStringBuilder::append): append(const JSC::UString&)
+        (JSC::UStringBuilder::toUString):
+        * wtf/text/StringBuilder.h: Copied from runtime/StringBuilder.h. Move JSC::UString parts into runtime/UStringBuilder.h
+        (WTF::StringBuilder::append): Renamed m_buffer to buffer everywhere.
+        (WTF::StringBuilder::isEmpty): Ditto (+ constify method). 
+        (WTF::StringBuilder::reserveCapacity): Ditto.
+        (WTF::StringBuilder::resize): Ditto.
+        (WTF::StringBuilder::size): Ditto.
+        (WTF::StringBuilder::operator[]): Ditto.
+        (WTF::StringBuilder::toString): Ditto (+ renamed from build()). Returns a String, not an UString. The old build() method is now named toUString() and lives in UStringBuilder.
+
+2010-10-12  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cleaned up the processing of replacements after regular expression
+        processing, especially the case where there wasn't a match.
+        Changed to use empty strings instead of computing a zero length sub
+        string.
+        https://bugs.webkit.org/show_bug.cgi?id=47506
+
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::stringProtoFuncReplace):
+
+2010-10-11  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Clang build fix after r69472.
+        https://bugs.webkit.org/show_bug.cgi?id=46523
+
+        * wtf/text/StringHash.h:
+
+2010-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Undo last minute change to 32bit build.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_convert_this_strict):
+
+2010-10-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Build fix for Windows. Add a necessary export from r69516.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Fix interpreter build -- was broken by incorrect merge.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-10-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=10701
+
+        Initial strict mode implementation.  This is the simplest
+        implementation that could possibly work and adds (hopefully)
+        all of the restrictions required by strict mode.  There are
+        a number of inefficiencies, especially in the handling of
+        arguments and eval as smart implementations would make this
+        patch more complicated.  
+
+        The SyntaxChecker AST builder has become somewhat more complex
+        as strict mode does require more parse tree information to
+        validate the syntax.
+
+        Summary of major changes to the parser:
+            * We track when we enter strict mode (this may come as a surprise)
+            * Strict mode actually requires a degree of AST knowledge to validate
+              so the SyntaxChecker now produces values that can be used to distinguish
+              "node" types.
+            * We now track variables that are written to.  We do this to
+              statically identify writes to global properties that don't exist
+              and abort at that point.  This should actually make it possible
+              to optimise some other cases in the future but for now it's
+              purely for validity checking.  Currently writes are only tracked
+              in strict mode code.
+            * Labels are now tracked as it is now a syntax error to jump to a label
+              that does not exist (or to use break, continue, or return in a context
+              where they would be invalid).
+
+        Runtime changes:
+            * In order to get correct hanlding of the Arguments object all
+              strict mode functions that reference arguments create and tearoff
+              the arguments object on entry.  This is not strictly necessary
+              but was the least work necessary to get the correct behaviour.
+            * PutPropertySlot now tracks whether it is being used for a strict
+              mode write, and if so Object::put will throw when a write can't be
+              completed.
+            * StrictEvalActivation was added as an "activation" object for strict
+              mode eval (so that strict eval does not introduce new variables into
+              the containing scope).
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isStrictMode):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        (JSC::BytecodeGenerator::emitReturn):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isStrictMode):
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_convert_this_strict):
+        (JSC::JIT::emitSlow_op_convert_this_strict):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_pnames):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::isResolve):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::next):
+        (JSC::JSParser::startLoop):
+        (JSC::JSParser::endLoop):
+        (JSC::JSParser::startSwitch):
+        (JSC::JSParser::endSwitch):
+        (JSC::JSParser::setStrictMode):
+        (JSC::JSParser::strictMode):
+        (JSC::JSParser::isValidStrictMode):
+        (JSC::JSParser::declareParameter):
+        (JSC::JSParser::breakIsValid):
+        (JSC::JSParser::pushLabel):
+        (JSC::JSParser::popLabel):
+        (JSC::JSParser::hasLabel):
+        (JSC::JSParser::DepthManager::DepthManager):
+        (JSC::JSParser::DepthManager::~DepthManager):
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::startSwitch):
+        (JSC::JSParser::Scope::endSwitch):
+        (JSC::JSParser::Scope::startLoop):
+        (JSC::JSParser::Scope::endLoop):
+        (JSC::JSParser::Scope::inLoop):
+        (JSC::JSParser::Scope::breakIsValid):
+        (JSC::JSParser::Scope::pushLabel):
+        (JSC::JSParser::Scope::popLabel):
+        (JSC::JSParser::Scope::hasLabel):
+        (JSC::JSParser::Scope::isFunction):
+        (JSC::JSParser::Scope::declareVariable):
+        (JSC::JSParser::Scope::declareWrite):
+        (JSC::JSParser::Scope::deleteProperty):
+        (JSC::JSParser::Scope::declareParameter):
+        (JSC::JSParser::Scope::setNeedsFullActivation):
+        (JSC::JSParser::Scope::collectFreeVariables):
+        (JSC::JSParser::Scope::getUncapturedWrittenVariables):
+        (JSC::JSParser::Scope::getDeletedVariables):
+        (JSC::JSParser::Scope::setStrictMode):
+        (JSC::JSParser::Scope::strictMode):
+        (JSC::JSParser::Scope::isValidStrictMode):
+        (JSC::JSParser::pushScope):
+        (JSC::JSParser::popScope):
+        (JSC::JSParser::declareVariable):
+        (JSC::JSParser::declareWrite):
+        (JSC::JSParser::deleteProperty):
+        (JSC::jsParse):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseSourceElements):
+        (JSC::JSParser::parseDoWhileStatement):
+        (JSC::JSParser::parseWhileStatement):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseConstDeclarationList):
+        (JSC::JSParser::parseForStatement):
+        (JSC::JSParser::parseBreakStatement):
+        (JSC::JSParser::parseContinueStatement):
+        (JSC::JSParser::parseReturnStatement):
+        (JSC::JSParser::parseWithStatement):
+        (JSC::JSParser::parseSwitchStatement):
+        (JSC::JSParser::parseSwitchClauses):
+        (JSC::JSParser::parseSwitchDefaultClause):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseBlockStatement):
+        (JSC::JSParser::parseStatement):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionBody):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseFunctionDeclaration):
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+        (JSC::JSParser::parseIfStatement):
+        (JSC::JSParser::parseExpression):
+        (JSC::JSParser::parseAssignmentExpression):
+        (JSC::JSParser::parseConditionalExpression):
+        (JSC::JSParser::parseBinaryExpression):
+        (JSC::JSParser::parseStrictObjectLiteral):
+        (JSC::JSParser::parsePrimaryExpression):
+        (JSC::JSParser::parseMemberExpression):
+        (JSC::JSParser::parseUnaryExpression):
+        * parser/JSParser.h:
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseString):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::isReparsing):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::isStrictMode):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::SyntaxChecker):
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::appendToComma):
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeTypeOfNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::makeNegateNode):
+        (JSC::SyntaxChecker::makeBitwiseNotNode):
+        (JSC::SyntaxChecker::createLogicalNot):
+        (JSC::SyntaxChecker::createUnaryPlus):
+        (JSC::SyntaxChecker::createVoid):
+        (JSC::SyntaxChecker::thisExpr):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        (JSC::SyntaxChecker::createArray):
+        (JSC::SyntaxChecker::createNumberExpr):
+        (JSC::SyntaxChecker::createString):
+        (JSC::SyntaxChecker::createBoolean):
+        (JSC::SyntaxChecker::createNull):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegex):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::createStrictModeCallerIfNecessary):
+        (JSC::Arguments::createStrictModeCalleeIfNecessary):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
+        (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::getConstructData):
+        (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::getCallData):
+        (JSC::createTypeErrorFunction):
+        * runtime/Error.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        (JSC::ProgramExecutable::reparseExceptionInfo):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::isStrictMode):
+        (JSC::EvalExecutable::create):
+        (JSC::FunctionExecutable::create):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::toStrictThisObject):
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.cpp:
+        (JSC::createDescriptorForThrowingProperty):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        (JSC::JSFunction::put):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::internalFunctionStructure):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::toStrictThisObject):
+        (JSC::throwTypeError):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isStrictModeFunction):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSValue::putDirect):
+        (JSC::JSValue::toStrictThisObject):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::toStrictThisObject):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSValue.h:
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::toStrictThisObject):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::isStrictMode):
+        * runtime/StrictEvalActivation.cpp: Added.
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+        (JSC::StrictEvalActivation::deleteProperty):
+        (JSC::StrictEvalActivation::toThisObject):
+        (JSC::StrictEvalActivation::toStrictThisObject):
+        * runtime/StrictEvalActivation.h: Added.
+
+2010-10-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Windows build fix after r69472.
+
+        * wtf/text/StringHash.h:
+        (WTF::CaseFoldingHash::hash):
+
+2010-10-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Use WTF::StringHasher in WTF::CaseFoldingHash
+        https://bugs.webkit.org/show_bug.cgi?id=46523
+
+        * wtf/text/StringHash.h:
+        (WTF::CaseFoldingHash::foldCase):
+        (WTF::CaseFoldingHash::hash):
+
+2010-10-09  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47445
+        Remove unused function WTFThreadData::initializeIdentifierTable()
+
+        * wtf/WTFThreadData.h:
+
+2010-10-08  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Added check to start of subexpression being positive before using
+        subexpression in replacement.
+        https://bugs.webkit.org/show_bug.cgi?id=47324
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+
+2010-10-08  Chris Evans  <cevans@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47393
+
+        Use unsigned consistently to check for max StringImpl length.
+        Add a few integer overflow checks.
+        Uses the existing paradigm of CRASH() when we can't reasonably handle a crazily large request.
+
+        * wtf/text/WTFString.cpp:
+        * wtf/text/StringImpl.h:
+        * wtf/text/StringImpl.cpp:
+        Better use of size_t vs. unsigned; check for integer overflows.
+
+2010-10-07  David Goodwin  <david_goodwin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARM JIT generates undefined operations due to partially uninitialized ShiftTypeAndAmount
+        https://bugs.webkit.org/show_bug.cgi?id=47356
+
+        * assembler/ARMv7Assembler.h:
+
+2010-10-06  Chris Evans  <cevans@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47248
+
+        Use size_t consistently in CString, to prevent theoretical trouble
+        with > 4GB strings on 64-bit platforms.
+
+        * wtf/text/CString.h:
+        * wtf/text/CString.cpp:
+        Use size_t for string lengths.
+        * wtf/MD5.cpp:
+        (WTF::expectMD5): use suitable format string + cast for size_t.
+        * JavaScriptCore.exp:
+        Update symbol name.
+
+2010-10-06  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Start cleaning up Arguments.h
+        https://bugs.webkit.org/show_bug.cgi?id=47304
+
+        * wtf/TypeTraits.h:
+        * wtf/TypeTraits.cpp:
+        Add RemoveReference type trait.
+
+2010-10-06  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        Unreviewed build fix.
+
+        [EFL] Build fix for glib support.
+        https://bugs.webkit.org/show_bug.cgi?id=47221
+
+        If compiling with GLib support enabled, we also need to link wtf against
+        glib library.
+
+        * wtf/CMakeListsEfl.txt:
+
+2010-10-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Gavin Barraclough.
+
+        [BREWMP] Port ExecutableAllocator::cacheFlush to enable ARM JIT
+        https://bugs.webkit.org/show_bug.cgi?id=47117
+
+        Use IMemCache1 to flush data cache and invalidate instruction cache.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2010-10-05  Leandro Pereira  <leandro@profusion.mobi>
+
+        Unreviewed. Build fix.
+
+        Moved "jsc" directory to "shell", so that the name does not clash with the
+        JavaScriptCore shell in some build systems.
+        http://webkit.org/b/47049
+
+        * CMakeLists.txt: Changed reference from "jsc" to "shell".
+        * jsc: Removed.
+        * jsc/CMakeLists.txt: Removed.
+        * jsc/CMakeListsEfl.txt: Removed.
+        * shell: Copied from JavaScriptCore/jsc.
+
+2010-10-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Use PlatformRefPtr in randomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=46989
+
+        Use PlatformRefPtr to free memory automatically.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2010-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r68338): JavaScript error on PowerPC only (crashes on Interpreter built for x86_64)
+        https://bugs.webkit.org/show_bug.cgi?id=46690
+
+        Use the correct register value when initialising the arguments
+        object in the interpreter.  This is covered by existing tests.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-10-04  David Goodwin  <david_goodwin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARMv7 JIT should take advantage of 2-byte branches to reduce code size
+        https://bugs.webkit.org/show_bug.cgi?id=47007
+
+        * assembler/ARMv7Assembler.cpp:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::computeJumpType):
+        (JSC::ARMv7Assembler::link):
+        (JSC::ARMv7Assembler::canBeJumpT2):
+        (JSC::ARMv7Assembler::canBeJumpT4):
+        (JSC::ARMv7Assembler::linkBX):
+        (JSC::ARMv7Assembler::linkJumpT4):
+        (JSC::ARMv7Assembler::linkJumpT2):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+
+2010-10-04  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Use fast malloc for WebKit EFL
+        https://bugs.webkit.org/show_bug.cgi?id=46691
+
+        Use fast malloc for WebKit EFL because the fast malloc is to allocate
+        memory quickly.
+
+        * wtf/CMakeListsEfl.txt:
+
+2010-10-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Lazily create activation objects
+        https://bugs.webkit.org/show_bug.cgi?id=47107
+
+        Make it possible to lazily create the activation object
+        for a function that needs one.  This allows us to reduce
+        the overhead of entering a function that may require
+        an activation in some cases, but not always.
+
+        This does make exception handling a little more complex as
+        it's now necessary to verify that a callframes activation
+        has been created, and create it if not, in all of the
+        paths used in exception handling.
+
+        We also need to add logic to check for the existence of
+        the activation in the scoped_var opcodes, as well as
+        op_ret, op_ret_object_or_this and op_tearoff_activation
+        so that we can avoid creating an activation unnecesarily
+        on function exit. 
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::createActivation):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setActivationRegister):
+        (JSC::CodeBlock::activationRegister):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::createActivationIfNecessary):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_resolve_global_dynamic):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_create_activation):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-10-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Remove ENABLE_SANDBOX
+        https://bugs.webkit.org/show_bug.cgi?id=47032
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-10-01  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Geoffrey Garen.
+        Specify ALWAYS_INLINE at function declaration not function definition
+        https://bugs.webkit.org/show_bug.cgi?id=46960
+
+        For functions defined with ALWAYS_INLINE, add the attribute to the declaration as well.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * wtf/FastMalloc.cpp:
+
+2010-10-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Unreviewed.
+
+        [BREWMP] Change Collector BLOCK_SIZE to 64KB
+        https://bugs.webkit.org/show_bug.cgi?id=46436
+
+        Lower BLOCK_SIZE to 64KB because Brew MP runs on low end devices.
+
+        * runtime/Collector.h:
+
+2010-10-01  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Stack overflow on symbian platform.
+        https://bugs.webkit.org/show_bug.cgi?id=40598
+        
+        Move big allocation in arrayProtoFuncToString from stack to heap.
+        JSC::arrayProtoFuncToString function can be called recursivly and
+        1K allocation on stack cahse stack overflow.
+        Can be useful for other platforms with limited stack size.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+
+2010-09-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Add a factory function which returns an instance wrapped in PlatformRefPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=46373
+
+        A Brew MP instance has reference count 1 when it is created, so call adoptPlatformRef
+        to wrap the instance in PlatformRefPtr.
+
+        * wtf/brew/ShellBrew.h:
+        (WTF::createRefPtrInstance):
+
+2010-09-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Port PlatformRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=46370
+
+        Implement refPlatformPtr and derefPlatformPtr to use PlatformRefPtr in Brew MP.
+
+        * wtf/brew/RefPtrBrew.h: Added.
+        (WTF::refPlatformPtr):
+        (WTF::derefPlatformPtr):
+
+2010-09-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add additional checks to StringBuffer.
+        <rdar://problem/7756381>
+
+        * wtf/text/StringBuffer.h:
+        (WTF::StringBuffer::StringBuffer):
+        (WTF::StringBuffer::resize):
+
+2010-09-30  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make 2D accelerated canvas rendering build on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=46007
+        
+        Added ACCELERATED_2D_CANVAS to FeatureDefines
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-09-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] wxMSW build fix. Make sure we copy the compiler flags and remove exception handling from
+        the copy so as not to alter global settings.
+
+        * wscript:
+
+2010-09-30  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The case-insensitivity backreference checking isn't working with YARR
+        Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46882
+
+        Add ignorecase checking to the Interpreter::tryConsumeBackReference() function.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+
+2010-09-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Andreas Kling.
+
+        [BREWMP] Leave initializeRandomNumberGenerator empty.
+        https://bugs.webkit.org/show_bug.cgi?id=46851
+
+        On Brew MP, AEECLSID_RANDOM initializes itself.
+
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+
+2010-09-30  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Remove unnecessary cacheFlush calls from Thumb-2
+        https://bugs.webkit.org/show_bug.cgi?id=46702
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::relinkCall):
+        (JSC::ARMv7Assembler::repatchInt32):
+        (JSC::ARMv7Assembler::repatchPointer):
+
+2010-09-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Next try to fix cygwin build.
+
+        * wtf/Assertions.cpp:
+
+2010-09-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Build fix for cygwin #2. It's OS(WINDOWS), not OS(WIN).
+
+        * wtf/Assertions.cpp:
+
+2010-09-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Build fix for cygwin.
+
+        * wtf/Assertions.cpp:
+
+2010-09-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [WINCE] Buildfix for Assertions.cpp after r68511.
+        https://bugs.webkit.org/show_bug.cgi?id=46807
+
+        Some, but not all WinCE environments have support for IsDebuggerPresent().
+        Add HAVE(ISDEBUGGERPRESENT) to make this a build option.
+        HAVE(ISDEBUGGERPRESENT) will be 1 for all OS(WIN) by default.
+
+        * wtf/Assertions.cpp:
+        * wtf/Platform.h:
+
+2010-09-29  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Csaba Osztrogonác.
+
+        JSC compile fails on 32bit platform when Regexp Tracing is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=46713
+
+        Fix the cast of pointer in regexp tracing to avoid the warning.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+
+2010-09-28  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Begin hooking up painting in the plug-in process
+        https://bugs.webkit.org/show_bug.cgi?id=46766
+
+        * JavaScriptCore.exp:
+        Add tryFastRealloc, used by WebKit2.
+
+2010-09-28  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Guard GRefPtr/GOwnPtr files with ENABLE(GLIB_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=46721
+
+        Enable GOwnPtr/GRefPtr build only if glib support has been
+        explicitly enabled using the WTF_ENABLE_GLIB_SUPPORT macro.
+
+        * wtf/gobject/GOwnPtr.cpp:
+        * wtf/gobject/GOwnPtr.h:
+        * wtf/gobject/GRefPtr.cpp:
+        * wtf/gobject/GRefPtr.h:
+
+2010-09-28  İsmail Dönmez  <ismail@namtrac.org>
+
+        Reviewed by Andreas Kling.
+
+        Test for WINCE instead of WINCEBASIC, compiler always defines WINCE.
+        Remove reference to unexisting path JavaScriptCore/os-wince.
+
+        * JavaScriptCore.pri:
+        * wtf/Assertions.cpp:
+
+2010-09-27  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Changed the initialization of JSArray objects to have space for 
+        3 elements for the constructor that takes a ArgList argument.
+        This improves v8-deltablue performance by about 2.8% by reducing 
+        the number of realloc() calls.
+        https://bugs.webkit.org/show_bug.cgi?id=46664
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+
+2010-09-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 46680 - Inlining string concatenation can regress interpreter performance
+        <rdar://problem/8362752> REGRESSION: ~6.4% sunspider regression in interpreter
+        Do not inline calls to string concatenation in the interpret loop.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::concatenateStrings):
+        (JSC::Interpreter::privateExecute):
+
+2010-09-27  Anders Carlsson  <andersca@apple.com>
+
+        Fix thinko.
+
+        * runtime/JSCell.h:
+
+2010-09-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Try to fix Windows build.
+
+        * runtime/JSCell.h:
+        (JSC::MSVCBugWorkaround::MSVCBugWorkaround):
+        (JSC::MSVCBugWorkaround::~MSVCBugWorkaround):
+
+2010-09-27  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add operator == for AtomicString and Vector<Uchar>
+        https://bugs.webkit.org/show_bug.cgi?id=46509
+
+        * JavaScriptCore.exp:
+        * wtf/text/AtomicString.cpp:
+        (WTF::operator==):
+        * wtf/text/AtomicString.h:
+        (WTF::operator==):
+        (WTF::operator!=):
+
+2010-09-27  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * wtf/Noncopyable.h:
+
+2010-09-26  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Alexey Proskuryakov and Adam Barth.
+
+        Add WTF_MAKE_NONCOPYABLE macro
+        https://bugs.webkit.org/show_bug.cgi?id=46589
+
+        Going forward, we'd like to get rid of the Noncopyable and FastAllocBase classes. The
+        reason for this is that the Itanium C++ ABI states that no empty classes of the same type
+        can be laid out at the same offset in the class. This can result in objects getting larger
+        which leads to memory regressions. (One example of this is the String class which grew by
+        sizeof(void*) when both its base class and its first member variable inherited indirectly
+        from FastAllocBase).
+
+        * wtf/Noncopyable.h:
+        Add a WTF_MAKE_NONCOPYABLE macro and get rid of NoncopyableCustomAllocated.
+        
+        * runtime/JSCell.h:
+        * wtf/RefCounted.h:
+        Don't inherit from NoncopyableCustomAllocated. Instead, use WTF_MAKE_NONCOPYABLE.
+
+2010-09-27  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] use ENABLE(GLIB_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=46630
+
+        * wtf/Platform.h: Include GTypedefs.h only if glib support
+        is explicitly enabled.
+
+2010-09-25  Holger Hans Peter Freyther  <holger@moiji-mobile.com>
+
+        Reviewed by Adam Barth.
+
+        jsc: Document the strcat opcode.
+        https://bugs.webkit.org/show_bug.cgi?id=46571
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-09-21  Holger Hans Peter Freyther  <holger@moiji-mobile.com>
+
+        Reviewed by Adam Barth.
+
+        make-bytecode-docs.pl: Add a comment to the generated HTML
+        https://bugs.webkit.org/show_bug.cgi?id=46570
+
+        Generate an HTML Comment that this file was generated from
+        Interpreter.cpp with the make-bytecode-docs.pl script.
+
+        * docs/make-bytecode-docs.pl:
+
+2010-09-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Remove WTF::stringHash functions
+        https://bugs.webkit.org/show_bug.cgi?id=46520
+
+        Since r68289 the stringHash functions are only wrappers around StringHasher::createHash.
+        So use StringHasher::createHash directly and remove stringHash.
+
+        * wtf/StringHashFunctions.h:
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::computeHash): Use WTF::StringHasher::createHash directly.
+
+2010-09-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add WTF::StringHasher::createBlobHash
+        https://bugs.webkit.org/show_bug.cgi?id=46514
+
+        Add this function for hashing FormElementKey and QualifiedNameComponents.
+
+        * wtf/StringHashFunctions.h:
+        (WTF::StringHasher::createBlobHash):
+
+2010-09-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION (r68289): Assertion failure in StringHasher::addCharacter() (ch != invalidCharacterValue)
+        running websocket/tests/bad-sub-protocol-non-ascii.html
+        https://bugs.webkit.org/show_bug.cgi?id=46553
+
+        Because we use StringHasher for binary data too, so the check for invalid unicode input is wrong.
+        Add an additional member variable to indicate if we have an pending character
+        instead of only using an invalid character for this purpose.
+
+        * wtf/StringHashFunctions.h:
+        (WTF::StringHasher::StringHasher):
+        (WTF::StringHasher::addCharacters):
+        (WTF::StringHasher::addCharacter):
+        (WTF::StringHasher::hash):
+
+2010-09-26  Mark Hahnenberg  <mhahnenb@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        valueOf called in wrong order in atan2 and date constructors.
+        https://bugs.webkit.org/show_bug.cgi?id=26978
+
+        Fixed the bug where the arguments to atan2 were being evaluated 
+        out of order.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncATan2):
+
+2010-09-26  Mark Hahnenberg  <mhahnenb@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        valueOf called in wrong order in atan2 and date constructors.
+        https://bugs.webkit.org/show_bug.cgi?id=26978
+
+        Fixed the issue where the parameters to the Date constructor
+        were being evaluated to numbers more than once.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateUTC):
+
+2010-09-25  Oliver Hunt  <oliver@apple.com>
+
+        Fix various builds
+
+        Relearning the lesson that last minute changes are bad.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetArgumentsLength):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+
+2010-09-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Avoid constructing arguments object when accessing length and index properties
+        https://bugs.webkit.org/show_bug.cgi?id=46572
+
+        Add opcodes to read argument length and properties, and then implement them.
+        Much like other lazy opcodes these opcodes take a fast path when the arguments
+        object has not been instantiated, and fall back on generic access mechanisms
+        if they are acting on an instantiated object.
+
+        3% win on v8-earleyboyer, no change elsewhere.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetArgumentsLength):
+        (JSC::BytecodeGenerator::emitGetArgumentByVal):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+
+2010-09-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Fix typo in StringHasher class
+        https://bugs.webkit.org/show_bug.cgi?id=45970
+
+        * wtf/StringHashFunctions.h:
+        (WTF::StringHasher::createHash):
+
+2010-09-24  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add WTF::StringHasher
+        https://bugs.webkit.org/show_bug.cgi?id=45970
+
+        StringHasher is a class for calculation stringHash out of character string.
+        This class will unify the different usages of the same algorithm.
+
+        * wtf/StringHashFunctions.h:
+        (WTF::StringHasher::StringHasher):
+        (WTF::StringHasher::addCharacters):
+        (WTF::StringHasher::addCharacter):
+        (WTF::StringHasher::hash):
+        (WTF::StringHasher::createHash):
+        (WTF::StringHasher::defaultCoverter):
+        (WTF::StringHasher::addCharactersToHash):
+        (WTF::stringHash):
+
+2010-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Variable declarations inside a catch scope don't get propogated to the parent scope
+        https://bugs.webkit.org/show_bug.cgi?id=46501
+
+        Add logic to make variable declaration look for a scope for the
+        new variable.  This allows us to create a scope (eg. for catch)
+        and then seal it, so that additional variable declarations
+        contained are propogated to the correct target.  Strangely this
+        comes out as a performance win, but I think it's mostly cache
+        effects.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::preventNewDecls):
+        (JSC::JSParser::Scope::allowsNewDecls):
+        (JSC::JSParser::declareVariable):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseConstDeclarationList):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionDeclaration):
+
+2010-09-24  İsmail Dönmez  <ismail@namtrac.org>
+
+       Reviewed by Csaba Osztrogonác.
+
+       Add a Windows compatible inttypes.h header to fix WinCE build.
+       https://bugs.webkit.org/show_bug.cgi?id=46463
+
+       * os-win32/inttypes.h: Added.
+
+2010-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION(r68223): It broke 2-3 tests on bots (Requested by Ossy on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=46448
+
+        Roll this back in, with additional logic to prevent us from delaying construction
+        of functions named "arguments"
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitInitLazyRegister):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
+        (JSC::BytecodeGenerator::constRegisterFor):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_init_lazy_reg):
+        (JSC::JIT::emit_op_new_func):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_init_lazy_reg):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::needsActivationForMoreThanVariables):
+
+2010-09-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r68223.
+        http://trac.webkit.org/changeset/68223
+        https://bugs.webkit.org/show_bug.cgi?id=46448
+
+        It broke 2-3 tests on bots (Requested by Ossy on #webkit).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::constRegisterFor):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_init_arguments):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_init_arguments):
+        * parser/Nodes.h:
+
+2010-09-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Delay construction of functions that aren't captured
+        https://bugs.webkit.org/show_bug.cgi?id=46433
+
+        If a function isn't captured by an activation there's no
+        way it can be accessed indirectly, so we can delay the
+        construction until it's used (similar to what we do with
+        arguments).  We rename the existing op_init_arguments to
+        op_init_lazy_reg and removed its implicit handling of
+        the anonymous argument register, and make op_new_function
+        take a parameter to indicate whether it should null check
+        the target slot before creating the function object.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitInitLazyRegister):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
+        (JSC::BytecodeGenerator::constRegisterFor):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_init_lazy_reg):
+        (JSC::JIT::emit_op_new_func):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_init_lazy_reg):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::needsActivationForMoreThanVariables):
+
+2010-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/8460731> ~9.9% speedup when compiling interpreter with llvm-gcc-4.2
+        https://bugs.webkit.org/show_bug.cgi?id=46423
+
+        Reviewed by Oliver Hunt.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Disable the gcc computed
+        goto hacks added in r55564 when compiling with llvm-gcc-4.2.
+
+2010-09-23  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Reviewed by Darin Adler.
+
+        Fix usage of enum as if it was a define
+        https://bugs.webkit.org/show_bug.cgi?id=46355
+
+        pthread.h defines PTHREAD_MUTEX_DEFAULT and PTHREAD_MUTEX_NORMAL as an
+        enum.  Hence, it cannot be used by the preprocessor which always
+        evaluates that condition as true. This was giving a warning when
+        compiling with gcc and "-Wundef" flag.
+
+        The second path, when PTHREAD_MUTEX_DEFAULT is not the same of
+        PTHREAD_MUTEX_NORMAL, is not slow. So, let's eliminate the first path
+        and get rid of that #if.
+
+        * wtf/ThreadingPthreads.cpp: Always call pthread_mutexattr_init() to
+        set mutex type to PTHREAD_MUTEX_NORMAL.
+        (WTF::Mutex::Mutex):
+
+2010-09-23  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Removed extraneous truncation of ovector on entry and error exit.
+        Changed the initialization to -1 of vector to only initialize
+        the start indecies, which is sufficient for the pattern/subpatterns.
+        Changed the JIT code to not clear the end index for subpatterns
+        as it isn't needed.  These changes are worth ~2.7% on v8-regexp.
+        https://bugs.webkit.org/show_bug.cgi?id=46404
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+
+2010-09-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Only copy captured variables into activation
+        https://bugs.webkit.org/show_bug.cgi?id=46330
+
+        We now track free variable information which means that
+        we no longer need to copy every variable defined in a
+        function.  With this patch activations only retain those
+        variables needed for correctness.  In order to interact
+        safely with the inspector this means that JSActivation
+        now provides its own lookup functions so it can avoid 
+        trying to read or write to variables that have been
+        optimised out.
+
+        * bytecode/CodeBlock.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::capturedVariableCount):
+        (JSC::ScopeNode::captures):
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::capturedVariableCount):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSActivation.h:
+
+2010-09-23  Ismail Donmez  <ismail@namtrac.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix jsc.exe build for Windows CE
+
+        * jsc.pro: Add mmtimer.lib for Windows CE.
+
+2010-09-23  Ismail Donmez  <ismail@namtrac.org>
+
+        Unreviewed.
+
+        JIT should be disabled on Windows CE. Broken in r64176.
+
+        * wtf/Platform.h:
+
+2010-09-23  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Reduce the number of BOL checks in YARR Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46260
+
+        Extend the YARR Interpreter with an optimization which reduces the number of
+        BOL assertion checks. If a "TypeBodyAlternative" byteTerm is followed by a
+        "TypeAssertionBOL" byteTerm it will be checked just one time.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::alternativeBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::ByteTerm::BodyAlternativeBegin):
+        (JSC::Yarr::ByteTerm::BodyAlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::BodyAlternativeEnd):
+        (JSC::Yarr::ByteTerm::AlternativeBegin):
+        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::AlternativeEnd):
+
+2010-09-22  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed the cross over from alternatives executed once and
+        those that loop.  This fixed the problem where the index
+        was getting messed up for looping alternatives causing an
+        infinite loop.
+        https://bugs.webkit.org/show_bug.cgi?id=46189
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2010-09-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Jon Honeycutt.
+
+        Allow jsc.exe to be run against unversioned ICU.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2010-09-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Laszlo Gombos.
+
+        Use "typedef wchar_t JSChar" when compiled with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=40651
+
+        Use wchar_t for JSChar and UChar when compiled with RVCT.
+        Linux is the exception for this rule.
+
+        * API/JSStringRef.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2010-09-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [INTERPRETER] Two tests fail with SputnikError: #1.1: if argArray is neither an array nor an arguments object (see 10.1.8), a TypeError exception is thrown
+        https://bugs.webkit.org/show_bug.cgi?id=44245
+
+        Remove incorrect code from op_load_varargs in the interpreter.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-09-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [JIT] fast/js/sputnik/Conformance/15_Native_Objects/15.3_Function/15.3.5/S15.3.5.3_A2_T6.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=44246
+
+        JIT code generated for instanceof was not checking to ensure that the prototype property was
+        an object, this patch ensures that it does.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+
+2010-09-22  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Inline UTF8SequenceLength
+        https://bugs.webkit.org/show_bug.cgi?id=45589
+
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::convertUTF8ToUTF16): Use inline version of UTF8SequenceLength to improve performance.
+
+2010-09-21  Oliver Hunt  <oliver@apple.com>
+
+        RS=Gavin Barraclough.
+
+        Fix codeblock dumping
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+
+2010-09-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Speed up function.apply(..., arguments)
+        https://bugs.webkit.org/show_bug.cgi?id=46207
+
+        Add code to do argument copying inline in the case
+        where we're using Function.apply to forward our arguments
+        directly.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+           Splitted op_load_varargs into fast and slow paths, so add the call
+           to the slow path generator.
+        * jit/JIT.h:
+        * jit/JITCall32_64.cpp:
+          Remove 32bit specific emit_op_load_varargs as the logic is the
+          same for all value representations
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_load_varargs):
+          Copy arguments inline
+        (JSC::JIT::emitSlow_op_load_varargs):
+
+2010-09-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/8363003> REGRESSION: ~1.4% sunspider regression in
+        interpreter due to 54724 and 54596
+        
+        Fixed a typo (using "UNLIKELY" instead of "LIKELY").
+        
+        * wtf/PassRefPtr.h:
+        (WTF::refIfNotNull):
+        (WTF::derefIfNotNull): It is likely that m_ptr != 0 because most RefPtrs
+        hold real data. Also, in cases where they do not hold real data, the
+        compiler usually sees a call to release() right before the call to the
+        destructor, so it can probably optimize out the test completely.
+
+2010-09-21  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Martin Robinson.
+
+        Build issues with Windows versions of the GTK+ port
+        https://bugs.webkit.org/show_bug.cgi?id=45844
+
+        Link with winmm.dll when necessary and specify the executable extension
+        explicitely so that the Programs/jsc-@WEBKITGTK_API_MAJOR_VERSION@
+        rule actually works.
+
+        Don't try to build the ThreadSpecificWin.cpp since GTK+ port uses
+        a section in ThreadSpecific.cpp
+
+        * GNUmakefile.am:
+
+2010-09-21  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] 'make dist' should be fixed in preparation for the next release
+        https://bugs.webkit.org/show_bug.cgi?id=46129
+
+        * GNUmakefile.am: Update the sources list to include missing headers.
+
+2010-09-21  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45673
+
+        r65596 caused ENABLE_PROFILER_REFERENCE_OFFSET to not be
+        8 byte aligned. A non 8 byte divisible value for this will
+        cause the sp to become non 8 byte aligned.
+
+        Verify and correct offset values that r65596 effected that
+        weren't updated.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2010-09-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Fix Opcode stats compilation
+        https://bugs.webkit.org/show_bug.cgi?id=46079
+
+        The FixedArray API had changed, and <stdio.h> was not included for
+        printf.
+
+        * bytecode/Opcode.cpp:
+        (JSC::OpcodeStats::~OpcodeStats):
+
+2010-09-20  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed detection of alternative smaller than the first alternative
+        to only check looping alternatives.
+        https://bugs.webkit.org/show_bug.cgi?id=46049
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2010-09-20  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        REGRESSION(67790): jsc tests are failed with YARR interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46083
+
+        Fix the initializing of the lastSubpatternId member of
+        parentheses.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
+
+2010-09-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 46077 - ASSERT failure in YARR JIT
+
+        We will currently attempt to loop if there are multiple alternatives, they are all
+        BOL predicated, and the last alternative is longer then the first - however if all
+        alternatives are BOL predicated the head of loop label will not have been set, and
+        we'll try to link a jump to an undefined label. Stop doing so.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2010-09-20  Adam Roben  <aroben@apple.com>
+
+        Export RegExpObject::info from JavaScriptCore
+
+        This allows obj->inherits(&RegExpObject::info) to work correctly from
+        outside JavaScriptCore.dll on Windows.
+
+        Fixes <http://webkit.org/b/46098>
+        fast/loader/stateobjects/pushstate-object-types.html fails on Windows
+
+        Reviewed by John Sullivan.
+
+        * runtime/RegExpObject.h: Added JS_EXPORTDATA to the info member, as
+        we already have for some other classes whose info members have to be
+        used from outside the DLL.
+
+2010-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix pt 2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix pt 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix - implicit double-to-int conversion invalid on 32-bit.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncSetYear):
+
+2010-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 46065 - Unify implementation of ToInt32 and ToUInt32, don't use fmod.
+
+        These methods implement the same conversion (see discussion in the notes
+        of sections of 9.5 and 9.6 of the spec), only differing in how the result
+        is interpretted.
+
+        Date prototype is incorrectly using toInt32, and this is causing us to
+        provide an output value indicating whether the input to ToInt32 was finite
+        (the corresponding methods on Date are actually spec'ed to use ToInteger,
+        not ToInt32).  This patch partially fixes this in order to remove this
+        bogus output value, hoewever more work will be require to bring Date
+        fully up to spec compliance (the constructor is still performing ToInt32
+        conversions).
+
+        * JavaScriptCore.exp:
+        * runtime/DatePrototype.cpp:
+        (JSC::fillStructuresUsingTimeArgs):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/JSValue.cpp:
+        (JSC::toInt32):
+        * runtime/JSValue.h:
+        (JSC::toUInt32):
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+
+2010-09-18  Darin Adler  <darin@apple.com>
+
+        First step in fixing Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Removed incorrect symbol. The build will probably still fail,
+        but the failure will tell us what symbol to add.
+
+2010-09-18  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Added code to unroll regular expressions containing ^.
+        Alternatives that begin with ^ are tagged during parsing
+        and rolled up in containing sub expression structs.
+        After parsing, a regular expression flagged as containing
+        a ^ (a.k.a. BOL) is processed further in optimizeBOL().
+        A copy of the disjunction is made excluding alternatives that
+        are rooted with BOL.  The original alternatives are flagged
+        to only be executed once.  The copy of the other alternatives are
+        added to the original expression.
+        In the case that all original alternatives are flagged, there
+        won't be any looping alternatives.
+        The JIT generator will emit code accordingly, executing the
+        original alternatives once and then looping over the
+        alternatives that aren't anchored with a BOL (if any).
+        https://bugs.webkit.org/show_bug.cgi?id=45787
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::assertionBOL):
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
+        (JSC::Yarr::RegexPatternConstructor::copyDisjunction):
+        (JSC::Yarr::RegexPatternConstructor::copyTerm):
+        (JSC::Yarr::RegexPatternConstructor::optimizeBOL):
+        (JSC::Yarr::compileRegex):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternAlternative::PatternAlternative):
+        (JSC::Yarr::PatternAlternative::setOnceThrough):
+        (JSC::Yarr::PatternAlternative::onceThrough):
+        (JSC::Yarr::PatternDisjunction::PatternDisjunction):
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+
+2010-09-18  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Rename Wince files to WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=37287
+
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/wince/UnicodeWinCE.cpp: Copied from JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp.
+        * wtf/unicode/wince/UnicodeWinCE.h: Copied from JavaScriptCore/wtf/unicode/wince/UnicodeWince.h.
+        * wtf/unicode/wince/UnicodeWince.cpp: Removed.
+        * wtf/unicode/wince/UnicodeWince.h: Removed.
+        * wtf/wince/FastMallocWinCE.h: Copied from JavaScriptCore/wtf/wince/FastMallocWince.h.
+        * wtf/wince/FastMallocWince.h: Removed.
+
+2010-09-18  Ademar de Souza Reis Jr  <ademar.reis@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Enable Platform Strategies on Qt
+
+        [Qt] Turn on PLATFORM_STRATEGIES
+        https://bugs.webkit.org/show_bug.cgi?id=45831
+
+        * wtf/Platform.h: Enable Platform Strategies when building QtWebkit
+
+2010-09-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Imprecise tracking of variable capture leads to overly pessimistic creation of activations
+        https://bugs.webkit.org/show_bug.cgi?id=46020
+
+        The old logic for track free and captured variables would cause us
+        to decide we needed an activation in every function along the scope
+        chain between a variable capture and its declaration.  We now track
+        captured variables precisely which requires a bit of additional work
+
+        The most substantial change is that the parsing routine needs to
+        be passed the list of function parameters when reparsing a function
+        as when reparsing we don't parse the function declaration itself only
+        its body.
+
+        * JavaScriptCore.exp:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::needsFullActivation):
+           We need to distinguish between use of a feature that requires
+           an activation and eval so we now get this additional flag.
+        (JSC::JSParser::Scope::collectFreeVariables):
+        (JSC::JSParser::Scope::getCapturedVariables):
+           We can't simply return the list of "capturedVariables" now as
+           is insufficiently precise, so we compute them instead.
+        (JSC::JSParser::popScope):
+        (JSC::jsParse):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseWithStatement):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseFunctionDeclaration):
+        (JSC::JSParser::parseProperty):
+        (JSC::JSParser::parseMemberExpression):
+        * parser/JSParser.h:
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::fromGlobalCode):
+           Pass function parameters (if available) to the parser.
+
+2010-09-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add IsFloatingPoint and IsArithmetic type traits
+        https://bugs.webkit.org/show_bug.cgi?id=46018
+
+        * wtf/TypeTraits.h:
+        * wtf/TypeTraits.cpp:
+
+2010-09-17  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] FontPlatformDataFreeType should use smart pointers to hold its members
+        https://bugs.webkit.org/show_bug.cgi?id=45917
+
+        Added support to PlatformRefPtr for handling HashTableDeletedValue.
+
+        * wtf/PlatformRefPtr.h:
+        (WTF::PlatformRefPtr::PlatformRefPtr): Added a constructor that takes HashTableDeletedValue.
+        (WTF::PlatformRefPtr::isHashTableDeletedValue): Added.
+
+2010-09-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Crash due to timer triggered GC on one heap while another heap is active
+        https://bugs.webkit.org/show_bug.cgi?id=45932
+        <rdar://problem/8318446>
+
+        The GC timer may trigger for one heap while another heap is active.  This
+        is safe, but requires us to ensure that we have temporarily associated the
+        thread's identifierTable with the heap we're collecting on.  Otherwise we
+        may end up with the identifier tables in an inconsistent state leading to
+        an eventual crash.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocate):
+        (JSC::Heap::reset):
+        (JSC::Heap::collectAllGarbage):
+           Add assertions to ensure we have the correct identifierTable active
+           while collecting.
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger):
+           Temporarily make the expected IdentifierTable active
+        * wtf/WTFThreadData.h:
+        (JSC::IdentifierTable::remove):
+           Make it possible to see when IdentifierTable::remove has succeeded
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::~StringImpl):
+           CRASH if an StringImpl is an Identifier but isn't present in the
+           active IdentifierTable.  If we get to this state something has
+           gone wrong and we should just crash immediately.
+
+2010-09-16  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Implement dissolveDragImageToFraction
+        https://bugs.webkit.org/show_bug.cgi?id=45826
+
+        * wtf/gobject/GTypedefs.h: Added forward declarations for GtkWindow and GdkEventExpose.
+
+2010-09-16  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by Jian Li.
+
+        Unify FILE_SYSTEM and FILE_WRITER enables under the name FILE_SYSTEM.
+        https://bugs.webkit.org/show_bug.cgi?id=45798
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-09-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Use free variable analysis to improve activation performance
+        https://bugs.webkit.org/show_bug.cgi?id=45837
+
+        Adds free and captured variable tracking to the JS parser.  This
+        allows us to avoid construction of an activation object in some
+        cases.  Future patches will make more use of this information to
+        improve those cases where activations are still needed.
+
+        * parser/ASTBuilder.h:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::declareVariable):
+        (JSC::JSParser::Scope::useVariable):
+        (JSC::JSParser::Scope::collectFreeVariables):
+        (JSC::JSParser::Scope::capturedVariables):
+        (JSC::JSParser::ScopeRef::ScopeRef):
+        (JSC::JSParser::ScopeRef::operator->):
+        (JSC::JSParser::ScopeRef::index):
+        (JSC::JSParser::currentScope):
+        (JSC::JSParser::pushScope):
+        (JSC::JSParser::popScope):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseConstDeclarationList):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseFunctionDeclaration):
+        (JSC::JSParser::parsePrimaryExpression):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::ScopeNodeData):
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::needsActivation):
+        (JSC::ScopeNode::hasCapturedVariables):
+        * parser/Parser.cpp:
+        (JSC::Parser::didFinishParsing):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * parser/SyntaxChecker.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::ScriptExecutable::recordParse):
+
+2010-09-14  Hyung Song  <beergun@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Add IMemGroup and IMemSpace to OwnPtr type.
+        https://bugs.webkit.org/show_bug.cgi?id=44764
+
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.cpp:
+        (WTF::deleteOwnedPtr):
+
+2010-09-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Sort with non-numeric custom sort function fails on array with length but no values
+        https://bugs.webkit.org/show_bug.cgi?id=45781
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort): Replaced early exit for an array of length zero to instead
+        exit for any array without values, even if it has a non-0 length.
+
+2010-09-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows production build fix.
+        Roll out r65143.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2010-09-14  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Share UnicodeMacrosFromICU.h
+        https://bugs.webkit.org/show_bug.cgi?id=45710
+
+        glib, qt4 and wince use the same macros from ICU.
+        Remove the code duplication and use the same header file.
+
+        * wtf/unicode/UnicodeMacrosFromICU.h: Copied from JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h.
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h: Removed.
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        * wtf/unicode/wince/UnicodeWince.h:
+
+2010-09-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Preparation for eliminating deprecatedParseURL
+        https://bugs.webkit.org/show_bug.cgi?id=45695
+
+        * wtf/text/WTFString.h: Added isAllSpecialCharacters, moved here from
+        the HTML tree builder.
+
+2010-09-13  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add option to conditionally compile smooth scrolling support.
+        https://bugs.webkit.org/show_bug.cgi?id=45689
+
+        ENABLE(SMOOTH_SCROLLING) is disabled by default for all platforms.
+
+        * wtf/Platform.h:
+
+2010-09-13  Adam Roben  <aroben@apple.com>
+
+        Copy JavaScriptCore's generated sources to the right directory
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Fixed typo.
+
+2010-09-13  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Don't call _msize
+        https://bugs.webkit.org/show_bug.cgi?id=45556
+
+        Because Brew MP uses its own memory allocator, it is not correct to use
+        _msize in fastMallocSize. Add !PLATFORM(BREWMP) guard.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocSize):
+
+2010-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] V8 port: webcore project files changes
+        https://bugs.webkit.org/show_bug.cgi?id=45141
+
+        * JavaScriptCore.pro: Moved wtf specific files to wtf.pri,
+        so that they can also be used from WebCore.pro for v8 builds.
+        * wtf/wtf.pri: Added.
+
+2010-09-10  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Andreas Kling.
+
+        Add a define missing when building with glib unicode backend
+        https://bugs.webkit.org/show_bug.cgi?id=45544
+
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h:
+
+2010-09-10  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        Refactor JavaScriptCore memory statistics so that WebKit doesn't need to know 
+        about the JIT and other implementation details of JavaScriptCore.  Necessary 
+        to fix PPC build.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=45528
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/MemoryStatistics.cpp: Added.
+        (JSC::memoryStatistics):
+        * runtime/MemoryStatistics.h: Added.
+
+2010-09-09  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Added a regular expression tracing facility.  This tracing is connected
+        to jsc.  Every compiled regular expression object is added to a list.
+        When the process exits, each regular expression dumps its pattern,
+        JIT address, number of times it was executed and the number of matches.
+        This tracing is controlled by the macro ENABLE_REGEXP_TRACING in
+        wtf/Platform.h.
+        https://bugs.webkit.org/show_bug.cgi?id=45401
+
+        * JavaScriptCore.exp:
+        * jsc.cpp:
+        (runWithScripts):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        (JSC::JSGlobalData::addRegExpToTrace):
+        (JSC::JSGlobalData::dumpRegExpTrace):
+        * runtime/JSGlobalData.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wtf/Platform.h:
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::getAddr):
+
+2010-09-09  John Therrell  <jtherrell@apple.com>
+
+        32-bit build fix.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::committedByteCount):
+
+2010-09-09  John Therrell  <jtherrell@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Added statistics sampling and reporting for JavaScriptCore's RegisterFile and ExecutableAllocator classes
+        https://bugs.webkit.org/show_bug.cgi?id=45134
+
+        Added thread-safe committed byte counting and reporting functionality to RegisterFile and 
+        ExecutableAllocator.
+
+        * JavaScriptCore.exp:
+        Exported new symbols to allow for WebKit to get statistics from JavaScriptCore classes.
+        
+        * interpreter/RegisterFile.cpp:
+        (JSC::registerFileStatisticsMutex):
+        Added function which returns a static Mutex used for locking during read/write access to
+        static committed byte count variable.
+        (JSC::RegisterFile::~RegisterFile):
+        Added call to addToStatistics since memory is decommitted here.
+        (JSC::RegisterFile::releaseExcessCapacity):
+        Added call to addToStatistics since memory is decommitted here.
+        (JSC::RegisterFile::initializeThreading):
+        Added function which calls registerFileStatisticsMutex().
+        (JSC::RegisterFile::committedByteCount):
+        Added function which returns the current committed byte count for RegisterFile.
+        (JSC::RegisterFile::addToCommittedByteCount):
+        Added function which updates committed byte count.
+        
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        Added call to addToStatistics since memory is committed here.
+        (JSC::RegisterFile::grow):
+        Added call to addToStatistics since memory is committed here.
+        
+        * jit/ExecutableAllocator.h:
+        Added function prototype for public static function committedByteCount().
+        
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::release):
+        Added call to addToStatistics since memory is decommitted here.
+        (JSC::FixedVMPoolAllocator::reuse):
+        Added call to addToStatistics since memory is committed here.
+        (JSC::FixedVMPoolAllocator::addToCommittedByteCount):
+        Added function which updates committed byte count.
+        (JSC::ExecutableAllocator::committedByteCount):
+        Added function which returns the current committed byte count for ExecutableAllocator.
+        
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        Added call to RegisterFile::initializeThreading.
+
+2010-09-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <http://webkit.org/b/45502> JSObjectSetPrivateProperty does not handle NULL values as it claims
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPrivateProperty): Don't call toJS if we have a NULL value as that will cause an assertion
+        failure. Instead map NULL directly to the null JSValue.
+        * API/tests/testapi.c:
+        (main): Add test coverage for the NULL value case.
+
+2010-09-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        [Qt] JSVALUE32_64 not works on Windows platform with MinGW compiler
+        https://bugs.webkit.org/show_bug.cgi?id=29268
+
+        * wtf/Platform.h: Enable JSVALUE32_64 for Qt/Windows/MinGW, because it works now.
+
+2010-09-08  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Removing doneSemicolon label in the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=45289
+
+        As a side effect of moving the multiline comment parsing
+        to a separate function, an opportunity raised to simplify
+        the single line comment parsing, and removing doneSemicolon
+        label. Slight performance increase on --parse-only
+        tests (from 32.8ms to 31.5ms)
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+
+2010-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove accessor for private member variable in JSParser
+        https://bugs.webkit.org/show_bug.cgi?id=45378
+
+        m_token is private to JSParser, so it does not seem to be useful
+        to have an accessor for it. On top of that, the file was both
+        using the accessor and directly accessing the member variable,
+        only one style should be used.
+
+2010-09-08  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] REGRESSION(63348): jsc is broken
+        https://bugs.webkit.org/show_bug.cgi?id=42818
+
+        Need fastcall conventions on Qt/Win/MinGW.
+        Based on patches of Gavin Barraclough: r63947 and r63948.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2010-09-08  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        Remove some unnecessary duplicate calls to string functions
+
+        https://bugs.webkit.org/show_bug.cgi?id=45314
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::format):
+
+2010-09-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Re-Disable JIT for MSVC 64bit to fix the build on this compiler.
+        https://bugs.webkit.org/show_bug.cgi?id=45382
+
+        It was enabled in the cleanup made in r64176, though it is still
+        not implemented.
+
+        * wtf/Platform.h:
+
+2010-09-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Need a WebSocket implementation
+        https://bugs.webkit.org/show_bug.cgi?id=45197
+
+        Add a GIO-based WebSocket implementation.
+
+        * wtf/gobject/GRefPtr.cpp: Added PlatformRefPtr support for GSource.
+        (WTF::refPlatformPtr):
+        (WTF::derefPlatformPtr):
+        * wtf/gobject/GRefPtr.h: Added new template specialization declarations.
+        * wtf/gobject/GTypedefs.h: Add some more GLib/GIO forward declarations.
+
+2010-08-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Handle MediaQueryExp memory management exclusively with smart pointers
+        https://bugs.webkit.org/show_bug.cgi?id=44874
+        
+        Implemented a non-copying sort function to make it possible to sort a Vector
+        of OwnPtrs (which cannot be copied). This is required for the above.
+
+        * wtf/NonCopyingSort.h: Added.
+        (WTF::nonCopyingSort): It's secretly heapsort.
+        (WTF::heapSort): heapsort implementation.
+        (WTF::siftDown): Helper function for heapsort.
+        (WTF::heapify): ditto
+
+        Adjust build systems.
+        
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-09-08  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Refactoring multiline comments in the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=45289
+
+        MultiLine comment parsing is moved to a separate function.
+
+        Slight performance increase on --parse-only tests (from 33.6ms to 32.8ms)
+        SunSpider reports no change (from 523.1ms to 521.2ms).
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseMultilineComment):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+
+2010-09-07  James Robinson  <jamesr@chromium.org>
+
+        Compile fix attempt for windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-09-07  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Fix Windows build after r66936
+        https://bugs.webkit.org/show_bug.cgi?id=45348
+
+        Add symbol names that were missing from r66936.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-09-07  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        pushState and replaceState do not clone RegExp objects correctly
+        https://bugs.webkit.org/show_bug.cgi?id=44718
+        
+        Move internal representation of JSC::RegExp (which depends on wether
+        YARR and YARR_JIT is enabled) into RegExpRepresentation which can live
+        in the implementation only. This makes it feasible to use RegExp in
+        WebCore without bringing in all of YARR.
+
+        * JavaScriptCore.exp: Export RegExp and RegExpObject functions that are
+        needed inside WebCore's JSC bindings.
+        * runtime/RegExp.cpp:
+        (JSC::RegExpRepresentation::~RegExpRepresentation):
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+
+2010-09-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/8381749> -Wcast-align warning emitted when building with clang
+
+        Remove the -Wcast-align-warning since it isn't really useful, and clang is more aggressive about warning than gcc.
+
+        * Configurations/Base.xcconfig:
+
+2010-09-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(66741): Undefined pthread macros
+        https://bugs.webkit.org/show_bug.cgi?id=45246
+
+        PTHREAD_MUTEX_NORMAL and PTHREAD_MUTEX_DEFAULT (introduced in r60487) are not defined on Linux, 
+        but used in a statement. Add an additional check to test this.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+
+2010-09-06  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix
+
+2010-09-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        SerializedScriptValue needs to use a flat storage mechanism
+        https://bugs.webkit.org/show_bug.cgi?id=45244
+
+        Export JSArray::put
+
+        * JavaScriptCore.exp:
+
+2010-09-06  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Support JSVALUE32_64 on MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=43999
+
+        Add missing functions to support JSVALUE32_64 on MIPS.
+        Remove JSVALUE32 as the default for MIPS.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::divd):
+        (JSC::MIPSAssembler::mthc1):
+        (JSC::MIPSAssembler::cvtwd):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::neg32):
+        (JSC::MacroAssemblerMIPS::branchOr32):
+        (JSC::MacroAssemblerMIPS::set8):
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::divDouble):
+        (JSC::MacroAssemblerMIPS::convertInt32ToDouble):
+        (JSC::MacroAssemblerMIPS::branchDouble):
+        (JSC::MacroAssemblerMIPS::branchConvertDoubleToInt32):
+        (JSC::MacroAssemblerMIPS::zeroDouble):
+        * jit/JIT.h:
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+
+2010-09-06  Robert Hogan  <robert@webkit.org>
+
+        Unreviewed, compile fix.
+
+        Fix compile failure in r66843
+
+        Revert to original patch in bugzilla. Leave bug open for
+        discussion on potential removal of double utf8 conversion.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45240
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::format):
+
+2010-09-06  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] utf8 encoding of console() messages
+
+        Unskip:
+        http/tests/security/xssAuditor/embed-tag-null-char.html
+        http/tests/security/xssAuditor/object-embed-tag-null-char.html
+
+        Both tests failed because Qt's implementation of String::format()
+        is casting a utf8 result to String, which assumes latin1 in
+        its constructor. So instead of casting a QString to a String, use
+        StringImpl::create() instead. Unfortunately, this involves a lot
+        of extra casts but the end result is correct.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45240
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::format):
+
+2010-09-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45135
+        <rdar://problem/7823714> TCMalloc_PageHeap doesn't hold a mutex while manipulating shared data
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Make sure to create a non-recursive mutex
+        regardless of platform default, so that we can assert that it's held (this is for platforms
+        that don't have libdispatch).
+        (WTF::TCMalloc_PageHeap::signalScavenger): Assert that the mutex is held, so we can look
+        at m_scavengeThreadActive. For platforms that have libdispatch, assert that pageheap_lock
+        is held.
+        (WTF::TCMalloc_PageHeap::periodicScavenge): Make sure that pageheap_lock is held before
+        manipulating m_scavengeThreadActive. Otherwise, there is an obvious race condition, and we
+        can make unbalanced calls to dispatch_resume().
+
+2010-09-03  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Reviewed by Martin Robinson.
+
+        [EFL] Regression (66531) Build break with Glib Support
+        https://bugs.webkit.org/show_bug.cgi?id=45011
+
+        Move GtkTypedefs.h to GTypedefs.h and let it inside gobject directory
+        since when glib is enabled, EFL port needs it, too.
+
+        * CMakeListsEfl.txt: Include gobject directory to find new header
+        file.
+        * GNUmakefile.am: Ditto.
+        * wtf/CMakeListsEfl.txt: Ditto.
+        * wtf/Platform.h: Include header if port is EFL and glib support is
+        enabled.
+        * wtf/gtk/GtkTypedefs.h: Removed.
+        * wtf/gobject/GTypedefs.h: Added. Sections specific to GTK are now
+        guarded by PLATFORM(GTK).
+
+2010-09-03  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix warning in wtf/ByteArray.h
+        https://bugs.webkit.org/show_bug.cgi?id=44672
+
+        * wtf/ByteArray.h: Use maximal sized array for MSVC and unsized array for other compilers.
+
+2010-09-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Actually parse a URL from ParsedURL
+        https://bugs.webkit.org/show_bug.cgi?id=45080
+
+        This patch only handles standard URLs.  At some point we'll need to
+        distinguish between standard URLs and other kinds of URLs.
+
+        * wtf/url/api/ParsedURL.cpp:
+        (WTF::ParsedURL::ParsedURL):
+
+2010-09-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ParsedURL and URLString to WTFURL API
+        https://bugs.webkit.org/show_bug.cgi?id=45078
+
+        Currently there's no actual URL parsing going on, but this patch is a
+        start to sketching out the API.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/url/api/ParsedURL.cpp: Added.
+        (WTF::ParsedURL::ParsedURL):
+        (WTF::ParsedURL::scheme):
+        (WTF::ParsedURL::username):
+        (WTF::ParsedURL::password):
+        (WTF::ParsedURL::host):
+        (WTF::ParsedURL::port):
+        (WTF::ParsedURL::path):
+        (WTF::ParsedURL::query):
+        (WTF::ParsedURL::fragment):
+        (WTF::ParsedURL::segment):
+        * wtf/url/api/ParsedURL.h: Added.
+        (WTF::ParsedURL::spec):
+        * wtf/url/api/URLString.h: Added.
+        (WTF::URLString::URLString):
+        (WTF::URLString::string):
+
+2010-09-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add WTFURL to the JavaScriptCore build on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=45075
+
+        Building code is good.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-09-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43230
+        <rdar://problem/8254215> REGRESSION: Memory leak within JSParser::JSParser
+
+        One can't delete a ThreadSpecific object that has data in it. It's not even possible to
+        enumerate data objects in all threads, much less destroy them from a thread that's destroying
+        the ThreadSpecific.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::JSParser):
+        * runtime/JSGlobalData.h: 
+        * wtf/WTFThreadData.cpp:
+        (WTF::WTFThreadData::WTFThreadData):
+        * wtf/WTFThreadData.h:
+        (WTF::WTFThreadData::approximatedStackStart):
+        Moved stack guard tracking from JSGlobalData to WTFThreadData.
+
+        * wtf/ThreadSpecific.h: Made destructor unimplemented. It's dangerous, and we probably won't
+        ever face a situation where we'd want to delete a ThreadSpecific object.
+
+2010-09-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Ecma-262 15.11.1.1 states that if the argument is undefined then an
+        Error object's message property should be set to the empty string.
+
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        (JSC::ErrorInstance::create):
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+
+2010-08-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavenge): Replaced somewhat-quirky code that
+        mixed types with code that uses size_t.
+
+        * wtf/TCPageMap.h: Removed names of unused arguments to avoid warning.
+
+2010-08-31  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Isolate all GTK+ typedefs into one file
+        https://bugs.webkit.org/show_bug.cgi?id=44900
+
+        * GNUmakefile.am: Add GtkTypedefs.h to the source lists.
+        * wtf/Platform.h: #include GtkTypedefs.h for the GTK+ build.
+        * wtf/ThreadingPrimitives.h: Remove GTK+ typedefs.
+        * wtf/gobject/GOwnPtr.h: Ditto.
+        * wtf/gobject/GRefPtr.h: Ditto.
+        * wtf/gtk/GtkTypedefs.h: Added.
+
+2010-08-31  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Fix 'make dist' in preparation of the 1.3.3 release
+        https://bugs.webkit.org/show_bug.cgi?id=44978
+
+        * GNUmakefile.am: Adding missing headers to the sources list.
+
+2010-08-31  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Support emit_op_mod() for MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=42855
+
+        This patch uses MIPS div instructions for op_mod to improve performance.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::div):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+
+2010-08-31  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Modify ASSERT_UNUSED and UNUSED_PARAM similar to Qt's Q_UNUSED.
+        https://bugs.webkit.org/show_bug.cgi?id=44870
+
+        * wtf/Assertions.h:
+        * wtf/UnusedParam.h:
+
+2010-08-31  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        JSC TimeoutChecker::didTimeOut overflows on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=38538
+
+        Make getCPUTime() return values relative to the first call.
+        The previous implementation relied on simply on currentTime(), which
+        return a time since epoch and not a time since the thread started. This
+        made the return value of getCPUTime() overflow on 32 bits.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2010-08-30  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        HISTORY_ALWAYS_ASYNC should be removed (history should always be async)
+        https://bugs.webkit.org/show_bug.cgi?id=44315
+
+        Remove ENABLE_HISTORY_ALWAYS_ASYNC #define.
+
+        * wtf/Platform.h: 
+
+2010-08-30  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Fix namespace for wtf/Complex.h and wtf/Vector3.h
+        https://bugs.webkit.org/show_bug.cgi?id=44892
+
+        * wtf/Complex.h:
+        * wtf/Vector3.h:
+
+2010-08-30  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Strings returned by asciiDebug() should be NULL-terminated.
+        https://bugs.webkit.org/show_bug.cgi?id=44866
+
+        * wtf/text/WTFString.cpp:
+        (asciiDebug):
+
+2010-08-30  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Refactor number parsing in the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=44104
+
+        Number parsing was full of gotos, and needed a complete
+        redesign to remove them (Only one remained). Furthermore
+        integer arithmetic is empolyed for fast cases (= small
+        integer numbers).
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseHex):
+        (JSC::Lexer::parseOctal):
+        (JSC::Lexer::parseDecimal):
+        (JSC::Lexer::parseNumberAfterDecimalPoint):
+        (JSC::Lexer::parseNumberAfterExponentIndicator):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+
+2010-08-29  Darin Adler  <darin@apple.com>
+
+        Fix Qt build.
+
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h: Added U_IS_BMP.
+        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+        * wtf/unicode/wince/UnicodeWince.h: Ditto.
+
+2010-08-29  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Port vprintf_stderr_common
+        https://bugs.webkit.org/show_bug.cgi?id=33568
+
+        Use BREW's DBGPRINTF to output debug messages.
+
+        * wtf/Assertions.cpp:
+
+2010-08-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 44830 - In Array's prototype functyions we're incorrectly handing large index values
+
+        We are in places casting doubles to unsigneds, and unsigneds to ints, without always check
+        that the result is within bounds. This is problematic in the case of double-to-unsigned
+        conversion because we should be saturating to array length.
+
+        Also, the error return value from Array.splice should be [], not undefined.
+
+        I don't see any security concerns here. These methods are spec'ed in such a way that they
+        can be applied to non Array objects, so in all cases the (potentially bogus) indices are
+        being passed to functions that will safely check accesses are within bounds.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::argumentClampedIndexFromStartOrEnd):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/JSValue.h:
+        (JSC::JSValue::toUInt32):
+
+2010-08-28  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add an ENABLE define for purgeable memory support
+        https://bugs.webkit.org/show_bug.cgi?id=44777
+
+        * wtf/Platform.h:
+
+2010-08-27  Kimmo Kinnunen  <kimmo.t.kinnunen@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] NPAPI Plugin metadata should be cached, and loading a plugin should not require loading every plugin
+        https://bugs.webkit.org/show_bug.cgi?id=43179
+
+        Add ENABLE_NETSCAPE_PLUGIN_METADATA_CACHE flag to enable persistent
+        NPAPI Plugin Cache. The flag is enabled by default.
+
+        * wtf/Platform.h: Add ENABLE_NETSCAPE_PLUGIN_METADATA_CACHE
+
+2010-07-27  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Add JavaScript API to allow a page to go fullscreen.
+        rdar://problem/6867795
+        https://bugs.webkit.org/show_bug.cgi?id=43099
+
+        * wtf/Platform.h: Enable FULLSCREEN_API mode for the Mac (except iOS).
+
+2010-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix pt 2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix pt 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 44745 - Number.toFixed/toExponential/toPrecision are inaccurate.
+
+        These methods should be using a version of dtoa that can generate results accurate
+        to the requested precision, whereas our version of dtoa is only currently able to
+        support producing results sufficiently accurate to distinguish the value from any
+        other IEEE-754 double precision number.
+
+        This change has no impact on benchmarks we track.
+
+        On microbenchmarks for these functions, this is a slight regression where a high
+        precision is requested (dtoa now need to iterate further to generate a a greater
+        number of digits), but with smaller precision values (hopefully more common) this
+        improves performance, since it reduced the accurate of result dtoa is required,
+        to produce, and removes the need to pre-round values before calling dtoa. 
+
+        * JavaScriptCore.exp:
+            doubleToStringInJavaScriptFormat renamed to numberToString
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+            doubleToStringInJavaScriptFormat renamed to numberToString
+
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+            doubleToStringInJavaScriptFormat renamed to numberToString
+
+        * wtf/DecimalNumber.h:
+        (WTF::DecimalNumber::DecimalNumber):
+        (WTF::DecimalNumber::toStringDecimal):
+        (WTF::DecimalNumber::toStringExponential):
+            Remove all pre-rounding of values, instead call dtoa correctly.
+
+        * wtf/dtoa.cpp:
+        (WTF::dtoa):
+        * wtf/dtoa.h:
+            Reenable support for rounding to specific-figures/decimal-places in dtoa.
+            Modify to remove unbiased rounding, provide ECMA required away-from-zero.
+            Rewrite doubleToStringInJavaScriptFormat to use DecimalNumber, rename to
+            numberToString.
+
+2010-08-27  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Byte alignment issue on MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=29415
+
+        MIPS accesses one byte at a time for now to avoid the help from the
+        kernel to fix unaligned accesses.
+
+        * wtf/text/AtomicString.cpp:
+        (WebCore::equal):
+        * wtf/text/StringHash.h:
+        (WebCore::StringHash::equal):
+
+2010-08-27  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix a couple of typos in comment.
+
+        * bytecode/CodeBlock.h:
+
+2010-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * wtf/dtoa.cpp:
+
+2010-08-26  Gavin Barraclough  <baraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 44735 - Clean up dtoa.cpp
+        Remove unused & unmaintained code paths, reformat code to match
+        coding standard & use platform #defines from Platform.h directly.
+
+        * wtf/dtoa.cpp:
+        (WTF::storeInc):
+        (WTF::multadd):
+        (WTF::s2b):
+        (WTF::lo0bits):
+        (WTF::mult):
+        (WTF::pow5mult):
+        (WTF::lshift):
+        (WTF::diff):
+        (WTF::ulp):
+        (WTF::b2d):
+        (WTF::d2b):
+        (WTF::ratio):
+        (WTF::):
+        (WTF::strtod):
+        (WTF::quorem):
+        (WTF::dtoa):
+
+2010-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Partially revert r65959. The toString changes regressed the v8 tests,
+        but keep the toFixed/toExponential/toPrecision changes.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/NumberPrototype.cpp:
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+        * wtf/DecimalNumber.h:
+        * wtf/dtoa.cpp:
+        (WTF::append):
+        (WTF::doubleToStringInJavaScriptFormat):
+        * wtf/dtoa.h:
+        * wtf/text/WTFString.cpp:
+        * wtf/text/WTFString.h:
+
+2010-08-26  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Remove the USE(GLES2_RENDERING) define and associated code
+        https://bugs.webkit.org/show_bug.cgi?id=43761
+
+        Remove WTF_USE_GLES2_RENDERING from the list of defines in chromium, it's unused.
+
+        * wtf/Platform.h:
+
+2010-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Rolling out r64608, this regressed performance.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::~LinkBuffer):
+        (JSC::LinkBuffer::performFinalization):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        (JSC::StructureStubInfo::initGetByIdProtoList):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::create):
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::poolForSize):
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::allocInternal):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        * jit/JITStubs.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/ExceptionHelpers.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+
+2010-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Bug 44655 - Add debug only convenience methods to obtain a Vector<char> from a String/StringImpl.
+
+        * wtf/text/WTFString.cpp:
+        (asciiDebug):
+            Return a Vector<char> containing the contents of a string as ASCII.
+
+2010-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add PassOwnArrayPtr
+        https://bugs.webkit.org/show_bug.cgi?id=44627
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add the new files.
+
+        * wtf/Forward.h:
+        Forward declare PassOwnArrayPtr.
+        
+        * wtf/OwnArrayPtr.h:
+        Mimic the OwnPtr interface.
+
+        * wtf/OwnArrayPtrCommon.h: Added.
+        (WTF::deleteOwnedArrayPtr):
+        Move delete function here so it can be shared by OwnArrayPtr and
+        PassOwnArrayPtr.
+
+        * wtf/PassOwnArrayPtr.h: Added.
+        Mimic the PassOwnPtr interface.
+
+2010-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [JSC] JavaScript parsing error when loading Equifax web page
+        https://bugs.webkit.org/show_bug.cgi?id=42900
+
+        '-->' is ostensibly only meant to occur when there is only
+        whitespace preceeding it on the line.  However firefox treats
+        multiline comments as a space character, so they are allowed.
+        One side effect of the firefox model is that any line terminators
+        inside the multiline comment are ignored, so
+
+            foo/*
+            */-->
+
+        is treated as
+
+            foo -->
+
+        and so '-->' will not be a comment in this case.  Happily this simply
+        means that to fix this issue all we need to do is stop updating
+        m_atLineStart when handling multiline comments.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+
+2010-08-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Improve overflow handling in StringImpl::Replace
+        https://bugs.webkit.org/show_bug.cgi?id=42502
+        <rdar://problem/8203794>
+
+        Harden StringImpl::replace against overflow -- I can't see how this
+        could be abused, but it's better to be safe than sorry.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::replace):
+
+2010-08-26  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] The GNUmakefile.am files contain a myriad of confusing preprocessor and compiler flag definitions
+        https://bugs.webkit.org/show_bug.cgi?id=44624
+
+        Clean up GNUmakefile.am.
+
+        * GNUmakefile.am: Alphabetize the include order in javascriptcore_cppflags. Move
+        a couple include lines from the top-level GNUmakefile.am.
+
+2010-08-25  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Kent Tamura.
+
+        Local variables 'k' and 'y' in s2b() in dtoa.cpp are computed but not used
+        https://bugs.webkit.org/show_bug.cgi?id=29259
+
+        Remove unused code in dtoa.cpp, spotted by Wan-Teh Chang.
+
+        * wtf/dtoa.cpp:
+        (WTF::s2b):
+
+2010-08-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kevin Ollivier.
+
+        [BREWMP] Add build system
+        https://bugs.webkit.org/show_bug.cgi?id=44645
+
+        Make waf script portable so that we can add more ports.
+
+        * wscript:
+
+2010-08-25  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the single entry regular expression cache introduced as part of
+        the fix for https://bugs.webkit.org/show_bug.cgi?id=41238.
+        The performance problem in Dromaeo that initiated that bug is no 
+        longer present. Dromaeo has been modified so that the regular
+        expression tests are somewhat random and don't benefit from a
+        single entry cache.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+
+2010-08-25  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Cairo and EFL port shouldn't depend on glib.
+        https://bugs.webkit.org/show_bug.cgi?id=44354
+
+        Replace GRefPtr with PlatformRefPtr. Keep GLib specific bits in
+        GRefPtr.h.
+
+        * GNUmakefile.am: Add PlatformRefPtr.h to the source list.
+        * wtf/PlatformRefPtr.h: Migrated from GRefPtr.h.
+        (WTF::PlatformRefPtr::PlatformRefPtr): Ditto.
+        (WTF::PlatformRefPtr::~PlatformRefPtr): Ditto.
+        (WTF::PlatformRefPtr::clear): Ditto.
+        (WTF::PlatformRefPtr::get): Ditto.
+        (WTF::PlatformRefPtr::operator*): Ditto.
+        (WTF::PlatformRefPtr::operator->): Ditto.
+        (WTF::PlatformRefPtr::operator!): Ditto.
+        (WTF::PlatformRefPtr::operator UnspecifiedBoolType): Ditto.
+        (WTF::PlatformRefPtr::hashTableDeletedValue): Ditto.
+        (WTF::::operator): Ditto.
+        (WTF::::swap): Ditto.
+        (WTF::swap): Ditto.
+        (WTF::operator==): Ditto.
+        (WTF::operator!=): Ditto.
+        (WTF::static_pointer_cast): Ditto.
+        (WTF::const_pointer_cast): Ditto.
+        (WTF::getPtr): Ditto.
+        (WTF::adoptPlatformRef): Ditto.
+        * wtf/gobject/GRefPtr.cpp: Changes to reflect new names.
+        (WTF::refPlatformPtr):
+        (WTF::derefPlatformPtr):
+        * wtf/gobject/GRefPtr.h: Ditto.
+        (WTF::refPlatformPtr):
+        (WTF::derefPlatformPtr):
+
+2010-08-25  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove dead code in JSGlobalObject
+        https://bugs.webkit.org/show_bug.cgi?id=44615
+
+        The recursion data member in the JSGlobalObject and its getter
+        plus inc/dec methods seems to be unused, remove them.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+
+2010-08-25  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Changed the initial and subsequent allocation of vector storage to
+        Array()s. The changes are to limit sparse arrays to 100000 entries
+        and fixed the sparse map to vector storage conversion to use the 
+        minimum amount of memory needed to store the current number of entries.
+        These changes address https://bugs.webkit.org/show_bug.cgi?id=43707
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::getNewVectorLength):
+
+2010-08-16  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Avoid increasing required alignment of target type warning
+        https://bugs.webkit.org/show_bug.cgi?id=43963
+
+        Fix platform independent alignment warnings.
+
+        * wtf/ListHashSet.h:
+        (WTF::ListHashSetNodeAllocator::pool):
+
+2010-08-19  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Enable truncated floating point feature on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=44233
+
+        Enable truncated floating point feature with the help of VCVTR.S32.F64
+        instruction. If VCVTR.S32.F64 can't fit the result into a 32-bit
+        integer/register, it saturates at INT_MAX or INT_MIN. Testing this
+        looks quicker than testing FPSCR for exception.
+
+        Inspired by Jacob Bramley's patch from JaegerMonkey
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::cmn_r):
+        (JSC::ARMAssembler::vcvtr_s32_f64_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
+
+2010-08-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DecimalNumber.h:
+        (WTF::DecimalNumber::intPow10):
+        * wtf/dtoa.cpp:
+        * wtf/dtoa.h:
+
+2010-08-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=44487
+
+        Number.toExponential/toFixed/toPrecision all contain a spaghetti of duplicated
+        code & unnecessary complexity. Add a new DecimalNumber class to encapsulate
+        double to string conversion, share the implementations of rounding &
+        decimal-fraction/exponential formatting.
+
+        * JavaScriptCore.exp:
+            Update exports.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::toThisNumber):
+        (JSC::getIntegerArgumentInRange):
+            Helper methods used in implementing toExponential/toFixed/toString.
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+            Reimplemented using new DecimalNumber class.
+            
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+            Updated to call numberToString.
+
+        * wtf/DecimalNumber.h: Added.
+        (WTF::):
+        (WTF::DecimalNumber::DecimalNumber):
+        (WTF::DecimalNumber::toStringDecimal):
+        (WTF::DecimalNumber::toStringExponential):
+        (WTF::DecimalNumber::sign):
+        (WTF::DecimalNumber::exponent):
+        (WTF::DecimalNumber::significand):
+        (WTF::DecimalNumber::precision):
+        (WTF::DecimalNumber::init):
+        (WTF::DecimalNumber::isZero):
+        (WTF::DecimalNumber::roundToPrecision):
+            New class to perform double to string conversion.
+            Has three constructors, which allow conversion with no rounding,
+            rounding to significant-figures, or rounding to decimal-places,
+            and two methods for formatting strings, either using decimal
+            fraction or exponential encoding. Internal implementation uses
+            pre-rounding of the values before calling dtoa rather than
+            relying on dtoa to correctly round, which does not produce
+            fully accurate results. Hopefully we can address this in the
+            near future.
+
+        * wtf/dtoa.cpp:
+        (WTF::intPow10):
+        * wtf/dtoa.h:
+            intPow10 is used internally by DecimalNumber.
+            
+        * wtf/text/WTFString.cpp:
+        (WTF::copyToString):
+        (WTF::nanOrInfToString):
+            Used internally in numberToString for NaN/Infinity handling.
+        (WTF::numberToString):
+            Added new method to convert doubles to strings.
+
+        * wtf/text/WTFString.h:
+            Added declaration for numberToString. This is here because
+            we should switch over to using this for all double to string
+            conversion in WebCore (see section 2.4.4.3 of the HTML5 spec).
+
+2010-08-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Don't seed the JS random number generator from time()
+        https://bugs.webkit.org/show_bug.cgi?id=41868
+        <rdar://problem/8171025>
+
+        Switch to using the secure random number generator to
+        seed the fast random generator, and make the generator
+        be per global object.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::weakRandomNumber):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRandom):
+
+2010-08-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Make overflow guards in UString::utf8 explicit
+        https://bugs.webkit.org/show_bug.cgi?id=44540
+
+        Add an explicit overflow check prior to allocating our buffer,
+        rather than implicitly relying on the guard in convertUTF16ToUTF8.
+
+        * runtime/UString.cpp:
+        (JSC::UString::utf8):
+
+2010-08-24  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Symbian] Fix commit/decommit of system memory using RChunk
+
+        Swap accidentially reversed start and m_base values for determining the
+        offset within the RChunk.
+
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::systemCommit):
+        (WTF::PageReservation::systemDecommit):
+
+2010-08-23  Patrick Gansterer  <paroga@paroga.com>
+
+        Rubber-stamped by Gabor Loki.
+
+        [WINCE] Buildfix for GeneratedJITStubs after r64818
+        https://bugs.webkit.org/show_bug.cgi?id=44469
+
+        Use " THUNK_RETURN_ADDRESS_OFFSET" instead of "#offset#".
+
+        * jit/JITStubs.cpp:
+
+2010-08-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        [REGRESSION] Interpreter incorrectly excludes prototype chain when validating put_by_id_transition
+        https://bugs.webkit.org/show_bug.cgi?id=44240
+        <rdar://problem/8328995>
+
+        Fix an error I introduced when cleaning up the interpreter side of the logic
+        to prevent setters being called in object initialisers.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-08-23  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed case where a single character search string in a string.replace()
+        did not properly handle back reference replacement.  The fix is to 
+        check for a '$' as part of the check to see if we can execute the
+        single character replace optimization.
+        https://bugs.webkit.org/show_bug.cgi?id=44067
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2010-08-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JSON.stringify is much slower than Firefox on particular pathological input
+        https://bugs.webkit.org/show_bug.cgi?id=44456
+
+        Make StringBuilder::reserveCapacity reserve additional space so we don't end up
+        repeatedly copying the entire result string.
+
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::append):
+        (JSC::StringBuilder::reserveCapacity):
+
+2010-08-23  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Handle blob resource.
+        https://bugs.webkit.org/show_bug.cgi?id=43941
+
+        * JavaScriptCore.exp: Add an export that is neede by BlobResourceHandle.
+
+2010-08-19  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        JSC: Move the static_cast into to(U)Int32 fast case
+        https://bugs.webkit.org/show_bug.cgi?id=44037
+
+        Do the static_cast<(u)int32_t> inline to avoid the function call overhead
+        for easily converted values (within (u)int32_t range.)
+
+        * runtime/JSValue.cpp:
+        (JSC::toInt32SlowCase):
+        (JSC::toUInt32SlowCase):
+        * runtime/JSValue.h:
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+
+2010-08-18  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        REGRESSION(r58469): Math.pow() always returns double-backed JSValue which is extremely slow as array subscript
+        https://bugs.webkit.org/show_bug.cgi?id=43742
+
+        Add codegen for pow() to return Int32 values when possible.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::powThunkGenerator):
+
+2010-08-18  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        The JITStackFrame is wrong using Thumb-2 JIT with JSVALUE32_64
+        https://bugs.webkit.org/show_bug.cgi?id=43897
+
+        A 64 bits wide member in a structure is aligned to 8 bytes on ARM by
+        default, but this is not taken into account in the offset defines of
+        JITStackFrame.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2010-08-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Rename UString::substr to substringSharingImpl, add to WTF::String.
+        Now WTF::String can do everything that JSC::UString can do!
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::escapeQuotes):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::substitute):
+        * parser/SourceProvider.h:
+        (JSC::UStringSourceProvider::getRange):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::indent):
+        (JSC::Stringifier::unindent):
+        * runtime/JSString.cpp:
+        (JSC::JSString::replaceCharacter):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::trimString):
+        * runtime/UString.cpp:
+        (JSC::UString::substringSharingImpl):
+        * runtime/UString.h:
+        * wtf/text/WTFString.cpp:
+        (WTF::String::substringSharingImpl):
+        * wtf/text/WTFString.h:
+
+2010-08-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-08-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-08-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 44146 - Remove toDouble/toUInt32 methods from UString.
+
+        These methods all implement JavaScript language specific behaviour, and as such
+        are not suited to being on a generic string object.  They are also inefficient
+        and incorrectly used, refactor & cleanup.  Uses of these methods really divide
+        out into two cases.
+
+        ToNumber:
+        Uses of toDouble from JSString and from parseFloat are implementing ecma's
+        ToNumber conversion from strings (see ecma-262 9.3.1), so UString::toDouble
+        should largely just be moved out to a global jsToNumber function.  ToNumber is
+        capable of recognizing either decimal or hexadecimal numbers, but parseFloat
+        should only recognize decimal values.  This is currently handled by testing for
+        hexadecimal before calling toDouble, which should unnecessary - instead we can
+        just split out the two parts to the grammar into separate functions. Also,
+        strtod recognizes a set of literals (nan, inf, and infinity - all with any
+        capitalization) - which are not defined by any of the specs we are implementing.
+        To handle this we need to perform additional work in toDouble to convert the
+        unsupported cases of infinities back to NaNs.  Instead we should simply remove
+        support for this literals from strtod.  This should provide a more desirable
+        behaviour for all clients of strtod.
+
+        Indexed properties:
+        Uses of the toStrictUInt32 methods are were all converting property names to
+        indices, and all uses of toUInt32 were incorrect; in all cases we should have
+        been calling toUInt32.  This error results in some incorrect behaviour in the
+        DOM (accessing property "0 " of a NodeList should fail; it currently does not).
+        Move this method onto Identifier (our canonical property name), and make it
+        always perform a strict conversion. Add a layout test to check NodeList does
+        convert indexed property names correctly.
+
+        * JavaScriptCore.exp:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::toUInt32):
+        * runtime/Identifier.h:
+        (JSC::Identifier::toUInt32):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::deleteProperty):
+        * runtime/JSArray.h:
+        (JSC::Identifier::toArrayIndex):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertySlot):
+        (JSC::JSByteArray::getOwnPropertyDescriptor):
+        (JSC::JSByteArray::put):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::isInfinity):
+        (JSC::jsHexIntegerLiteral):
+        (JSC::jsStrDecimalLiteral):
+        (JSC::jsToNumber):
+        (JSC::parseFloat):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::put):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deleteProperty):
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        * wtf/dtoa.cpp:
+        (WTF::strtod):
+
+2010-08-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 44099 - REGRESSION(r65468): Crashes in StringImpl::find
+
+        Bug 44080 introuduced a couple of cases in which array bounds could be overrun.
+        One of these was fixed in r65493, this patch fixes the other and address the
+        concerns voiced in comment #6 by restructuring the loops to remove the code
+        dupliction without introducing an additional if check.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::find):
+        (WTF::StringImpl::findIgnoringCase):
+        (WTF::StringImpl::reverseFind):
+        (WTF::StringImpl::reverseFindIgnoringCase):
+
+2010-08-17  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Move the accelerated compositing build flag to the right place
+        https://bugs.webkit.org/show_bug.cgi?id=43882
+
+        * wtf/Platform.h:
+
+2010-08-17  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Shinichiro Hamaji.
+
+        Avoid uninitialized memory read in StringImpl::find().
+
+        REGRESSION(r65468): Crashes in StringImpl::find
+        https://bugs.webkit.org/show_bug.cgi?id=44099
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::find):
+
+2010-08-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig
+
+        Add VectorTraits to String & DefaultHash traits to UString to unify behaviour.
+
+        * runtime/UString.h:
+        (JSC::UStringHash::hash):
+        (JSC::UStringHash::equal):
+        (WTF::):
+        * wtf/text/WTFString.h:
+        (WTF::):
+
+2010-08-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig
+
+        Remove unnecessary includes from UString.h, add new includes as necessary.
+
+        * profiler/CallIdentifier.h:
+        * profiler/ProfileNode.h:
+        * runtime/DateConversion.cpp:
+        * runtime/Identifier.h:
+        (JSC::IdentifierRepHash::hash):
+        * runtime/RegExpCache.h:
+        * runtime/RegExpKey.h:
+        * runtime/UString.cpp:
+        (JSC::UString::substr):
+        * runtime/UString.h:
+        * wtf/text/WTFString.h:
+
+2010-08-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Bug 44080 - String find/reverseFind methods need tidying up
+        These methods have a couple of problems with their interface, and implementation.
+
+        These methods take and int index, and return an int - however this is problematic
+        since on 64-bit string indices may have a full 32-bit range.  This spills out into
+        surrounding code, which unsafely casts string indices from unsigned to int. Code
+        checking the result of these methods check for a mix of "== -1", "< 0", and
+        "== notFound".  Clean this up by changing these methods to take an unsigned
+        starting index, and return a size_t. with a failed match indicated by notFound.
+        reverseFind also has a special meaning for the starting index argument, in that a
+        negative index is interpreted as an offset back from the end of the string. Remove
+        this functionality, in the (1!) case where it is used we should just calculate the
+        offset by subtracting from the string's length.
+
+        The implementation has a few problems too.  The code is not in webkit style, in
+        using assorted abbreviations in variable names, and implementations of similar
+        find methods with differing argument types were unnecessarily inconsistent. When
+        find is passed const char* data the string would be handled as latin1 (zero
+        extended to UTF-16) for all characters but the first; this is sign extended.
+        Case-insensitive find is broken for unicode strings; the hashing optimization is
+        not unicode safe, and could result in false negatives.
+
+        Unify UString find methods to match String.
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::escapeQuotes):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::substitute):
+        * runtime/JSString.cpp:
+        (JSC::JSString::replaceCharacter):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExpKey.h:
+        (JSC::RegExpKey::getFlagsValue):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::substituteBackreferences):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncSplit):
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        (JSC::UString::find):
+        (JSC::UString::reverseFind):
+        * wtf/text/AtomicString.h:
+        (WTF::AtomicString::find):
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::find):
+        (WTF::StringImpl::findCaseInsensitive):
+        (WTF::StringImpl::reverseFind):
+        (WTF::StringImpl::reverseFindCaseInsensitive):
+        (WTF::StringImpl::endsWith):
+        (WTF::StringImpl::replace):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::startsWith):
+        * wtf/text/WTFString.cpp:
+        (WTF::String::split):
+        * wtf/text/WTFString.h:
+        (WTF::String::find):
+        (WTF::String::reverseFind):
+        (WTF::String::findCaseInsensitive):
+        (WTF::String::reverseFindCaseInsensitive):
+        (WTF::String::contains):
+        (WTF::find):
+        (WTF::reverseFind):
+
+2010-08-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, do not build WebCore as a convenience library as this leads to
+        errors in the Win build w/export symbols and causes problems with DOM bindings
+        debugging in gdb. 
+
+        * wscript:
+
+2010-08-16  Leandro Pereira  <leandro@profusion.mobi>
+
+        [EFL] Build fix after r65366.
+
+        * CMakeLists.txt: Use if (VAR) instead of if (${VAR}) to check if
+        they're empty.
+        * jsc/CMakeLists.txt: Ditto.
+        * wtf/CMakeLists.txt: Ditto.
+
+2010-08-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, don't build intermediate source in DerivedSources dir.
+
+        * wscript:
+
+2010-08-14  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [CMake] Add preprocessor detection for generator scripts
+        https://bugs.webkit.org/show_bug.cgi?id=43984
+
+        * CMakeLists.txt:
+
+2010-08-14  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [CMake] Set target properties only if available
+        https://bugs.webkit.org/show_bug.cgi?id=43978
+
+        * CMakeLists.txt:
+        * jsc/CMakeLists.txt:
+        * wtf/CMakeLists.txt:
+
+2010-08-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, add CString to the list of forwards.
+
+        * wtf/Forward.h:
+
+2010-08-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+        Switch String::/UString::ascii() to return a CString.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::dumpCaller):
+        * jsc.cpp:
+        (runWithScripts):
+        (runInteractive):
+        * runtime/Identifier.h:
+        (JSC::Identifier::ascii):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/UString.cpp:
+        (JSC::UString::ascii):
+        (JSC::UString::latin1):
+        * runtime/UString.h:
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::asciiOLD):
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.cpp:
+        (WTF::String::ascii):
+        (WTF::String::latin1):
+        * wtf/text/WTFString.h:
+
+2010-08-13  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Avoid increasing required alignment of target type warning on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=38045
+
+        The reinterpret_cast<Type1*>([pointer to Type2]) expressions - where
+        sizeof(Type1) > sizeof(Type2) - cause the following warning on ARM:
+        increases required alignment of target type warnings.
+        Casting the type of [pointer to Type2] object to void* bypasses the
+        warning.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putShortUnchecked):
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt64Unchecked):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+        * jit/JITStubs.cpp:
+        * pcre/pcre_compile.cpp:
+        (jsRegExpCompile):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::increaseVectorPrefixLength):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        * wtf/FastMalloc.cpp:
+        (WTF::PageHeapAllocator::New):
+        (WTF::TCMalloc_Central_FreeList::Populate):
+        * wtf/MD5.cpp:
+        (WTF::reverseBytes):
+        (WTF::MD5::addBytes):
+        (WTF::MD5::checksum):
+        * wtf/StdLibExtras.h:
+        (isPointerTypeAlignmentOkay):
+        (reinterpret_cast_ptr):
+        * wtf/Vector.h:
+        (WTF::VectorBuffer::inlineBuffer):
+        * wtf/qt/StringQt.cpp:
+        (WTF::String::String):
+
+2010-08-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Unify UString::UTF8String() & String::utf8() methods,
+        remove UString::cost() & make atArrayIndex a free function.
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpName):
+        (JSC::printGlobalResolveInfo):
+        (JSC::printStructureStubInfo):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (runInteractive):
+        (fillBufferWithContentsOfFile):
+        * pcre/pcre_exec.cpp:
+        (Histogram::~Histogram):
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::c_str):
+        * profiler/Profile.cpp:
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintData):
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/Identifier.h:
+        (JSC::Identifier::toStrictUInt32):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::deleteProperty):
+        * runtime/JSArray.h:
+        (JSC::toArrayIndex):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::parseInt):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        * runtime/UString.cpp:
+        (JSC::UString::toDouble):
+        (JSC::putUTF8Triple):
+        (JSC::UString::utf8):
+        * runtime/UString.h:
+        (JSC::UString::~UString):
+        (JSC::UString::isNull):
+        (JSC::UString::isEmpty):
+        (JSC::UString::impl):
+        * wtf/text/WTFString.cpp:
+        (WTF::String::utf8):
+        * wtf/text/WTFString.h:
+        (WTF::String::~String):
+        (WTF::String::swap):
+        (WTF::String::isNull):
+        (WTF::String::isEmpty):
+        (WTF::String::impl):
+        (WTF::String::length):
+        (WTF::String::String):
+        (WTF::String::isHashTableDeletedValue):
+
+2010-08-12  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Refactoring the fpu code generator for the ARM port
+        https://bugs.webkit.org/show_bug.cgi?id=43842
+
+        Support up to 32 double precision registers, and the
+        recent VFP instruction formats. This patch is mainly
+        a style change which keeps the current functionality.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMRegisters::):
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::emitInst):
+        (JSC::ARMAssembler::emitDoublePrecisionInst):
+        (JSC::ARMAssembler::emitSinglePrecisionInst):
+        (JSC::ARMAssembler::vadd_f64_r):
+        (JSC::ARMAssembler::vdiv_f64_r):
+        (JSC::ARMAssembler::vsub_f64_r):
+        (JSC::ARMAssembler::vmul_f64_r):
+        (JSC::ARMAssembler::vcmp_f64_r):
+        (JSC::ARMAssembler::vsqrt_f64_r):
+        (JSC::ARMAssembler::vmov_vfp_r):
+        (JSC::ARMAssembler::vmov_arm_r):
+        (JSC::ARMAssembler::vcvt_f64_s32_r):
+        (JSC::ARMAssembler::vcvt_s32_f64_r):
+        (JSC::ARMAssembler::vmrs_apsr):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::addDouble):
+        (JSC::MacroAssemblerARM::divDouble):
+        (JSC::MacroAssemblerARM::subDouble):
+        (JSC::MacroAssemblerARM::mulDouble):
+        (JSC::MacroAssemblerARM::sqrtDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::branchDouble):
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+
+2010-08-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r65295.
+        http://trac.webkit.org/changeset/65295
+        https://bugs.webkit.org/show_bug.cgi?id=43950
+
+        It broke 4 sputnik tests (Requested by Ossy on #webkit).
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpName):
+        (JSC::printGlobalResolveInfo):
+        (JSC::printStructureStubInfo):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (runInteractive):
+        (fillBufferWithContentsOfFile):
+        * pcre/pcre_exec.cpp:
+        (Histogram::~Histogram):
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::c_str):
+        * profiler/Profile.cpp:
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintData):
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/Identifier.h:
+        (JSC::Identifier::Identifier):
+        (JSC::Identifier::toArrayIndex):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::deleteProperty):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::parseInt):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        * runtime/UString.cpp:
+        (JSC::UString::toDouble):
+        (JSC::UString::UTF8String):
+        * runtime/UString.h:
+        (JSC::UString::isNull):
+        (JSC::UString::isEmpty):
+        (JSC::UString::impl):
+        (JSC::UString::cost):
+        (JSC::UString::~UString):
+        (JSC::UString::toArrayIndex):
+        * wtf/text/WTFString.cpp:
+        (WTF::String::utf8):
+        * wtf/text/WTFString.h:
+        (WTF::String::String):
+        (WTF::String::isHashTableDeletedValue):
+        (WTF::String::length):
+        (WTF::String::operator[]):
+        (WTF::String::isNull):
+        (WTF::String::isEmpty):
+        (WTF::String::impl):
+
+2010-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Unify UString::UTF8String() & String::utf8() methods,
+        remove UString::cost() & make atArrayIndex a free function.
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpName):
+        (JSC::printGlobalResolveInfo):
+        (JSC::printStructureStubInfo):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (runInteractive):
+        (fillBufferWithContentsOfFile):
+        * pcre/pcre_exec.cpp:
+        (Histogram::~Histogram):
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::c_str):
+        * profiler/Profile.cpp:
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintData):
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/Identifier.h:
+        (JSC::Identifier::toStrictUInt32):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::deleteProperty):
+        * runtime/JSArray.h:
+        (JSC::toArrayIndex):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::parseInt):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        * runtime/UString.cpp:
+        (JSC::UString::toDouble):
+        (JSC::putUTF8Triple):
+        (JSC::UString::utf8):
+        * runtime/UString.h:
+        (JSC::UString::~UString):
+        (JSC::UString::isNull):
+        (JSC::UString::isEmpty):
+        (JSC::UString::impl):
+        * wtf/text/WTFString.cpp:
+        (WTF::String::utf8):
+        * wtf/text/WTFString.h:
+        (WTF::String::~String):
+        (WTF::String::swap):
+        (WTF::String::isNull):
+        (WTF::String::isEmpty):
+        (WTF::String::impl):
+        (WTF::String::length):
+        (WTF::String::String):
+        (WTF::String::isHashTableDeletedValue):
+
+2010-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Eeerk! - revert accidentally committed changes in UString!
+
+        * JavaScriptCore.exp:
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        * runtime/UString.h:
+
+2010-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Change UString constructors to match those in WTF::String.
+        This changes behaviour of UString((char*)0) to create null
+        strings, akin to UString() rather than UString::empty().
+        (This matches String).  Remove unused constructors from
+        UString, and add null-terminated UTF-16 constructor, to
+        match String.  Move String's constructor into the .cpp to
+        match UString.
+
+        * JavaScriptCore.exp:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * runtime/RegExpKey.h:
+        (JSC::RegExpKey::RegExpKey):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::createSingleCharacterString):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        * runtime/UString.h:
+        (JSC::UString::UString):
+        (JSC::UString::swap):
+        (JSC::UString::adopt):
+        (JSC::UString::operator[]):
+        * wtf/text/WTFString.h:
+        (WTF::String::String):
+        (WTF::String::adopt):
+        (WTF::String::operator[]):
+
+2010-08-12  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        * runtime/UString.h: Removed unneccessary #include.
+
+2010-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Revert changes to ALWAYS_INLINEness of a couple of functions in UString.
+        This appears to have degraded performance.
+
+        * runtime/UString.cpp:
+        (JSC::UString::ascii):
+        * runtime/UString.h:
+        (JSC::UString::length):
+        (JSC::UString::isEmpty):
+        (JSC::UString::~UString):
+
+2010-08-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Fix warnings: unknown conversion type character 'l' in format
+        https://bugs.webkit.org/show_bug.cgi?id=43359
+
+        Qt port doesn't call any printf in String::format(...), consequently
+        using __attribute__((format(printf,m,n))) is incorrect and causes
+        false positive warnings on Windows if you build with MinGW.
+
+        Qt port calls QString::vsprintf(...) , which is platform
+        independent, and handles %lli, %llu and %llx on all platforms.
+        (http://trac.webkit.org/changeset/35712)
+
+        * wtf/text/WTFString.h:
+
+2010-08-12  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix the array subscript is above array bounds warning in ByteArray on ARM.
+        https://bugs.webkit.org/show_bug.cgi?id=43358
+
+        The warning is very similar to this one: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37861
+
+        * wtf/ByteArray.cpp:
+        (WTF::ByteArray::create):
+
+2010-08-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Use GSettings to save/restore Web Inspector settings
+        https://bugs.webkit.org/show_bug.cgi?id=43512
+
+        * wtf/gobject/GRefPtr.cpp: Added support for GVariant, used by our
+        GSettings support.
+        (WTF::refGPtr):
+        (WTF::derefGPtr):
+        * wtf/gobject/GRefPtr.h:
+
+2010-08-12  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        The scratch register should be saved in YARR with ARM JIT
+        https://bugs.webkit.org/show_bug.cgi?id=43910
+
+        Reported by Jocelyn Turcotte.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+
+2010-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Forward.h:
+
+2010-08-11  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Geoffrey Garen.
+
+        Date("") should be an invalid date. For IE, Firefox and Chrome, Date("") is invalid date,
+        which means isNaN(new Date("")) should return true.
+        https://bugs.webkit.org/show_bug.cgi?id=43793
+        Tests: fast/js/date-constructor.html
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache):
+
+2010-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows & !JIT build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+
+2010-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamp by sam weinig
+
+        Touch a file to stop the bot rolling a bit change out!
+
+        * runtime/UString.cpp:
+        (JSC::UString::ascii):
+
+2010-08-11  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix for wx and WebDOM bindings, add CString classes to the list of forwards.
+
+        * wtf/Forward.h:
+
+2010-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamps by Darin Adler & Sam Weinig.
+
+        Bug 43867 - Some UString cleanup
+
+        Change JSC::UString data(), size(), and from(), to characters(), length(), and number() to match WTF::String.
+        Move string concatenation methods to a new header to simplify down UString.h.  Remove is8Bit().
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClass::className):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::create):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpName):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::processClauseList):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createRegex):
+        * parser/ParserArena.h:
+        (JSC::IdentifierArena::makeNumericIdentifier):
+        * parser/SourceProvider.h:
+        (JSC::UStringSourceProvider::data):
+        (JSC::UStringSourceProvider::length):
+        * profiler/Profiler.cpp:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyNames):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        * runtime/Identifier.h:
+        (JSC::Identifier::characters):
+        (JSC::Identifier::length):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::decode):
+        (JSC::parseInt):
+        (JSC::parseFloat):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toString):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::appendQuotedString):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::indent):
+        (JSC::Stringifier::unindent):
+        (JSC::Walker::walk):
+        * runtime/JSString.cpp:
+        (JSC::JSString::replaceCharacter):
+        (JSC::JSString::getIndexSlowCase):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::RopeBuilder::fiberCount):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsNontrivialString):
+        (JSC::JSString::getIndex):
+        (JSC::jsString):
+        (JSC::jsStringWithFinalizer):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::append):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::Lexer::Lexer):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/NumericStrings.h:
+        (JSC::NumericStrings::add):
+        (JSC::NumericStrings::lookupSmallString):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getRightContext):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::append):
+        * runtime/StringConcatenate.h: Copied from JavaScriptCore/runtime/UString.h.
+        (JSC::):
+        (JSC::sumWithOverflow):
+        (JSC::tryMakeString):
+        (JSC::makeString):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::localeCompare):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString):
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+        (JSC::UString::ascii):
+        (JSC::UString::operator[]):
+        (JSC::UString::toDouble):
+        (JSC::UString::find):
+        (JSC::UString::rfind):
+        (JSC::UString::substr):
+        (JSC::operator==):
+        (JSC::operator<):
+        (JSC::operator>):
+        (JSC::UString::UTF8String):
+        * runtime/UString.h:
+        (JSC::UString::UString):
+        (JSC::UString::adopt):
+        (JSC::UString::length):
+        (JSC::UString::characters):
+        (JSC::UString::isNull):
+        (JSC::UString::isEmpty):
+        (JSC::UString::impl):
+        (JSC::UString::cost):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::codePointCompare):
+        (JSC::UString::toArrayIndex):
+        (JSC::IdentifierRepHash::hash):
+        (WTF::):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexParser.h:
+        (JSC::Yarr::Parser::Parser):
+
+2010-08-11  Gabor Loki  <loki@webkit.org>
+
+        Qt build fix (ARMv7).
+
+        Fix invalid conversion from int to Condition.
+        Add ARMv7Assembler.cpp to JavaScriptCore.pro.
+
+        * JavaScriptCore.pro:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::JmpSrc::JmpSrc):
+
+2010-08-11  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        At collection time, we frequently want to mark a cell, while checking
+        whether it was originally checked.  Previously, this was a get
+        operation follwed by a set operation.  Fusing the two saves
+        computation and gives a 0.5% sunspider speedup.
+
+        * runtime/Collector.h:
+        (JSC::CollectorBitmap::getset):
+        (JSC::Heap::checkMarkCell):
+        * runtime/JSArray.h:
+        (JSC::MarkStack::drain):
+        * runtime/JSCell.h:
+        (JSC::MarkStack::append):
+
+2010-08-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Improve vsprops copying for Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=41982
+
+        When we detect a new SDK, always copy a new set of vsprops files.
+        Previously, if someone updated their SDK after updating their sources,
+        they could end up with out-of-date vsprops files.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2010-08-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add leakRef and clear to all RefPtr variants
+        https://bugs.webkit.org/show_bug.cgi?id=42389
+
+        * API/JSRetainPtr.h: Changed all uses of "template <...>" to instead do
+        "template<...>". We should probably put this in the style guide and do it
+        consitently. Fixed other minor style issues. Defined many of the inlined
+        functions outside the class definition, to avoid style checker warnings
+        about multiple statements on a single line and for slightly better clarity
+        of the class definition itself. Renamed releaseRef to leakRef. Added a
+        releaseRef that calls leakRef so we don't have to rename all callers oat
+        once. Added a clear function.
+
+        * wtf/PassRefPtr.h: Changed all uses of releaseRef to leakRef.
+n
+        * wtf/RefPtr.h: Changed all uses of "template <...>" to instead do
+        "template<...>". Tidied up declarations and comments a bit.
+         Changed all uses of releaseRef to leakRef.
+
+        * wtf/RetainPtr.h: Changed all uses of "template <...>" to instead do
+        "template<...>". Defined many of the inlined functions outside the class
+        definition, to avoid style checker warnings about multiple statements on
+        a single line and for slightly better clarity of the class definition itself.
+        Renamed releaseRef to leakRef. Added a releaseRef that calls leakRef so we
+        don't have to rename all callers at once. Added a clear function.
+
+2010-08-10  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Unreviewed, reverting an unintentional change to a file submitted in r65108.
+
+        * bytecode/CodeBlock.h:
+        (JSC::binaryChop):
+
+2010-08-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig
+
+        Bug 43817 - Remove UString::Rep
+        UString::Rep has for a long time been replaced by UStringImpl (Rep
+        remaining as a typedef).  UStringImpl has since been removed too
+        (unified with StringImpl). Remove Rep, rename rep() to impl() and
+        m_rep to m_impl.  Also add impl() method to Identifier, and rename
+        its UString member from _ustring to m_string.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::deletePrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::getOwnPropertyNames):
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        * API/JSClassRef.cpp:
+        (tryCreateStringFromUTF8):
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * API/JSClassRef.h:
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::ustring):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::offsetForValue):
+        (JSC::StringJumpTable::ctiForValue):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addParameter):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::willResolveToArguments):
+        (JSC::BytecodeGenerator::uncheckedRegisterForArguments):
+        (JSC::BytecodeGenerator::constRegisterFor):
+        (JSC::BytecodeGenerator::isLocal):
+        (JSC::BytecodeGenerator::isLocalConstant):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        (JSC::keyForCharacterSwitch):
+        (JSC::prepareJumpTableForStringSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::processClauseList):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseStrictObjectLiteral):
+        * pcre/pcre_exec.cpp:
+        (Histogram::add):
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::Hash::hash):
+        * profiler/Profile.cpp:
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * profiler/ProfileNode.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::IdentifierCStringTranslator::hash):
+        (JSC::IdentifierCStringTranslator::equal):
+        (JSC::IdentifierCStringTranslator::translate):
+        (JSC::Identifier::add):
+        (JSC::IdentifierUCharBufferTranslator::hash):
+        (JSC::IdentifierUCharBufferTranslator::equal):
+        (JSC::IdentifierUCharBufferTranslator::translate):
+        (JSC::Identifier::addSlowCase):
+        * runtime/Identifier.h:
+        (JSC::Identifier::Identifier):
+        (JSC::Identifier::ustring):
+        (JSC::Identifier::impl):
+        (JSC::Identifier::data):
+        (JSC::Identifier::size):
+        (JSC::Identifier::ascii):
+        (JSC::Identifier::isNull):
+        (JSC::Identifier::isEmpty):
+        (JSC::Identifier::toUInt32):
+        (JSC::Identifier::toStrictUInt32):
+        (JSC::Identifier::toArrayIndex):
+        (JSC::Identifier::toDouble):
+        (JSC::Identifier::equal):
+        (JSC::Identifier::add):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::displayName):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::addStaticGlobals):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        * runtime/JSString.h:
+        (JSC::):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsSubstring):
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::deleteProperty):
+        (JSC::JSVariableObject::symbolTableGet):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::symbolTableGet):
+        (JSC::JSVariableObject::symbolTablePut):
+        (JSC::JSVariableObject::symbolTablePutWithAttributes):
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::HashTable::deleteTable):
+        * runtime/Lookup.h:
+        (JSC::HashEntry::initialize):
+        (JSC::HashEntry::setKey):
+        (JSC::HashEntry::key):
+        (JSC::HashTable::entry):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::add):
+        (JSC::PropertyNameArray::addKnownUnique):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::create):
+        * runtime/RegExpKey.h:
+        (JSC::RegExpKey::RegExpKey):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::rep):
+        (JSC::SmallStrings::singleCharacterStringRep):
+        * runtime/SmallStrings.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::put):
+        (JSC::Structure::hasTransition):
+        (JSC::Structure::remove):
+        (JSC::Structure::checkConsistency):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        (JSC::Structure::hasTransition):
+        * runtime/StructureTransitionTable.h:
+        * runtime/SymbolTable.h:
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::toStrictUInt32):
+        (JSC::UString::substr):
+        * runtime/UString.h:
+        (JSC::UString::UString):
+        (JSC::UString::adopt):
+        (JSC::UString::data):
+        (JSC::UString::size):
+        (JSC::UString::isNull):
+        (JSC::UString::isEmpty):
+        (JSC::UString::impl):
+        (JSC::UString::cost):
+        (JSC::operator==):
+        (JSC::codePointCompare):
+        (JSC::IdentifierRepHash::hash):
+        (WTF::):
+
+2010-08-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Bug 43816 - Remove UStringImpl
+        The class was actually removed a long time ago, replaced by StringImpl.
+        UStringImpl is just a typedef onto StringImpl.  Remove this.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::replaceCharacter):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::RopeIterator::operator*):
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsSubstring):
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        * runtime/RopeImpl.cpp:
+        (JSC::RopeImpl::derefFibersNonRecursive):
+        * runtime/RopeImpl.h:
+        (JSC::RopeImpl::deref):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        * runtime/UString.h:
+        (JSC::UString::adopt):
+        (JSC::tryMakeString):
+        (JSC::makeString):
+        * runtime/UStringImpl.h: Removed.
+
+2010-08-10  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Make FastMalloc more portable.
+        https://bugs.webkit.org/show_bug.cgi?id=41790
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_Central_FreeList::Populate):
+        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+
+2010-08-10  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by David Levin.
+
+        [WINCE] Buildfix for CE 6.0
+        https://bugs.webkit.org/show_bug.cgi?id=43027
+
+        CE 6.0 doesn't define localtime in the system include files.
+
+        * wtf/Platform.h: Include ce_time.h on all OS(WINCE).
+
+2010-08-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Bug 43786 - Move AtomicStringHash from WebCore to WTF
+        Also remove deprecated string headers from WebCore/platform/text.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/AtomicString.h:
+        * wtf/text/AtomicStringHash.h: Copied from WebCore/platform/text/AtomicStringHash.h.
+
+2010-08-09  Oliver Hunt  <oliver@apple.com>
+
+        Fix Qt/ARM again, this time including the other changed file.
+
+        * jit/JIT.h:
+
+2010-08-09  Oliver Hunt  <oliver@apple.com>
+
+        Fix Qt/ARM
+
+        C++ overload resolution I stab at thee
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::endUninterruptedSequence):
+
+2010-08-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Allow an assembler/macroassembler to compact branches to more concise forms when linking
+        https://bugs.webkit.org/show_bug.cgi?id=43745
+
+        This patch makes it possible for an assembler to convert jumps into a different
+        (presumably more efficient) form at link time.  Currently implemented in the
+        ARMv7 JIT as that already had logic to delay linking of jumps until the end of
+        compilation already.  The ARMv7 JIT chooses between either a 4 byte short jump
+        or a full 32-bit offset (and rewrites ITTT instructions as appropriate), so does
+        not yet produce the most compact form possible.  The general design of the linker
+        should make it relatively simple to introduce new branch types with little effort,
+        as the linker has no knowledge of the exact form of any of the branches.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.cpp: Added.
+        (JSC::):
+          Record jump sizes
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
+        (JSC::ARMv7Assembler::LinkRecord::from):
+        (JSC::ARMv7Assembler::LinkRecord::setFrom):
+        (JSC::ARMv7Assembler::LinkRecord::to):
+        (JSC::ARMv7Assembler::LinkRecord::type):
+        (JSC::ARMv7Assembler::LinkRecord::linkType):
+        (JSC::ARMv7Assembler::LinkRecord::setLinkType):
+          Encapsulate LinkRecord fields so we can compress the values somewhat
+
+        (JSC::ARMv7Assembler::JmpSrc::JmpSrc):
+          Need to record the jump type now
+
+        (JSC::ARMv7Assembler::b):
+        (JSC::ARMv7Assembler::blx):
+        (JSC::ARMv7Assembler::bx):
+          Need to pass the jump types
+
+        (JSC::ARMv7Assembler::executableOffsetFor):
+        (JSC::ARMv7Assembler::jumpSizeDelta):
+        (JSC::ARMv7Assembler::linkRecordSourceComparator):
+        (JSC::ARMv7Assembler::computeJumpType):
+        (JSC::ARMv7Assembler::convertJumpTo):
+        (JSC::ARMv7Assembler::recordLinkOffsets):
+        (JSC::ARMv7Assembler::jumpsToLink):
+        (JSC::ARMv7Assembler::link):
+        (JSC::ARMv7Assembler::unlinkedCode):
+          Helper functions for the linker
+
+        (JSC::ARMv7Assembler::linkJump):
+        (JSC::ARMv7Assembler::canBeShortJump):
+        (JSC::ARMv7Assembler::linkLongJump):
+        (JSC::ARMv7Assembler::linkShortJump):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+           Moving code around for the various jump linking functions
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::beginUninterruptedSequence):
+        (JSC::AbstractMacroAssembler::endUninterruptedSequence):
+          We have to track uninterrupted sequences in any assembler that compacts
+          branches as that's not something we're allowed to do in such sequences.
+          AbstractMacroAssembler has a nop version of these functions as it makes the
+          code elsewhere nicer.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::link):
+        (JSC::LinkBuffer::patch):
+        (JSC::LinkBuffer::locationOf):
+        (JSC::LinkBuffer::locationOfNearCall):
+        (JSC::LinkBuffer::returnAddressOffset):
+        (JSC::LinkBuffer::trampolineAt):
+          Updated these functions to adjust for any changed offsets in the linked code
+
+        (JSC::LinkBuffer::applyOffset):
+          A helper function to deal with the now potentially moved labels
+
+        (JSC::LinkBuffer::linkCode):
+          The new and mighty linker function
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::beginUninterruptedSequence):
+        (JSC::MacroAssemblerARMv7::endUninterruptedSequence):
+        (JSC::MacroAssemblerARMv7::jumpsToLink):
+        (JSC::MacroAssemblerARMv7::unlinkedCode):
+        (JSC::MacroAssemblerARMv7::computeJumpType):
+        (JSC::MacroAssemblerARMv7::convertJumpTo):
+        (JSC::MacroAssemblerARMv7::recordLinkOffsets):
+        (JSC::MacroAssemblerARMv7::jumpSizeDelta):
+        (JSC::MacroAssemblerARMv7::link):
+        (JSC::MacroAssemblerARMv7::jump):
+        (JSC::MacroAssemblerARMv7::branchMul32):
+        (JSC::MacroAssemblerARMv7::breakpoint):
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::ret):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+        (JSC::MacroAssemblerARMv7::executableOffsetFor):
+        (JSC::MacroAssemblerARMv7::inUninterruptedSequence):
+        (JSC::MacroAssemblerARMv7::makeJump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+           All branches need to pass on their type now
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::returnLastBytes):
+           We can't know ahead of time how much space will be necessary to
+           hold the linked code if we're compacting branches, this new
+           function allows us to return the unused bytes at the end of linking
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+           The JIT class now needs to take a linker offset so that recompilation
+           can generate the same jumps when using branch compaction.
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+          Update for new trampolineAt changes
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::):
+        * wtf/Platform.h:
+
+2010-08-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Qt build fix III.
+
+        * wtf/text/WTFString.h:
+
+2010-08-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Qt build fix.
+
+        * wtf/qt/StringQt.cpp:
+
+2010-08-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig
+
+        Bug 43594 - Add string forwards to Forward.h
+        This allows us to remove forward declarations for these classes from
+        WebCore/WebKit (a step in moving these class from WebCore:: to WTF::).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Forward.h:
+
+2010-08-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r64938.
+        http://trac.webkit.org/changeset/64938
+        https://bugs.webkit.org/show_bug.cgi?id=43685
+
+        Did not compile on several ports (Requested by abarth on
+        #webkit).
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::load32):
+        (JSC::MacroAssemblerX86::store32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::movl_mr):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::):
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::):
+        * jit/JIT.h:
+        * jit/JITMarkObjects.cpp: Removed.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::setupPolymorphicProtoList):
+        * wtf/Platform.h:
+
+2010-08-07  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        The JIT code contains a number of direct references to GC'd objects.
+        When we have movable objects, these references will need to be
+        updated.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::int32AtLocation):
+        (JSC::AbstractMacroAssembler::pointerAtLocation):
+        (JSC::AbstractMacroAssembler::jumpTarget):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::loadPtrWithPatch):
+            Normally, loadPtr will optimize when the register is eax.  Since
+            the slightly smaller instruction changes the offsets, it messes up
+            our ability to repatch the code.  We added this new instruction
+            that garuntees a constant size.
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::load32WithPatch):
+            Changed load32 in the same way described above.
+        (JSC::MacroAssemblerX86::load32):
+            Moved the logic to optimize laod32 from movl_mr to load32
+        (JSC::MacroAssemblerX86::store32):
+            Moved the logic to optimize store32 from movl_rm to store32
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::movl_mr):
+        (JSC::X86Assembler::int32AtLocation):
+        (JSC::X86Assembler::pointerAtLocation):
+        (JSC::X86Assembler::jumpTarget):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+            As described in StructureStubInfo.h, we needed to add additional
+            fields to both StructureStubInfo and
+            PolymorphicAccessStructureList so that we can determine the
+            structure of the JITed code at patch time.
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::markAggregate):
+            Added this function to mark the JITed code that correosponds to
+            this structure stub info.
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::):
+        * jit/JIT.h:
+        * jit/JITMarkObjects.cpp: Added.
+        (JSC::JIT::patchPrototypeStructureAddress):
+        (JSC::JIT::patchGetDirectOffset):
+        (JSC::JIT::markGetByIdProto):
+        (JSC::JIT::markGetByIdChain):
+        (JSC::JIT::markGetByIdProtoList):
+        (JSC::JIT::markPutByIdTransition):
+        (JSC::JIT::markGlobalObjectReference):
+        * jit/JITPropertyAccess.cpp:
+            Added asserts for the patch offsets.
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::setupPolymorphicProtoList):
+        * wtf/Platform.h:
+            Added ENABLE_MOVABLE_GC_OBJECTS flag
+
+2010-08-07  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Revert JSArray to point to the beginning of the contained ArrayStorage
+        struct.  This is described in
+        https://bugs.webkit.org/show_bug.cgi?id=43526.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::~JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::getNewVectorLength):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::increaseVectorPrefixLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::length):
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+
+2010-08-07  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE(YARR) guard around JSGlobalData::m_regexAllocator
+        https://bugs.webkit.org/show_bug.cgi?id=43399
+
+        m_regexAllocator is used only by RegExp::compile which is guarded with ENABLE(YARR).
+
+        * runtime/JSGlobalData.h:
+
+2010-08-07  Patrick Roland Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Enable JIT on WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=43303
+
+        Add ExtraCompiler for generating GeneratedJITStubs_MSVC.asm.
+
+        * DerivedSources.pro:
+
+2010-08-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Created a separate SimpleFontData constructor exclusively for SVG fonts and moved the CTFontRef
+        from SimpleFontData to FontPlatformData.
+        https://bugs.webkit.org/show_bug.cgi?id=43674
+
+        * wtf/Platform.h: Moved definitions of WTF_USE_CORE_TEXT and WTF_USE_ATSUI here from WebCore/config.h.
+
+2010-08-07  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bitmap.h has no default constructor
+        https://bugs.webkit.org/show_bug.cgi?id=43619
+
+        Without a constructor, the initial bits of the Bitmap class
+        are undefinied. If only a few, or zero bits are 0, the memory
+        area provided by AlignedMemoryAllocator can be easly exhausted.
+
+        Csaba Osztrogonác helped to find this bug.
+
+        * wtf/Bitmap.h:
+        (WTF::::Bitmap):
+
+2010-08-06  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        [EFL] Build fix.
+
+        * CMakeLists.txt: add runtime/CGHandle.cpp.
+
+2010-08-06  Jessie Berlin  <jberlin@apple.com>
+
+        Roll out http://trac.webkit.org/changeset/64801, which broke the Safari Windows Build.
+        Unreviewed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Forward.h:
+
+2010-08-06  Jessie Berlin  <jberlin@apple.com>
+
+        Windows Build Fix (continued). Unreviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-06  Jessie Berlin  <jberlin@apple.com>
+
+        Windows Build Fix. Unreviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Add GCHandle.h and GCHandle.cpp.
+
+2010-08-06  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43207
+
+        WeakGCPtr's should instead of directly pointing to the GC'd object
+        should be directed to an array of pointers that can be updated for
+        movable objects.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::updateWeakGCHandles):
+        (JSC::WeakGCHandlePool::update):
+        (JSC::Heap::addWeakGCHandle):
+        (JSC::Heap::markRoots):
+        * runtime/Collector.h:
+        (JSC::Heap::weakGCHandlePool):
+        * runtime/GCHandle.cpp: Added.
+        (JSC::WeakGCHandle::pool):
+        (JSC::WeakGCHandlePool::WeakGCHandlePool):
+        (JSC::WeakGCHandlePool::allocate):
+        (JSC::WeakGCHandlePool::free):
+        (JSC::WeakGCHandlePool::operator new):
+        * runtime/GCHandle.h: Added.
+        (JSC::WeakGCHandle::isValidPtr):
+        (JSC::WeakGCHandle::isPtr):
+        (JSC::WeakGCHandle::isNext):
+        (JSC::WeakGCHandle::invalidate):
+        (JSC::WeakGCHandle::get):
+        (JSC::WeakGCHandle::set):
+        (JSC::WeakGCHandle::getNextInFreeList):
+        (JSC::WeakGCHandle::setNextInFreeList):
+        (JSC::WeakGCHandlePool::isFull):
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::~WeakGCPtr):
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::clear):
+        (JSC::WeakGCPtr::assign):
+        (JSC::get):
+
+2010-08-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Fix warnings about difference in symbol visiblity on Mac OS X
+
+        * jsc.pro:
+
+2010-08-06  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Refactor identifier parsing in lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41845
+
+        The code is refactored to avoid gotos. The new code
+        has the same performance as the old one.
+
+        SunSpider --parse-only: no change (from 34.0ms to 33.6ms)
+        SunSpider: no change (from 523.2ms to 523.5ms)
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseIdent):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+
+2010-08-06  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        The ARM JIT does not support JSValue32_64 with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=43411
+
+        JSValue32_64 is enabled for RVCT by default.
+
+        * create_jit_stubs:
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
+        * wtf/Platform.h:
+
+2010-08-05  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Darin Adler.
+
+        Define WTF_USE_ARENA_ALLOC_ALIGNMENT_INTEGER for MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=43514
+
+        MIPS needs to define WTF_USE_ARENA_ALLOC_ALIGNMENT_INTEGER, so that
+        RenderArena::allocate() can return 8-byte aligned memory to avoid
+        exceptions on sdc1/ldc1.
+
+        * wtf/Platform.h:
+
+2010-08-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig
+
+        Bug 43594 - Add string forwards to Forward.h
+        This allows us to remove forward declarations for these classes from
+        WebCore/WebKit (a step in moving these class from WebCore:: to WTF::).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Forward.h:
+
+2010-08-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed leak seen on buildbot.
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::operator()): Make out timer a RetainPtr,
+        since anything less would be uncivilized.
+
+2010-08-05  Andy Estes  <aestes@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Rename iOS-related OS and PLATFORM macros.
+        https://bugs.webkit.org/show_bug.cgi?id=43493
+        
+        Rename WTF_OS_IPHONE_OS to WTF_OS_IOS, WTF_PLATFORM_IPHONE to
+        WTF_PLATFORM_IOS, and WTF_PLATFORM_IPHONE_SIMULATOR to
+        WTF_PLATFORM_IOS_SIMULATOR.
+
+        * jit/ExecutableAllocator.h:
+        * jit/JITStubs.cpp:
+        * profiler/ProfilerServer.mm:
+        (-[ProfilerServer init]):
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::):
+        * wtf/Platform.h:
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault):
+
+2010-08-05  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43464
+
+        Currently, the global object is being embedded in the JavaScriptCore
+        bytecode, however since the global object is the same for all opcodes
+        in a code block, we can have the global object just be a member of the
+        associated code block.
+
+        Additionally, I added an assert inside of emitOpcode that verifies
+        that the last generated opcode was of the correct length.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        * bytecode/Opcode.h:
+        (JSC::opcodeLength):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitOpcode):
+            Added an assert to check that the last generated opcode is the
+            correct length.
+        (JSC::BytecodeGenerator::rewindBinaryOp):
+            Changed the last opcode to op_end since the length will no longer
+            be correct.
+        (JSC::BytecodeGenerator::rewindUnaryOp):
+            Changed the last opcode to op_end since the length will no longer
+            be correct.
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitPutScopedVar):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_global_dynamic):
+        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        * jit/JITStubs.cpp:
+        (JSC::cti_op_resolve_global):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+
+2010-08-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 43185 - Switch RegisterFile over to use PageAllocation
+
+        Remove platform-specific memory allocation code.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        (JSC::RegisterFile::releaseExcessCapacity):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+        (JSC::RegisterFile::checkAllocatedOkay):
+        * wtf/PageAllocation.cpp:
+        (WTF::PageAllocation::lastError):
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::allocate):
+        (WTF::PageAllocation::allocateAt):
+        (WTF::PageAllocation::allocateAligned):
+        (WTF::PageAllocation::pageSize):
+        (WTF::PageAllocation::isPageAligned):
+        (WTF::PageAllocation::isPowerOfTwo):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::reserve):
+        (WTF::PageReservation::reserveAt):
+
+2010-08-05  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=43401 where array 
+        content aren't properly initialized as part of unshift.  
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCount):
+
+2010-08-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Unify blob related feature defines to ENABLE(BLOB).
+        https://bugs.webkit.org/show_bug.cgi?id=43081
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-08-05  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Remove GHashTable left-overs. GHashTable is ref-counted, and is
+        correctly supported by GRefPtr.
+
+        * wtf/gobject/GOwnPtr.h:
+
+2010-08-05  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed.
+
+        Typo fix that makes distcheck happy.
+
+        * GNUmakefile.am:
+
+2010-08-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43461
+        Invalid NaN parsing
+        
+        * wtf/dtoa.cpp: Turn off the dtoa feature that allows you to specify a
+        non-standard NaN representation, since our NaN encoding assumes that all
+        true NaNs have the standard bit pattern.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber): Don't allow an API client to accidentally specify
+        a non-standard NaN either.
+
+2010-08-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix part II.
+
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::systemReserve):
+
+2010-08-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::systemReserve):
+
+2010-08-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix - add new header to !Mac projects.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2010-08-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 43515 - Fix small design issues with PageAllocation, split out PageReservation.
+
+        The PageAllocation class has a number of issues:
+        * Changes in bug #43269 accidentally switched SYMBIAN over to use malloc/free to allocate
+          blocks of memory for the GC heap, instead of allocating RChunks.  Revert this change in
+          behaviour.
+        * In order for PageAllocation to work correctly on WinCE we should be decommitting memory
+          before deallocating.  In order to simplify understanding the expected state at deallocate,
+          split behaviour out into PageAllocation and PageReservation classes.  Require that all
+          memory be decommitted before calling deallocate on a PageReservation, add asserts to
+          enforce this.
+        * add many missing asserts.
+        * inline more functions.
+        * remove ability to create sub-PageAllocations from an existing PageAllocations object -
+          this presented an interface that would allow sub regions to be deallocated, which would
+          not have provided expected behaviour.
+        * remove writable/executable arguments to commit, this value can be cached at the point
+          the memory is reserved.
+        * remove writable/executable arguments to allocateAligned, protection other than RW is not
+          supported.
+        * add missing checks for overflow & failed allocation to mmap path through allocateAligned.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::Allocation::Allocation):
+        (JSC::ExecutablePool::Allocation::base):
+        (JSC::ExecutablePool::Allocation::size):
+        (JSC::ExecutablePool::Allocation::operator!):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::allocInternal):
+        * runtime/AlignedMemoryAllocator.h:
+        (JSC::::allocate):
+        (JSC::::AlignedMemoryAllocator):
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        * runtime/Collector.h:
+        * wtf/PageAllocation.cpp:
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::operator!):
+        (WTF::PageAllocation::allocate):
+        (WTF::PageAllocation::allocateAt):
+        (WTF::PageAllocation::allocateAligned):
+        (WTF::PageAllocation::deallocate):
+        (WTF::PageAllocation::pageSize):
+        (WTF::PageAllocation::systemAllocate):
+        (WTF::PageAllocation::systemAllocateAt):
+        (WTF::PageAllocation::systemAllocateAligned):
+        (WTF::PageAllocation::systemDeallocate):
+        (WTF::PageAllocation::systemPageSize):
+        * wtf/PageReservation.h: Copied from JavaScriptCore/wtf/PageAllocation.h.
+        (WTF::PageReservation::PageReservation):
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::reserve):
+        (WTF::PageReservation::reserveAt):
+        (WTF::PageReservation::deallocate):
+        (WTF::PageReservation::systemCommit):
+        (WTF::PageReservation::systemDecommit):
+        (WTF::PageReservation::systemReserve):
+        (WTF::PageReservation::systemReserveAt):
+        * wtf/Platform.h:
+
+2010-08-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r64655.
+        http://trac.webkit.org/changeset/64655
+        https://bugs.webkit.org/show_bug.cgi?id=43496
+
+        JavaScriptCore references patch seems to have caused
+        regressions in QT and GTK builds (Requested by nlawrence on
+        #webkit).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+        * runtime/JSCell.h:
+        (JSC::JSValue::asCell):
+        (JSC::MarkStack::append):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        * runtime/JSObject.h:
+        (JSC::JSObject::prototype):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::asCell):
+        * runtime/MarkStack.h:
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeErrorConstructor.h:
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+
+2010-08-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Enable JSVALUE64 for CPU(PPC64).
+        Basic browsing seems to work.
+
+        * wtf/Platform.h:
+
+2010-08-04  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Refactoring MarkStack::append to take a reference.  This is in
+        preparation for movable objects when we will need to update pointers.
+        http://bugs.webkit.org/show_bug.cgi?id=41177
+
+        Unless otherwise noted, all changes are to either return by reference
+        or pass a reference to MarkStack::append.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+            Added a temporary variable to prevent marking from changing an
+            unknown value on the stack
+        * runtime/JSCell.h:
+        (JSC::JSValue::asCell):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::appendInternal):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        * runtime/JSObject.h:
+        (JSC::JSObject::prototype):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSValue.h:
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::asCell):
+        * runtime/MarkStack.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::createStructure):
+            Changed the structure flags to include a custom markChildren.
+        (JSC::NativeErrorConstructor::markChildren):
+            Update the prototype of the stored structure.
+        * runtime/NativeErrorConstructor.h:
+            Added structure flags.
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+
+2010-08-03  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tightened up some get_by_id_chain* code generation
+        https://bugs.webkit.org/show_bug.cgi?id=40935
+
+        This is in the style of
+        https://bugs.webkit.org/show_bug.cgi?id=30539, and changed code to
+        call accessor functions when it was not necessary to directly access
+        the private variables.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2010-08-03  Adam Roben  <aroben@apple.com>
+
+        Turn on PLATFORM_STRATEGIES on Windows
+
+        Fixes <http://webkit.org/b/43431>.
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/Platform.h:
+
+2010-08-04  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Enable JSValue32_64 for GCC on ARM by default
+        https://bugs.webkit.org/show_bug.cgi?id=43410
+
+        * wtf/Platform.h:
+
+2010-08-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative windows build fix.
+
+        * wtf/Bitmap.h:
+
+2010-08-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix following r64624.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/PageAllocation.h:
+
+2010-08-03  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43269
+
+        Added new allocateAligned methods to PageAllocation.  In order to
+        prevent a regress in performance, the function needs to be inlined.
+
+        Additionally, I ported the symbian block allocator to use
+        PageAllocation and added a new WTF::Bitmap class to support this.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/AlignedMemoryAllocator.h: Added.
+        (JSC::AlignedMemory::deallocate):
+        (JSC::AlignedMemory::base):
+        (JSC::AlignedMemory::AlignedMemory):
+        (JSC::AlignedMemoryAllocator::destroy):
+        (JSC::AlignedMemoryAllocator::allocate):
+        (JSC::AlignedMemoryAllocator::AlignedMemoryAllocator):
+        (JSC::AlignedMemoryAllocator::~AlignedMemoryAllocator):
+        (JSC::AlignedMemoryAllocator::free):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::allocate):
+        (JSC::Heap::shrinkBlocks):
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::clearMarkBits):
+        (JSC::Heap::markedCells):
+        * runtime/Collector.h:
+        (JSC::CollectorHeap::collectorBlock):
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::operator*):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::operator++):
+        * wtf/Bitmap.h: Added.
+        (WTF::Bitmap::get):
+        (WTF::Bitmap::set):
+        (WTF::Bitmap::clear):
+        (WTF::Bitmap::clearAll):
+        (WTF::Bitmap::advanceToNextFreeBit):
+        (WTF::Bitmap::count):
+        (WTF::Bitmap::isEmpty):
+        (WTF::Bitmap::isFull):
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::operator UnspecifiedBoolType):
+        (WTF::PageAllocation::allocateAligned):
+        (WTF::PageAllocation::reserveAligned):
+        * wtf/Platform.h:
+        * wtf/symbian: Removed.
+        * wtf/symbian/BlockAllocatorSymbian.cpp: Removed.
+        * wtf/symbian/BlockAllocatorSymbian.h: Removed.
+
+2010-08-03  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=43314.  The prior code
+        was using the wrong "length" value to move array contents when adding
+        space to the beginning of an array for an unshift() or similar
+        operation.  Instead of using m_vectorLength, the length of the
+        allocated JSValue array, the code was using m_length, the declared
+        length of the array.  These two values do not need to match.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::increaseVectorPrefixLength):
+
+2010-08-03  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix following https://bugs.webkit.org/show_bug.cgi?id=43089
+        (accidentally inverted a compiler version check).
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2010-08-03  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Implement DEFINE_STUB_FUNCTION for WinCE.
+        https://bugs.webkit.org/show_bug.cgi?id=34953
+
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-08-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43390 - Do not CRASH if we run out of room for jit code.
+
+        Change the ExecutableAllocator implementations not to crash, and to return 0 if memory cannot be allocated.
+        The assemblers should pass this through without trying to use it in executableCopy.
+        Change the LinkBuffer to handle this, and to provide an allocationSuccessful() method to test for this.
+
+        Change the JIT to throw an exception if allocation fails.
+        Make JIT optimizations fail gracefully if memory cannot be allocated (use non-optimized path).
+        Change YARR JIT to fallback to PCRE 
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::executableCopy):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::allocationSuccessful):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        (JSC::StructureStubInfo::initGetByIdProtoList):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::allocInternal):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::setupPolymorphicProtoList):
+        * jit/JITStubs.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createOutOfMemoryError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+
+2010-08-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a crash seen on the GTK 64bit buildbot.
+        
+        When JSArray is allocated for the vptr stealing hack, it's not allocated
+        in the heap, so the JSArray constructor can't safely call Heap::heap().
+        
+        Since this was subtle enough to confuse smart people, I've changed JSArray
+        to have an explicit vptr stealing constructor.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+
+2010-08-03  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Beth Dakin.
+
+        Changed the ENABLE_MATHML value to enable MathML by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-08-03  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Change to keep returned pointer from malloc family functions to
+        quiet memory leak detect.  The pointer is saved in the new m_allocBase
+        member of the ArrayStorage structure.  This fixes the issue found in 
+        https://bugs.webkit.org/show_bug.cgi?id=43229.
+
+        As part of this change, we use m_allocBase when reallocating and
+        freeing the memory associated with ArrayStorage.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::~JSArray):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::increaseVectorPrefixLength):
+        * runtime/JSArray.h:
+
+2010-08-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43444
+        PLATFORM(CF) is false on Windows in JavaScriptCore
+
+        Moved some PLATFORM(WIN) #defines down into JavaScriptCore.
+
+        * wtf/Platform.h: Added WTF_PLATFORM_CF 1 and WTF_USE_PTHREADS 0, inherited
+        from WebCore/config.h. Removed WTF_USE_WININET 1 since WebCore/config.h
+        just #undefined that later.
+
+2010-08-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build: Don't use GCActivityCallbackCF on Windows, since
+        PLATFORM(CF) is not defined on Windows.
+        
+        We'll need to enable the GC activity callback some other way, but this
+        change should get the build back to normal.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+        * runtime/GCActivityCallbackCF.cpp: Make it easier to detect this error
+        in the future with an explicit error message.
+
+2010-08-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build: update .def file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-03  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41318
+        GC should reclaim garbage even when new objects are not being allocated rapidly
+
+        Added a callback in JavaScriptCore that gets triggered after an
+        allocation causes the heap to reset.  This is useful for adding a
+        timer that will trigger garbage collection after the "last" allocation.
+
+        Also needed was to add lock and unlock methods to JSLock that needed
+        only a JSGlobalData object versus an ExecState object.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reset):
+        (JSC::Heap::setActivityCallback):
+        * runtime/Collector.h:
+        * runtime/GCActivityCallback.cpp: Added.
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::operator()):
+        * runtime/GCActivityCallback.h: Added.
+        (JSC::GCActivityCallback::~GCActivityCallback):
+        (JSC::GCActivityCallback::operator()):
+        (JSC::GCActivityCallback::GCActivityCallback):
+        (JSC::DefaultGCActivityCallback::create):
+        * runtime/GCActivityCallbackCF.cpp: Added.
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger):
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::operator()):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::JSLock):
+        * runtime/JSLock.h:
+
+2010-08-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix after removal of need to compile ExecutableAllocatorPosix.cpp
+
+        * wscript:
+
+2010-08-02  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [QT] build fix for symbian
+        https://bugs.webkit.org/show_bug.cgi?id=43234
+
+        1) wrong order of passing param's
+        2) static_cast complains on symbian so using reinterpret_cast
+
+        No new tests added. Just a build fix for qt symbian
+
+        * wtf/PageAllocation.cpp:
+        (WTF::PageAllocation::commit):
+        (WTF::PageAllocation::decommit):
+        (WTF::PageAllocation::reserve):
+
+2010-07-30  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Simon Fraser.
+
+        Enabling view modes to all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=37505
+
+        Removing ENABLE_WIDGETS_10_SUPPORT flag.
+
+        As view mode media feature is not part of widget 1.0 specification
+        any more the ENABLE_WIDGETS_10_SUPPORT flag may be removed. The only use
+        of this flag was related to view mode media feature implementation in Qt. 
+
+        * wtf/Platform.h:
+
+2010-07-30  Andy Estes  <aestes@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Add Xcode support for compiling WebKit against iOS SDKs.
+        https://bugs.webkit.org/show_bug.cgi?id=42796
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-07-30  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Davin Levin.
+
+        Added a yield() function.
+        https://bugs.webkit.org/show_bug.cgi?id=42843
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::yield):
+        * wtf/ThreadingWin.cpp:
+        (WTF::yield):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::yield):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::yield):
+
+2010-07-30  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Add library version and soname to EFL generated libraries and binary.
+        https://bugs.webkit.org/show_bug.cgi?id=43212
+
+        Add version and soname to libjavascriptcore.so and libwtf.so in case of
+        linking as shared libraries, and version to jsc executable.
+
+        * CMakeLists.txt:
+        * jsc/CMakeLists.txt:
+        * wtf/CMakeLists.txt:
+
+2010-07-30  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [QT] build fix for symbian
+        https://bugs.webkit.org/show_bug.cgi?id=43234
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::PageAllocation):
+
+2010-07-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r64313.
+        http://trac.webkit.org/changeset/64313
+        https://bugs.webkit.org/show_bug.cgi?id=43233
+
+        Some Chromium bots are not happy with it for some unknown
+        reason. (Requested by dumi on #webkit).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        * wtf/ThreadingWin.cpp:
+        * wtf/gtk/ThreadingGtk.cpp:
+        * wtf/qt/ThreadingQt.cpp:
+
+2010-07-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r64302.
+        http://trac.webkit.org/changeset/64302
+        https://bugs.webkit.org/show_bug.cgi?id=43223
+
+        Assertion is bogus (Requested by olliej on #webkit).
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putShortUnchecked):
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt64Unchecked):
+        * jit/JITStubs.cpp:
+        * pcre/pcre_compile.cpp:
+        (jsRegExpCompile):
+        * wtf/FastMalloc.cpp:
+        (WTF::PageHeapAllocator::New):
+        (WTF::TCMalloc_Central_FreeList::Populate):
+        * wtf/MD5.cpp:
+        (WTF::reverseBytes):
+        (WTF::MD5::addBytes):
+        (WTF::MD5::checksum):
+        * wtf/StdLibExtras.h:
+        * wtf/Vector.h:
+        (WTF::VectorBuffer::inlineBuffer):
+        * wtf/qt/StringQt.cpp:
+        (WebCore::String::String):
+
+2010-07-29  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Changed the handling for removing and adding elements at the front
+        of an array.  The code now keeps a bias that indicates the amount of
+        JSValue sized holes are prior to the ArrayStorage block.  This means
+        that shift operations are now memmove's of the header part of
+        the ArrayStorage and unshift operations are similar, but may require a
+        realloc first to create the space.  Similar operations are performed
+        for special cases of splice and slice.
+        Also optimized the new Array(size) case so that we don't allocate and
+        initialize array elements until the JS code starts using elements.
+        The array growth code is slightly more aggressive for initial growth
+        based on size growth of any previous array.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::~JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::getNewVectorLength):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::increaseVectorPrefixLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::length):
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::arrayStorage):
+        (JSC::JSArray::setArrayStorage):
+        (JSC::JSArray::markChildrenDirect):
+
+2010-07-29  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Changed MINIMUM_CELL_SIZE to be fixed at 64 bytes.
+
+        * runtime/Collector.h:
+
+2010-07-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by David Levin.
+
+        Added a yield() function.
+        https://bugs.webkit.org/show_bug.cgi?id=42843
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::yield):
+        * wtf/ThreadingWin.cpp:
+        (WTF::yield):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::yield):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::yield):
+
+2010-07-29  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed issue where RegExp greedy jit code loops when no input is
+        consumed.  Changed the code to only loop if some input was consumed,
+        but fall through if we successfully match an alternative that 
+        doesn't consume any input.
+        https://bugs.webkit.org/show_bug.cgi?id=42664
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
+
+2010-07-29  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Avoid increasing required alignment of target type warning on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=38045
+
+        The reinterpret_cast<Type1*>([pointer to Type2]) expressions - where
+        sizeof(Type1) > sizeof(Type2) - cause the following warning on ARM:
+        increases required alignment of target type warnings.
+        Casting the type of [pointer to Type2] object to void* bypasses the
+        warning.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putShortUnchecked):
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt64Unchecked):
+        * jit/JITStubs.cpp:
+        * pcre/pcre_compile.cpp:
+        (jsRegExpCompile):
+        * wtf/FastMalloc.cpp:
+        (WTF::PageHeapAllocator::New):
+        (WTF::TCMalloc_Central_FreeList::Populate):
+        * wtf/MD5.cpp:
+        (WTF::reverseBytes):
+        (WTF::MD5::addBytes):
+        (WTF::MD5::checksum):
+        * wtf/StdLibExtras.h:
+        (reinterpret_cast_ptr):
+        * wtf/Vector.h:
+        (WTF::VectorBuffer::inlineBuffer):
+        * wtf/qt/StringQt.cpp:
+        (WebCore::String::String):
+
+2010-07-29  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed build fix.
+
+        Include a missing header in the source list to fix 'make dist.'
+
+        * GNUmakefile.am: Include missing header.
+
+2010-07-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 43162 - Add support for MADV_FREE to PageAllocation.
+
+        * wtf/PageAllocation.cpp:
+        (WTF::PageAllocation::commit):
+        (WTF::PageAllocation::decommit):
+
+2010-07-27  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        Add FILE_SYSTEM build flag for FileSystem API
+        https://bugs.webkit.org/show_bug.cgi?id=42915
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Temporarily rolling out http://trac.webkit.org/changeset/64177,
+        this seems to give QT ARM/Win a headache (specifically, looks
+        like structure layour differs, objects get too large - 
+        "..\..\..\JavaScriptCore\runtime\ArrayPrototype.cpp:41:"
+        "error: size of array 'dummyclass_fits_in_cell' is negative").
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        * runtime/JSArray.cpp:
+        (JSC::increasedVectorLength):
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::~JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::length):
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+
+2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative build fix for Chromium/Win
+
+        * wtf/Platform.h:
+
+2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Oh! that makes more sense!  Maybe C++-style comments are bringing teh bad mojo.
+
+        * wtf/Platform.h:
+
+2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative build fix for GTK/64 ... seems to be barfing on a comment o_O
+
+        * wtf/Platform.h:
+
+2010-07-27  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Changed the handling for removing and adding elements at the front
+        of an array.  The code now keeps a bias that indicates the amount of
+        JSValue sized holes are prior to the ArrayStorage block.  This means
+        that shift operations are now memmove's of the header part of
+        the ArrayStorage and unshift operations are similar, but may require a
+        realloc first to create the space.  Similar operations are performed
+        for special cases of splice and slice.
+        Also optimized the new Array(size) case so that we don't allocate and
+        initialize array elements until the JS code starts using elements.
+        The array growth code is slightly more aggressive for initial growth
+        based on size growth of any previous array.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::~JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::getNewVectorLength):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::increaseVectorPrefixLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::length):
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::arrayStorage):
+        (JSC::JSArray::setArrayStorage):
+        (JSC::JSArray::markChildrenDirect):
+
+2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43089 - Cleanup JIT related switched in Platform.h
+
+        The code the enable to JIT checks every permutation of platform & OS individually, but
+        now the JIT is enabled on the majority much all x86/x86-64/ARM/MIPS systems.  It should
+        be cleaner to just enable by default on these platforms, and explicitly disable on configs
+        that don't aren't supported.
+
+        Also, rename ENABLE_JIT_OPTIMIZE_MOD to ENABLE_JIT_USE_SOFT_MODULO.  I always find this
+        confusing since enabling this "optimization" would be possible, but would be a regression
+        on x86/x86-64 systems!  I think it's clearer to reserve "JIT_OPTIMIZE" for compiler
+        technologies applicable to all platforms, and make a more optional behaviour like this a
+        "USE".
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * wtf/Platform.h:
+
+2010-07-27  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Make PLATFORM(CHROMIUM) and not OS(MAC) turn USE(GLES2_RENDERING) on
+        https://bugs.webkit.org/show_bug.cgi?id=43084
+
+        This turns USE(GLES2_RENDERING) on for chromium on windows/linux.  This causes no
+        change in behavior, that's all controlled by ENABLE() macros that are currently off.
+
+        * wtf/Platform.h:
+
+2010-07-23  Helder Correia  <heldercorreia@codeaurora.org>
+
+        Reviewed by Darin Adler.
+
+        Canvas tests 2d.imageData.object.round and 2d.imageData.object.wrap are
+        failing. For canvas image data manipulation, the values passed should
+        be truncated and wrapped. Also fix the canvas-ImageData-behaviour test
+        to expect wrapping rather than clamping, and add some new checkings.
+        https://bugs.webkit.org/show_bug.cgi?id=40272
+
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::setIndex):
+        (JSC::JSByteArray::JSByteArray):
+
+2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 42621 - Add a bump allocator for the YARR interpreter
+
+        The regex engine requires lifo allocation, however currently uses the general purpose
+        malloc/free memory allocation.  A simple bump pointer allocator should provide a lower
+        overhead allocation solution.
+
+        When using YARR interpreter, 15% progression on v8-regex.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalData.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        * wtf/BumpPointerAllocator.h: Added.
+        (WTF::BumpPointerPool::ensureCapacity):
+        (WTF::BumpPointerPool::alloc):
+        (WTF::BumpPointerPool::dealloc):
+        (WTF::BumpPointerPool::operator new):
+        (WTF::BumpPointerPool::BumpPointerPool):
+        (WTF::BumpPointerPool::create):
+        (WTF::BumpPointerPool::shrink):
+        (WTF::BumpPointerPool::destroy):
+        (WTF::BumpPointerPool::ensureCapacityCrossPool):
+        (WTF::BumpPointerPool::deallocCrossPool):
+        (WTF::BumpPointerAllocator::BumpPointerAllocator):
+        (WTF::BumpPointerAllocator::~BumpPointerAllocator):
+        (WTF::BumpPointerAllocator::startAllocator):
+        (WTF::BumpPointerAllocator::stopAllocator):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::Interpreter::Interpreter):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::byteCompileRegex):
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix from Chromium/GTK build fix!
+
+        * wtf/PageAllocation.cpp:
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Chromium/GTK build fix
+
+        * wtf/PageAllocation.cpp:
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix for !Mac platforms.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43009 - Abstract out page allocation from executable allocators
+
+        It would be great to have a single platform abstraction for block allocation, rather than copy/paste code.
+
+        In this initial implementation I've made Symbian fall back to use malloc/free for non-executable memory.
+        I think this will match current behaviour for the next client we will want to port across (RegisterFile &
+        Collector).
+
+        * CMakeListsEfl.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::isValid):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * jit/ExecutableAllocatorPosix.cpp: Removed.
+        * jit/ExecutableAllocatorSymbian.cpp: Removed.
+        * jit/ExecutableAllocatorWin.cpp: Removed.
+        * wscript:
+        * wtf/PageAllocator.cpp: Added.
+        (WTF::protection):
+        (WTF::PageAllocation::commit):
+        (WTF::PageAllocation::decommit):
+        (WTF::PageAllocator::allocate):
+        (WTF::PageAllocator::reserve):
+        (WTF::PageAllocator::deallocate):
+        (WTF::PageAllocator::pagesize):
+        * wtf/PageAllocator.h: Added.
+        (WTF::PageAllocation::PageAllocation):
+        (WTF::PageAllocation::base):
+        (WTF::PageAllocation::size):
+        (WTF::PageAllocation::chunk):
+        (WTF::PageAllocation::operator!):
+        (WTF::PageAllocator::):
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Rolling out r64097:64100, oops, more b0rked than I relized by my last changes, sorry!
+
+        * CMakeListsEfl.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::reprotectRegion):
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * jit/ExecutableAllocatorPosix.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::isValid):
+        * jit/ExecutableAllocatorSymbian.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::isValid):
+        * jit/ExecutableAllocatorWin.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::isValid):
+        * wscript:
+        * wtf/PageAllocation.cpp: Removed.
+        * wtf/PageAllocation.h: Removed.
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative !debug build fix II.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::PageAllocation):
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative !debug build fix.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::PageAllocation):
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43009 - Abstract out page allocation from executable allocators
+
+        It would be great to have a single platform abstraction for block allocation, rather than copy/paste code.
+
+        In this initial implementation I've made Symbian fall back to use malloc/free for non-executable memory.
+        I think this will match current behaviour for the next client we will want to port across (RegisterFile &
+        Collector).
+
+        * CMakeListsEfl.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::isValid):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * jit/ExecutableAllocatorPosix.cpp: Removed.
+        * jit/ExecutableAllocatorSymbian.cpp: Removed.
+        * jit/ExecutableAllocatorWin.cpp: Removed.
+        * wscript:
+        * wtf/PageAllocator.cpp: Added.
+        (WTF::protection):
+        (WTF::PageAllocation::commit):
+        (WTF::PageAllocation::decommit):
+        (WTF::PageAllocator::allocate):
+        (WTF::PageAllocator::reserve):
+        (WTF::PageAllocator::deallocate):
+        (WTF::PageAllocator::pagesize):
+        * wtf/PageAllocator.h: Added.
+        (WTF::PageAllocation::PageAllocation):
+        (WTF::PageAllocation::base):
+        (WTF::PageAllocation::size):
+        (WTF::PageAllocation::chunk):
+        (WTF::PageAllocation::operator!):
+        (WTF::PageAllocator::):
+
+2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml()
+
+        This ensures that long-running JavaScript (for example due to a modal alert() dialog),
+        will not trigger a deferred load after only 500ms (the default tokenizer delay) while
+        still giving a reasonable timeout (10 seconds) to prevent deadlock.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29381
+
+        * runtime/TimeoutChecker.h: Add getter for the timeout interval
+
+2010-07-25  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Kent Tamura.
+
+        [WINCE] Buildfix for JSC in release mode
+        https://bugs.webkit.org/show_bug.cgi?id=42934
+
+        * jsc.cpp: Don't use __try on WinCE.
+
+2010-07-24  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        [MSVC] Ensure 4 byte alignment on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=42935
+
+        * jit/JITStubs.h: Added #pragma pack(4) around JITStackFrame.
+
+2010-07-24  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        [WINCE] Cleanup defines in Platform.h
+        https://bugs.webkit.org/show_bug.cgi?id=42933
+
+        * wtf/Platform.h:
+
+2010-07-23  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Cleanup glib support (make it optional)
+        https://bugs.webkit.org/show_bug.cgi?id=42480
+
+        Remove gobject/GRefPtr.cpp if not using soup/glib.
+
+        * wtf/CMakeListsEfl.txt:
+
+2010-07-23  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Roben.
+
+        [WINCE] Implement TCSpinLock.
+        https://bugs.webkit.org/show_bug.cgi?id=41792
+
+        Implement the SpinLock with InterlockedExchange from the Windows API.
+
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SpinLock::IsHeld):
+        (TCMalloc_SpinLock::Init):
+        (TCMalloc_SlowLock):
+
+2010-07-22  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed rolling out r63947 and r63948, because they broke Qt Windows build.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2010-07-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Eeeep! r63947 hosed all non-x86 builds!
+
+        * jit/JITStubs.h:
+
+2010-07-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 42818 - [Qt] REGRESSION(63348): jsc is broken
+        Speculative fix, need fastcall conventions on Qt/Win.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2010-07-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Do more constant folding
+        https://bugs.webkit.org/show_bug.cgi?id=42867
+
+        Constant fold a few more operations.  SunSpider says this is
+        a win but I suspect that's just code motion at play.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeURightShiftNode):
+        (JSC::ASTBuilder::makeBitOrNode):
+        (JSC::ASTBuilder::makeBitAndNode):
+        (JSC::ASTBuilder::makeBitXOrNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+
+2010-07-22  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Kent Tamura.
+
+        Error properties of the Global Object are missing the DontEnum attribute
+        https://bugs.webkit.org/show_bug.cgi?id=28771
+
+        Add the attributes to become spec compliant.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+
+2010-07-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit on Windows should build optionally with an unversioned ICU DLL
+        https://bugs.webkit.org/show_bug.cgi?id=42722
+        <rdar://problem/8211743> JavaScriptCore needs to link against unversioned ICU
+        
+        Dynamically create a new header, ICUVersion.h, as part of build-generated-files.sh.
+        Header contains a preprocessor define (U_DISABLE_RENAMING) indicating to ICU whether the ICU API
+        should be namespaced with the current ICU version number. Proper value is determined
+        by checking for the presence of libicuuc.lib, the unversioned copy of ICU.
+        
+        To get the proper value for U_DISABLE_RENAMING into all source files, we force
+        the include of ICUVersion.h (our generated header) via the compiler options.
+        
+        Since the versioned and unversioned ICU have different filenames (libicuuc.lib vs icuuc.lib)
+        we copy the ICU lib to an intermediate location under obj with a common name. This
+        allows us to link properly with either without adding a new build configuration.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        Copy ICU libs into a common location with a common name.
+        Add additional library search path to pick up icu lib.
+        Change ICU library filename specified to linker.
+        Add forced include of ICUVersion.h.
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Generate ICUVersion.h
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops: Add forced include of ICUVersion.h.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        Copy ICU libs into a common location with a common name.
+        Add additional library search path to pick up icu lib.
+        Change ICU library filename specified to linker.
+        Add forced include of ICUVersion.h.
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+        Copy ICU libs into a common location with a common name.
+        Add additional library search path to pick up icu lib.
+        Change ICU library filename specified to linker.
+        Add forced include of ICUVersion.h.
+
+2010-07-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Re-save vsprops files after no-op edits in Visual Studio
+        to fix manual edit issues.
+
+2010-07-20  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+
+        Reviewed by Steve Block.
+
+        Need to be able to configure Geolocation policy regarding user permissions
+        https://bugs.webkit.org/show_bug.cgi?id=42068
+
+        If CLIENT_BASED_GEOLOCATION is enabled, enable preemtive permission policy
+        by default 
+
+        * wtf/Platform.h:
+        
+2010-07-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r63742.
+        http://trac.webkit.org/changeset/63742
+        https://bugs.webkit.org/show_bug.cgi?id=42641
+
+        Broke Leopard Intel build. (Requested by bbandix on #webkit).
+
+        * wtf/Platform.h:
+
+2010-07-20  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+
+        Reviewed by Steve Block.
+
+        Need to be able to configure Geolocation policy regarding user permissions
+        https://bugs.webkit.org/show_bug.cgi?id=42068
+
+        If CLIENT_BASED_GEOLOCATION is enabled, enable preemtive permission policy
+        by default 
+
+        * wtf/Platform.h:
+        
+2010-07-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG CleanUp of SVGPathData parsing
+        https://bugs.webkit.org/show_bug.cgi?id=41410
+
+        Added piOverTwo to MathExtras.
+
+        * wtf/MathExtras.h:
+
+2010-07-19  Mike Moretti  <mike.moretti@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Symbian] Build fix after r63404.
+
+        Implement isValid() function for the Symbian executable allocator.
+
+        * jit/ExecutableAllocatorSymbian.cpp:
+        (JSC::ExecutableAllocator::isValid):
+
+2010-07-19  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=42118
+        Disable WebGL on Leopard for now. 
+
+        LayoutTests fail on some graphics hardware on Leopard because one of the features we use,
+        GL_ARB_framebuffer_object, is not universally available in Leopard like it is in
+        SnowLeopard. This will allow LayoutTests to pass on Leopard until we add logic to use a
+        software OpenGL driver on machines without this support.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-07-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use OwnPtr for CodeBlock objects
+        https://bugs.webkit.org/show_bug.cgi?id=42490
+
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable): Moved this here and made it non-inline.
+        Eliminated the code that used to initialize the raw pointer since it's now
+        an OwnPtr.
+        (JSC::EvalExecutable::~EvalExecutable): Removed the explicit delete here.
+        (JSC::ProgramExecutable::ProgramExecutable): Ditto.
+        (JSC::ProgramExecutable::~ProgramExecutable): Ditto.
+        (JSC::FunctionExecutable::FunctionExecutable): Ditto.
+        (JSC::FunctionExecutable::~FunctionExecutable): Ditto.
+        (JSC::EvalExecutable::compileInternal): Added use of adoptPtr and get.
+        (JSC::ProgramExecutable::compileInternal): Ditto.
+        (JSC::FunctionExecutable::compileForCallInternal): Ditto.
+        (JSC::FunctionExecutable::compileForConstructInternal): Ditto.
+        (JSC::FunctionExecutable::recompile): Use clear instead of delete followed
+        by assignment of 0.
+
+        * runtime/Executable.h: Moved constructors to the cpp file and changed
+        raw pointers to OwnPtr.
+
+2010-07-19  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Fix build on 64-bit systems. According to
+        JavaScriptCore/wtf/Platform.h, x86_64 uses fixed allocator, which
+        needs jit/ExecutableAllocatorFixedVMPool.cpp to be included in build
+        system.
+        https://bugs.webkit.org/show_bug.cgi?id=42559
+
+        * CMakeListsEfl.txt: add missing file for x86_64.
+
+2010-07-16  Leandro Pereira  <leandro@profusion.mobi>
+
+        [EFL] Unreviewed build system cleanup.
+
+        Move ExecutableAllocator{FixedVMPool,Posix,Symbian,Win}.cpp from
+        root CMakeLists.txt to the platform CMakeLists.txt.
+
+        * CMakeLists.txt:
+        * CMakeListsEfl.txt: Add ExecutableAllocatorPosix.cpp.
+
+2010-07-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        ES5 allows use of reserved words as IdentifierName
+        https://bugs.webkit.org/show_bug.cgi?id=42471
+
+        Modify the lexer to allow us to avoid identifying reserved
+        words in those contexts where they are valid identifiers, and
+        we know it's safe.  Additionally tag the reserved word tokens
+        so we can easily identify them in those cases where we can't
+        guarantee that we've skipped reserved word identification.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::next):
+        (JSC::JSParser::parseProperty):
+        (JSC::JSParser::parseMemberExpression):
+        * parser/JSParser.h:
+        (JSC::):
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::):
+
+2010-07-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        clang++ build fixes for JavaScriptCore and WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=42478
+
+        * runtime/RegExpKey.h:
+        (JSC::operator==):
+        Move the RegExpKey equals operator into the JSC namespace so it can be found by ADL.
+
+2010-07-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Levin.
+
+        Really add WARN_UNUSED_RESULT to leakRef
+        https://bugs.webkit.org/show_bug.cgi?id=42464
+
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::):
+        (WTF::NonNullPassRefPtr::):
+        Put the WARN_UNUSED_RESULT attribute at the right place.
+
+        * wtf/RetainPtr.h:
+        (WTF::RetainPtr::releaseRef):
+        Remove WARN_UNUSED_RESULT here for now, it leads to two warnings that need
+        to be fixed first.
+
+2010-07-15  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Disable c4291 for chromium windows multi dll build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=42177
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2010-07-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash entering mail.yahoo.com
+        https://bugs.webkit.org/show_bug.cgi?id=42394
+    
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::argumentNumberFor): Added a NULL check. If the
+        identifier we're resolving is not a local variable, registerFor returns
+        NULL.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionBodyNode::emitBytecode): Unrelated to the crash, but I
+        noticed this while working on it: No need to NULL-check returnNode,
+        since an early return has already done so.
+
+2010-07-15  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] Simplify the distribution step
+        https://bugs.webkit.org/show_bug.cgi?id=42414
+
+        * GNUmakefile.am: Add extra dist files directly to EXTRA_DIST instead
+        of adding them by proxy via javascriptcore_dist. Sort the EXTRA_DIST list.
+        Refer to create_hash_table and create_regexp_tables directly, as is the
+        behavior with other code generation scripts.
+
+2010-07-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix dumping of op_put_by_id.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printPutByIdOp):
+
+2010-07-15  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Refactoring some parts of the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41845
+
+        This patch is a precursor of refactoring the identifier
+        parsing, which currently slows down the lexer, and not
+        ready for landing. This patch contains those sources,
+        which does not slow down the lexer (mainly style changes).
+
+        SunSpider: no change (529.4ms to 528.7ms)
+        --parse-only: no change (31.0ms to 31.2ms)
+
+        * parser/Lexer.cpp:
+        (JSC::isIdentStart): using typesOfASCIICharacters to determine
+             whether the current character is in identifier start
+        (JSC::isIdentPart): using typesOfASCIICharacters to determine
+             whether the current character is in identifier part
+        (JSC::Lexer::parseString): style fix
+        (JSC::Lexer::lex): removing the else after the main which
+             which reduces code duplication
+
+2010-07-15  Mark Rowe  <mrowe@apple.com>
+
+        Update the sorting in the Xcode project files.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-07-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make sure that mixed interpreter/jit builds don't try to use the jit if the allocator fails
+        https://bugs.webkit.org/show_bug.cgi?id=42310
+
+        Add some null checks to deal with the Fixed VM allocator failing
+        to get the requested executable region, delay the creation of the
+        JITStubs in JSGlobalData until after we know whether we're using
+        the JIT.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::poolForSize):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutableAllocator::isValid):
+        * jit/ExecutableAllocatorWin.cpp:
+        (JSC::ExecutableAllocator::isValid):
+        * jit/JIT.cpp:
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compileCTINativeCall):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::powThunkGenerator):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::getCTIStub):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::jitCompileRegex):
+
+2010-07-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative Qt/Windows build fix.
+
+        * jit/JITStubs.h:
+
+2010-07-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=42280
+        JIT_STUB_ARGUMENT_VA_LIST is only slowing us down! Remove it!
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+
+2010-07-14  Oliver Hunt  <oliver@apple.com>
+
+        RS=Geoff Garen.
+
+        Guard the CF path of interpreter vs. jit selection with PLATFORM(CF)
+
+        This allows the code to work on windows as well.  Also unifies the
+        environment variable with the preference name.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2010-07-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Don Melton.
+
+        Crash when trying to enable JIT and Interpreter in a single build.
+
+        CFPreferences code added at the last minute failed to account for
+        the preference not being present and then attempted to CFRelease
+        a null value.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2010-07-14  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Change indentations in the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41845
+
+        This patch fixes an old, indentation error comes from kjs,
+        as webkit has a different style rule for switches, and change
+        the indentation of the main switch, which is a temporary
+        style error. This change makes easier to see the behavioural
+        changes in the follow-up patch.
+
+        No behavioural changes.
+
+        * parser/Lexer.cpp:
+        (JSC::singleEscape):
+        (JSC::Lexer::lex):
+
+2010-07-13  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r63262.
+        http://trac.webkit.org/changeset/63262
+        https://bugs.webkit.org/show_bug.cgi?id=42229
+
+        broke Windows compile (Requested by bweinstein on #webkit).
+
+        * API/tests/testapi.c:
+        (assertEqualsAsCharactersPtr):
+        (main):
+        * testapi.pro: Removed.
+
+2010-07-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        ES5 requires BOMs to be treated as whitespace
+        https://bugs.webkit.org/show_bug.cgi?id=42218
+
+        Add BOM character to the Lexer's definition of whitespace,
+        and remove the logic that dealt with stripping BOMs and
+        caching the cleaned string.
+
+        * parser/Lexer.h:
+        (JSC::Lexer::isWhiteSpace):
+        * parser/SourceProvider.h:
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * wtf/text/StringImpl.h:
+
+2010-07-13  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Avoid slow-path for put() in Array.splice()
+        https://bugs.webkit.org/show_bug.cgi?id=41920
+
+        Defer creation of the returned array until its final size is known
+        to avoid growing it while adding elements.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Add two modes of creation, CreateInitialized (old)
+        and CreateCompact (which should only be used when constructing arrays whose
+        size and contents are known at the time of creation.)
+        (JSC::JSArray::setLength): Skip first consistency check if in CreateCompact
+        initialization mode. (Only applies to non-empty arrays.)
+        (JSC::JSArray::checkConsistency): Build fix (JSValue::type() is gone)
+        * runtime/JSArray.h:
+        (JSC::JSArray::uncheckedSetIndex): Added for fast initialization of compact
+        arrays. Does no bounds or other sanity checking.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice): Optimized creation of the returned JSArray.
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk): Pass CreateInitialized to ctor.
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyArray): Pass CreateInitialized to ctor.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpMatchesArray::RegExpMatchesArray): Pass CreateInitialized to ctor.
+
+2010-07-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 42207 - Clean up interface to compile executables, always check for exceptions
+
+        Presently interface to compile executable is inconsistent between eval/program and
+        function code, and is error prone in allowing a caller to byte compile without JIT
+        compiling an executable (we rely on all executables with codeblocks having JIT code).
+        Unify on an interface where all compilation is performed by a single compile (with
+        ForCall|ForConstruct variants) method, and make all clients check for errors.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * parser/Parser.h:
+        (JSC::Parser::isFunctionBodyNode):
+        (JSC::Parser::parse):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createStackOverflowError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::compile):
+        (JSC::EvalExecutable::generatedBytecode):
+        (JSC::EvalExecutable::generatedJITCode):
+        (JSC::ProgramExecutable::compile):
+        (JSC::ProgramExecutable::generatedBytecode):
+        (JSC::ProgramExecutable::generatedJITCode):
+        (JSC::FunctionExecutable::generatedBytecode):
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct):
+        (JSC::FunctionExecutable::generatedJITCodeForConstructWithArityCheck):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::canUseJIT):
+
+2010-07-13  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Oliver Hunt.
+
+        testapi.c depends on the Core Foundation.
+        https://bugs.webkit.org/show_bug.cgi?id=40058
+
+        Separate CoreFoundation specific tests in JSC's testapi.c. Enabling it
+        to compile in Qt environments.
+
+        All tests should work except for the JSStringCreateWithCharacters() function,
+        because its tests depend on Core Foundation specific functions.
+
+        * API/tests/testapi.c:
+        (testJSStringRefCF): moved CoreFoundation specific tests to this function.
+        (main): The moves plus some minor tweaks.
+        * testapi.pro: Added.
+
+2010-07-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 42182 - Change how numeric compare functions are detected
+
+        There are three problems with the current mechanism:
+          * It requires that a function executable be bytecode compiled without
+            being JIT generated (in order to copy the bytecode from the numeric
+            compare function).  This is a problem since we have an invariant when
+            running with the JIT that functions are never bytecode compiled without
+            also being JIT generated (after checking the codeblock we assume the
+            function has JIT code).  To help maintain this invariant 
+          * This implementation will prevent us from experimenting with alternate
+            compilation paths which do not compile via bytecode.
+          * It doesn't work.  Functions passing more than two arguments will match
+            if they are comparing their last two arguments, not the first two.
+            Generally the mapping back from bytecode to semantics may be more
+            complex then initially expected.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::setIsNumericCompareFunction):
+        (JSC::BytecodeGenerator::argumentNumberFor):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BlockNode::singleStatement):
+        (JSC::FunctionBodyNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isSubtract):
+        (JSC::BinaryOpNode::lhs):
+        (JSC::BinaryOpNode::rhs):
+        (JSC::SubNode::isSubtract):
+        (JSC::ReturnNode::value):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+
+2010-07-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: Crash at JSC::JIT::privateCompile(JSC::MacroAssemblerCodePtr*)
+        https://bugs.webkit.org/show_bug.cgi?id=41763
+
+        There are two parts to this patch, the first is to fix the actual
+        problem.  When calling copyStringWithoutBOMs on a string we know
+        to contain BOMs we return a value indicating that there are no
+        BOMs.
+
+        The second part of this fix is simply to harden the path that
+        led to a crash when parsing failed.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+           Harden compilation stubs against parser failure.
+        * parser/Lexer.cpp:
+        (JSC::Lexer::sourceCode):
+           Add assertions to ensure that subranges into a source provider
+           are always actually braces.  Hopefully this should catch similar
+           failures in future.  These assertions fire on existing tests
+           without this fix.
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::tryJitCodeForCall):
+        (JSC::FunctionExecutable::tryJitCodeForConstruct):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::copyStringWithoutBOMs):
+           Make copyStringWithBOMs do the right thing.
+
+2010-07-13  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix the constant encoding in data transfer instructions on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=42166
+
+        The getImm function is designed to produce modified immediate constant
+        for data processing instructions. It should not be used to encode
+        any constant for data transfer. In the current situation there is no
+        way to use any immediate constant for data transfer. So, the moveImm
+        function is the desired method to pass the offset value to the data
+        transfer instructions.
+
+        Reported by Jacob Bramley.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::dataTransfer32):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::call32):
+
+2010-07-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        String to number coercion is not spec compliant
+        https://bugs.webkit.org/show_bug.cgi?id=31349
+
+        ToNumber should ignore NBSP (\u00a0)
+        https://bugs.webkit.org/show_bug.cgi?id=25490
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseIntOverflow): Added a version that works on UChar.
+        * runtime/JSGlobalObjectFunctions.h: Ditto.
+
+        * runtime/UString.cpp:
+        (JSC::isInfinity): Added helper functions.
+        (JSC::UString::toDouble): Use isStrWhiteSpace instead of
+        isSASCIISpace to define what we should skip. Got rid of the
+        code that used CString and UTF8String, instead processing the
+        UChar of the string directly, except for when we call strtod.
+        For strtod, use our own home-grown conversion function that
+        does not try to do any UTF-16 processing. Tidied up the logic
+        a bit as well.
+
+2010-07-12  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] make dist is broken because of missing headers and other miscellaneous reasons
+        https://bugs.webkit.org/show_bug.cgi?id=42107
+
+        * GNUmakefile.am: Add missing header to the sources list.
+
+2010-07-12  Adam Roben  <aroben@apple.com>
+
+        Stop generating stripped symbols for Release builds
+
+        It turns out we can strip the symbols after-the-fact using PDBCopy.
+
+        Fixes <http://webkit.org/b/42085>.
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        Removed the pre-link event, which just created the public\sym
+        directory.
+
+2010-07-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add WARN_UNUSED_RETURN to the smart pointer "leak" member functions
+        https://bugs.webkit.org/show_bug.cgi?id=42086
+
+        * wtf/OwnPtr.h:
+        * wtf/PassOwnPtr.h:
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::releaseRef):
+        (WTF::NonNullPassRefPtr::leakRef):
+        (WTF::NonNullPassRefPtr::releaseRef):
+        * wtf/RetainPtr.h:
+        (WTF::RetainPtr::releaseRef):
+
+2010-07-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        HAVE_COMPUTED_GOTO is dependent on the interpreter being enabled
+        https://bugs.webkit.org/show_bug.cgi?id=42039
+
+        Separate the existence of computed goto support in the compiler
+        from whether or not we are using the interpreter.  All the current
+        HAVE(COMPUTED_GOTO) guards are for the interpreter, but I'd like
+        the option of using it elsewhere.  The interpreter now uses
+        ENABLE(COMPUTED_GOTO_INTERPRETER) 
+
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::getOpcode):
+        (JSC::Interpreter::getOpcodeID):
+        * wtf/Platform.h:
+
+2010-07-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove switches from inner expression loops in the parser
+        https://bugs.webkit.org/show_bug.cgi?id=42035
+
+        Use bitmasks and flags on the token types to identify unary and
+        binary operators, rather than switching on the token type to
+        identify them.
+
+        * parser/JSParser.cpp:
+        (JSC::isUnaryOp):
+        (JSC::JSParser::isBinaryOperator):
+        * parser/JSParser.h:
+        (JSC::):
+
+2010-07-09  Leon Clarke  <leonclarke@google.com>
+
+        Reviewed by Adam Barth.
+
+        add support for link prefetching
+        https://bugs.webkit.org/show_bug.cgi?id=3652
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-07-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Tidy up lexer token ids
+        https://bugs.webkit.org/show_bug.cgi?id=42014
+
+        Stop using character literals to identify single character tokens
+        and instead use symbolic names for all tokens.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makeBinaryNode):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::consume):
+        (JSC::JSParser::match):
+        (JSC::JSParser::autoSemiColon):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::allowAutomaticSemicolon):
+        (JSC::JSParser::parseDoWhileStatement):
+        (JSC::JSParser::parseWhileStatement):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseConstDeclarationList):
+        (JSC::JSParser::parseForStatement):
+        (JSC::JSParser::parseReturnStatement):
+        (JSC::JSParser::parseWithStatement):
+        (JSC::JSParser::parseSwitchStatement):
+        (JSC::JSParser::parseSwitchClauses):
+        (JSC::JSParser::parseSwitchDefaultClause):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseDebuggerStatement):
+        (JSC::JSParser::parseStatement):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+        (JSC::JSParser::parseIfStatement):
+        (JSC::JSParser::parseExpression):
+        (JSC::JSParser::parseAssignmentExpression):
+        (JSC::JSParser::parseConditionalExpression):
+        (JSC::isUnaryOp):
+        (JSC::JSParser::isBinaryOperator):
+        (JSC::JSParser::parseBinaryExpression):
+        (JSC::JSParser::parseProperty):
+        (JSC::JSParser::parseObjectLiteral):
+        (JSC::JSParser::parseStrictObjectLiteral):
+        (JSC::JSParser::parseArrayLiteral):
+        (JSC::JSParser::parsePrimaryExpression):
+        (JSC::JSParser::parseArguments):
+        (JSC::JSParser::parseMemberExpression):
+        (JSC::JSParser::parseUnaryExpression):
+        * parser/JSParser.h:
+        (JSC::):
+        * parser/Lexer.cpp:
+        (JSC::):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+
+2010-07-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 42015 - Enable JSValue32_64 on ARMv7
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        * wtf/Platform.h:
+
+2010-07-09  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Assertion failure in String::utf8() for certain invalid UTF16 inputs
+        https://bugs.webkit.org/show_bug.cgi?id=41983
+
+        * wtf/text/WTFString.cpp:
+        (WebCore::String::utf8):
+         - Fixed assertion when sourceExhausted is returned from convertUTF16ToUTF8.
+
+2010-07-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove a couple of excess writes from the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41981
+
+        Remove a couple of fields from JSTokenInfo, and rename the remaining ones
+        to something more accurate
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::next):
+        (JSC::JSParser::tokenStart):
+        (JSC::JSParser::tokenLine):
+        (JSC::JSParser::tokenEnd):
+        * parser/JSParser.h:
+        (JSC::JSTokenInfo::JSTokenInfo):
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+
+2010-07-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Property declarations in an object literal should not consider the prototype chain when being added to the new object
+        https://bugs.webkit.org/show_bug.cgi?id=41929
+
+        To fix this all we need to do is ensure that all new properties are
+        added with putDirect rather than a fully generic call to put.  This
+        is safe as an object literal is by definition going to produce a
+        completely normal object.
+
+        Rather than duplicating all the put_by_id logic we add an additional
+        flag to op_put_by_id to indicate it should be using putDirect.  In
+        the interpreter this adds a runtime branch, but in the jit this is
+        essentially free as the branch is taken at compile time.  This does
+        actually improve object literal creation time even in the interpreter
+        as we no longer need to walk the prototype chain to verify that the
+        cached put is safe.
+
+        We still emit normal put_by_id code when emitting __proto__ as we want
+        to get the correct handling for changing the prototype.
+
+        Sunspider claims this is a 0.7% speedup which is conceivably real due
+        to the performance improvement in object literals, but I suspect its
+        really just the result of code motion.
+
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.h:
+        (JSC::JIT::compilePutByIdTransition):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchPutByIdReplace):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchPutByIdReplace):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect):
+        (JSC::JSValue::putDirect):
+        * runtime/JSValue.h:
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        String.prototype methods should CheckObjectCoercible (test this is not null or undefined).
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::trimString):
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Date.prototype.toJSON takes one argument, report this correctly.
+
+        * runtime/DatePrototype.cpp:
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        RegExp's prototype should be an object of type RegExp.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
+
+2010-07-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JavaScript parser violates ECMA automatic semicolon insertion rule
+        https://bugs.webkit.org/show_bug.cgi?id=41844
+
+        Remove (very) old and bogus logic that automatically inserted a semicolon
+        at the end of a script's source.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+
+2010-07-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders Carlson.
+
+        Tidy up the lexer
+
+        Remove some of the old yacc/lex-isms still present in the lexer
+
+        * parser/JSParser.h:
+        (JSC::):
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseString):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+
+2010-07-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make object-literal parsing conformant with the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=41892
+
+        Bring our parsing of object literals into conformance with the ES5 spec.
+        Basically disallow conflicting accessor vs. normal property definitions
+        The bulk of this patch is just fiddling to maintain performance.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::getName):
+        (JSC::ASTBuilder::getType):
+        * parser/JSParser.cpp:
+        (JSC::jsParse):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProperty):
+        (JSC::JSParser::parseObjectLiteral):
+        (JSC::JSParser::parseStrictObjectLiteral):
+        * parser/JSParser.h:
+        * parser/Lexer.cpp:
+        (JSC::Lexer::clear):
+        * parser/Lexer.h:
+        (JSC::Lexer::currentOffset):
+        (JSC::Lexer::setOffset):
+          Add logic to allow us to roll the lexer back in the input stream.
+        * parser/Nodes.h:
+        (JSC::PropertyNode::):
+        (JSC::PropertyNode::type):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::isValid):
+        (JSC::SourceProvider::setValid):
+          SourceProvider now records whether the input text
+          has already been validated.
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::SyntaxChecker):
+        (JSC::SyntaxChecker::Property::Property):
+        (JSC::SyntaxChecker::Property::operator!):
+        (JSC::SyntaxChecker::createProperty):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+          The SyntaxChecker mode now needs to maintain a bit more information
+          to ensure that we can validate object literals correctly.
+
+2010-07-08  Darin Adler  <darin@apple.com>
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::sharedInstance): Fix typo.
+
+2010-07-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix assertion seen on the Leopard buildbot.
+        The single shared instance of JSGlobalData was not being
+        adopted after creation.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::sharedInstance): Do adoptRef and then leakRef.
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        BOMs are whitespace.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::isStrWhiteSpace):
+
+2010-07-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed.
+
+        Try fix the GTK+ build by touching this file.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        GTK build fix take two.
+
+        * GNUmakefile.am:
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        GTK build fix.
+
+        * GNUmakefile.am:
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41641
+
+        Update compile flags to allow use of ExecutableAllocatorFixedVMPool on platforms
+        other than x86-64 (this may be useful on 32-bit platforms, too).
+
+        Simplify ifdefs by dividing into thwo broad allocation strategies
+        (ENABLE_EXECUTABLE_ALLOCATOR_FIXED & ENABLE_EXECUTABLE_ALLOCATOR_DEMAND).
+
+        Rename constant used in the code to have names descriptive of their purpose,
+        rather than their specific value on a given platform.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::reprotectRegion):
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * wtf/Platform.h:
+
+2010-07-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Silence a few noisy build rules.
+
+        * GNUmakefile.am:
+
+2010-07-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62765.
+        http://trac.webkit.org/changeset/62765
+        https://bugs.webkit.org/show_bug.cgi?id=41840
+
+        All jscore and layout tests crash on Qt bot (Requested by Ossy
+        on #webkit).
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::scavengerThread):
+
+2010-07-08  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Interpreter: Crash in op_load_varargs on 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=41795
+
+        Added missing cast of argCount to int32_t in op_load_varargs.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-07-08  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make FastMalloc more portable.
+        https://bugs.webkit.org/show_bug.cgi?id=41790
+
+        Use WTF::Mutex instead of pthread_mutex_t and
+        replace pthread_cond_t with WTF::ThreadCondition.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::scavengerThread):
+
+2010-07-08  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Remove needless #include <fcntl.h> from TCSystemAlloc.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=41777
+
+        * wtf/TCSystemAlloc.cpp:
+
+2010-07-07  Darin Adler  <darin@apple.com>
+
+        Fixed build in configurations like PowerPC.
+
+        * runtime/RegExpConstructor.cpp: Added include of PassOwnPtr.h.
+        * runtime/RegExpObject.cpp: Ditto.
+        * wtf/SizeLimits.cpp: Changed compile time assertion to work
+        even on platforms where two bool members do not end up taking
+        the same size as one int member!
+
+2010-07-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Lazy mode of parser allows invalid syntax in object literals.
+        https://bugs.webkit.org/show_bug.cgi?id=41809
+
+        Make the parser itself validate getter and setter syntax rather
+        than offloading it to the AST builder.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseProperty):
+
+2010-07-07  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Revert r62689.
+        https://bugs.webkit.org/show_bug.cgi?id=41804
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::freeBlocks):
+
+2010-07-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Add reverseFind to Vector and deploy in HTML5 parser
+        https://bugs.webkit.org/show_bug.cgi?id=41778
+
+        This method seems generally useful.  I'm slightly surprised we don't
+        have it already.
+
+        * wtf/Vector.h:
+        (WTF::::reverseFind):
+
+2010-07-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Turn on adoptRef assertion for RefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=41547
+
+        * wtf/CrossThreadRefCounted.h: Fixed include style. Includes of other
+        WTF headers should use "" includes; consistent in most WTF headers.
+        Added a call to relaxAdoptionRequirement.
+
+        * wtf/RefCounted.h: Fixed include style. Removed LOOSE_REF_COUNTED.
+        Added relaxAdoptionRequirement.
+
+2010-07-07  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::freeBlocks):
+
+2010-07-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        More OwnPtr work
+        https://bugs.webkit.org/show_bug.cgi?id=41727
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty): Use adoptPtr.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::JSCallbackObject): Ditto.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock): Ditto.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::createRareDataIfNecessary): Ditto.
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode): Ditto.
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::ParserArena): Ditto.
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments): Ditto.
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compile): Ditto.
+        (JSC::ProgramExecutable::compile): Ditto.
+        (JSC::FunctionExecutable::compileForCall): Ditto.
+        (JSC::FunctionExecutable::compileForConstruct): Ditto.
+        (JSC::FunctionExecutable::reparseExceptionInfo): Ditto.
+        (JSC::EvalExecutable::reparseExceptionInfo): Ditto.
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort): Ditto.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor): Ditto.
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject): Ditto.
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::createSingleCharacterString): Ditto.
+        (JSC::SmallStrings::singleCharacterStringRep): Ditto.
+
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault): Use adoptPtr.
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::ByteCompiler): Ditto.
+        (JSC::Yarr::ByteCompiler::compile): Ditto.
+        (JSC::Yarr::ByteCompiler::regexBegin): Ditto.
+        (JSC::Yarr::byteCompileRegex): Ditto.
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern): Ditto.
+
+2010-07-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Make clear set the pointer to 0 before deletion
+        https://bugs.webkit.org/show_bug.cgi?id=41727
+
+        * wtf/OwnArrayPtr.h: Changed code so we always set the pointer to its new
+        value before deleting the old one, including in the set function and the
+        clear function. This required changing safeDelete.
+        * wtf/OwnPtr.h: Ditto. Also removed some extra null checks.
+        * wtf/PassOwnPtr.h: Ditto.
+
+        * wtf/PassRefPtr.h: Changed code so we always set the pointer to its new
+        value before deref'ing the old one in the clear function. Also added a
+        leakRef function for NonNullPassRefPtr.
+        * wtf/RefPtr.h: Ditto.
+
+        * wtf/gobject/GOwnPtr.h: More of the same.
+        * wtf/gobject/GRefPtr.h: Ditto.
+
+2010-07-07  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Refactored string parsing inside the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41606
+
+        Does not use goto. Although the last sunspider
+        parse-only tests yields 1.044x speedup, I think the
+        patch can have a slight improvement at most.
+
+        * parser/Lexer.cpp:
+        (JSC::singleEscape):
+        (JSC::Lexer::parseString):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+
+2010-07-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make it possible to have both the JIT and Interpreter available in a single build
+        https://bugs.webkit.org/show_bug.cgi?id=41722
+
+        Separate the concept of !ENABLE(JIT) and ENABLE(INTERPRETER) and make it possible
+        to have both JIT and INTERPRETER enabled at the same time.  This doesn't add
+        support for mix mode execution, but it does allow a single build to contain all
+        the code needed to use either the interpreter or the jit.
+
+        If both ENABLE(INTERPRETER) and ENABLE(JIT) are true then setting the environment
+        variable JSC_FORCE_INTERPRETER will force JSC to use the interpreter.
+
+        This patch basically consists of replacing !ENABLE(JIT) with ENABLE(INTERPRETER),
+        or converting #if ENABLE(JIT) ... #else ... into #if ENABLE(JIT) ... #endif
+        #if ENABLE(INTERPRETER), etc.  There are also a few functions that need to be
+        renamed to resolve return type ambiguity.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::returnVPC):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::generateJITCode):
+        (JSC::ProgramExecutable::generateJITCode):
+        (JSC::FunctionExecutable::generateJITCodeForCall):
+        (JSC::FunctionExecutable::generateJITCodeForConstruct):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::canUseJIT):
+        * wtf/Platform.h:
+
+2010-07-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Add adoptPtr and leakPtr functions for OwnPtr and PassOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=41320
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary): Use assignment
+        instead of set since the result of reparseExceptionInfo is now a
+        PassOwnPtr.
+
+        * bytecode/CodeBlock.h: Change extractExceptionInfo to return a
+        PassOwnPtr instead of a raw pointer.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::reparseExceptionInfo): Return a PassOwnPtr.
+        (JSC::EvalExecutable::reparseExceptionInfo): Ditto.
+        (JSC::ProgramExecutable::reparseExceptionInfo): Added. This was
+        in the header before, but it's better to not have it there to reduce
+        header dependencies. Return a PassOwnPtr.
+
+        * runtime/Executable.h: Made reparseExceptionInfo return a PassOwnPtr,
+        and put it in the private sections of classes other than the base class.
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::append): Use leakPtr instead of release.
+        (WTF::MessageQueue::appendAndCheckEmpty): Ditto.
+        (WTF::MessageQueue::prepend): Ditto.
+
+        * wtf/OwnPtr.h: Tweaked formatting. Changed the release function to return
+        a PassOwnPtr rather than a raw pointer. Added a leakPtr function that
+        returns a raw pointer. Put the constructor that takes a raw pointer and
+        the set function into a section guarded by LOOSE_OWN_PTR. Adapted to the
+        new adoptPtr function from PassOwnPtr.h.
+
+        * wtf/PassOwnPtr.h: Tweaked formatting. Renamed the release function
+        to leakPtr. Added an adoptPtr function that creates a new PassOwnPtr.
+        Put the constructor and assignment operators that take a raw pointer
+        into a section guarded by LOOSE_PASS_OWN_PTR.
+
+2010-07-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler
+
+        Update comment in StringExtras.h to be more accurate.
+
+        * wtf/StringExtras.h:
+
+2010-07-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62511.
+        http://trac.webkit.org/changeset/62511
+        https://bugs.webkit.org/show_bug.cgi?id=41686
+
+        Breaks Linux/64bit compilation (Requested by xan_ on #webkit).
+
+        * jit/ExecutableAllocator.cpp:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutableAllocator::reprotectRegion):
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/ExecutableAllocatorSymbian.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * wtf/Platform.h:
+
+2010-07-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41641
+
+        Update compile flags to allow use of ExecutableAllocatorFixedVMPool on platforms
+        other than x86-64 (this may be useful on 32-bit platforms, too).
+
+        Simplify ifdefs by dividing into thwo broad allocation strategies
+        (ENABLE_EXECUTABLE_ALLOCATOR_FIXED & ENABLE_EXECUTABLE_ALLOCATOR_DEMAND).
+
+        Rename constant used in the code to have names descriptive of their purpose,
+        rather than their specific value on a given platform.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::reprotectRegion):
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * wtf/Platform.h:
+
+2010-07-05  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        ThreadingPthreads.cpp should use JNIUtility.h on Android, not outdated jni_utility.h
+        https://bugs.webkit.org/show_bug.cgi?id=41594
+
+        * wtf/ThreadingPthreads.cpp:
+
+2010-07-04  Mark Rowe  <mrowe@apple.com>
+
+        Build fix after r62456.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Be slightly more consistent in using uint32_t to prevent
+        warnings about comparisons between signed and unsigned types, and attempts to call an overload
+        of std::min that doesn't exist.
+
+2010-07-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=41553
+        Make StringExtras.h versions of snprintf and vsnprintf match the unix versions.
+
+        - MSVC does not ensure the buffers are null terminated as the unix versions do.
+
+        * runtime/JSGlobalObjectFunctions.cpp: Cleanup includes.
+        * runtime/UString.cpp: Clean up includes.
+        (JSC::UString::from): Don't pass sizeof(buf) - 1, that is wrong.
+        * wtf/StringExtras.h:
+        (snprintf): Ensure null termination of buffer.
+        (vsnprintf): Ditto.
+
+2010-07-03  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Make Arguments::MaxArguments clamping work for numbers >= 0x80000000 in
+        the interpreter as well as the JIT.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41351
+        rdar://problem/8142141
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Fix signed integer overflow problem
+        in op_load_varargs handling. 0xFFFFFFFF was read as -1.
+
+2010-06-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dumitru Daniliuc.
+
+        Support for keys and in-memory storage for IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=41252
+
+        Set the role to Private.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-07-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Move BOM handling out of the lexer and parser
+        https://bugs.webkit.org/show_bug.cgi?id=41539
+
+        Doing the BOM stripping in the lexer meant that we could
+        end up having to strip the BOMs from a source multiple times.
+        To deal with this we now require all strings provided by
+        a SourceProvider to already have had the BOMs stripped.
+        This also simplifies some of the lexer logic.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::sourceCode):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::getRange):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::copyStringWithoutBOMs):
+
+2010-07-03  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Kent Tamura.
+
+        [WINCE] Implement Unicode::isAlphanumeric and Unicode::isArabicChar.
+        https://bugs.webkit.org/show_bug.cgi?id=41411
+
+        * wtf/unicode/wince/UnicodeWince.cpp:
+        (WTF::Unicode::isAlphanumeric):
+        * wtf/unicode/wince/UnicodeWince.h:
+        (WTF::Unicode::isArabicChar):
+
+2010-07-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Change the CRASH() macro to print "WebKit CRASH" log.
+        https://bugs.webkit.org/show_bug.cgi?id=41524
+
+        Print "WebKit CRASH" before crashing.
+
+        * wtf/Assertions.h:
+
+2010-07-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 41565 - Repatching in ARMv7Assembler::repatchLoadPtrToLEA is broken
+
+        This method tried to repatch a LDR (T2) into an ADD (T3) - but it only
+        repatches the first instruction word.  The layout of the fields in the
+        second word is different, and also needs repatching.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::repatchLoadPtrToLEA):
+
+2010-07-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Clamp the number of arguments supported by function.apply
+        https://bugs.webkit.org/show_bug.cgi?id=41351
+        <rdar://problem/8142141>
+
+        Add clamping logic to function.apply similar to that
+        enforced by firefox.  We have a smaller clamp than
+        firefox as our calling convention means that stack
+        usage is proportional to argument count -- the firefox
+        limit is larger than you could actually call.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.h:
+        (JSC::Arguments::):
+
+2010-07-02  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Re-enable JIT_OPTIMIZE_NATIVE_CALL on MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=40179
+
+        Add the MIPS part to re-enable JIT_OPTIMIZE_NATIVE_CALL.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * wtf/Platform.h:
+
+2010-07-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 41552 - Clean up ARMv7 vfp code generation
+        Emit separate opcode individually, remove magic numbers.
+
+        Also remove invalid assert from JSImmediate (number cells are not CELL_MASK aligned).
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::vadd_F64):
+        (JSC::ARMv7Assembler::vcmp_F64):
+        (JSC::ARMv7Assembler::vcvt_F64_S32):
+        (JSC::ARMv7Assembler::vcvtr_S32_F64):
+        (JSC::ARMv7Assembler::vdiv_F64):
+        (JSC::ARMv7Assembler::vldr):
+        (JSC::ARMv7Assembler::vmov_F64_0):
+        (JSC::ARMv7Assembler::vmov):
+        (JSC::ARMv7Assembler::vmrs):
+        (JSC::ARMv7Assembler::vmul_F64):
+        (JSC::ARMv7Assembler::vstr):
+        (JSC::ARMv7Assembler::vsub_F64):
+        (JSC::ARMv7Assembler::VFPOperand::VFPOperand):
+        (JSC::ARMv7Assembler::VFPOperand::bits1):
+        (JSC::ARMv7Assembler::VFPOperand::bits4):
+        (JSC::ARMv7Assembler::vcvtOp):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::vfpOp):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::vfpMemOp):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchDouble):
+        * runtime/JSImmediate.h:
+        (JSC::JSValue::isCell):
+
+2010-07-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62410.
+        http://trac.webkit.org/changeset/62410
+        https://bugs.webkit.org/show_bug.cgi?id=41549
+
+        accursed last minute changes (Requested by olliej on #webkit).
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::copyCodeWithoutBOMs):
+        (JSC::Lexer::sourceCode):
+        * parser/SourceProvider.h:
+        (JSC::):
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::hasBOMs):
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::getRange):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * wtf/text/StringImpl.h:
+
+2010-07-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=41548
+        Use snprintf instead of sprintf everywhere in JavaScriptCore
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::globalFuncEscape):
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+
+2010-07-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Move BOM handling out of the lexer and parser
+        https://bugs.webkit.org/show_bug.cgi?id=41539
+
+        Doing the BOM stripping in the lexer meant that we could
+        end up having to strip the BOMs from a source multiple times.
+        To deal with this we now require all strings provided by
+        a SourceProvider to already have had the BOMs stripped.
+        This also simplifies some of the lexer logic.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::sourceCode):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::getRange):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::copyStringWithoutBOMs):
+
+2010-07-02  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+        
+        [ Updated after rollout. ]
+
+        Merged RegExp constructor and RegExp::create methods.
+        Both functions are called with three parameters and check whether 
+        flags (the third param) is given or not.
+        Avoid extra hash lookups in RegExpCache::create by passing a pre-computed
+        iterator parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=41055
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-07-02  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed. Build fix for GTK+.
+
+        Build Lexer.lut.h with the rest of the .lut.h files. Later these should
+        all probably be moved to DerivedSources.
+
+        * GNUmakefile.am:
+
+2010-06-23  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Separate DerivedSources per-project
+        https://bugs.webkit.org/show_bug.cgi?id=41109
+
+        Generate JavaScriptCore derived sources in <builddir>/DerivedSources/JavaScriptCore.
+
+        * GNUmakefile.am:
+
+2010-07-02  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        The alternativeFrameLocation value is wrong in the emitDisjunction function in
+        case of PatternTerm::TypeParentheticalAssertion. This value needs to be
+        computed from term.frameLocation instead of term.inputPosition. This mistake caused glibc
+        memory corruption in some cases.
+        Layout test added for checking of TypeParentheticalAssertion case.
+        https://bugs.webkit.org/show_bug.cgi?id=41458
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2010-07-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add a FixedArray template to encapsulate fixed length arrays
+        https://bugs.webkit.org/show_bug.cgi?id=41506
+
+        This new type is used in place of fixed length C arrays so
+        that debug builds can guard against attempts to go beyond
+        the end of the array.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Opcode.cpp:
+        (JSC::OpcodeStats::~OpcodeStats):
+        * pcre/pcre_compile.cpp:
+        (calculateCompiledPatternLength):
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::allocate):
+        * runtime/Collector.h:
+        (JSC::CollectorBitmap::clearAll):
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::operator*):
+        * runtime/DateInstanceCache.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::replaceCharacter):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSStringFinalizerStruct::):
+        * runtime/NumericStrings.h:
+        * runtime/RegExpCache.h:
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::singleCharacterStrings):
+        * wtf/AVLTree.h:
+        * wtf/FixedArray.h: Added.
+        (WTF::FixedArray::operator[]):
+        (WTF::FixedArray::data):
+
+2010-07-01  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Improve the main lexer switch by mapping input characters to their type
+        https://bugs.webkit.org/show_bug.cgi?id=41459
+
+        Sunsipder: no change (from 532.9ms to 531.5ms)
+        SunSpider --parse-only: 1.025x as fast (from 33.1ms to 32.3ms)
+
+        * parser/Lexer.cpp:
+        (JSC::):
+        (JSC::Lexer::lex):
+
+2010-07-01  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Ander Carlsson.
+
+        Define HAVE_HOSTED_CORE_ANIMATION on Snow Leopard.
+
+        * wtf/Platform.h:
+
+2010-07-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 41490 - Add missing operations to MacroAssemblerARMv7
+        Also, make single, double, quad register numbers in ARMv7Assembler distinct & strongly typed.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMRegisters::):
+        (JSC::ARMRegisters::asSingle):
+        (JSC::ARMRegisters::asDouble):
+        (JSC::VFPImmediate::VFPImmediate):
+        (JSC::VFPImmediate::isValid):
+        (JSC::VFPImmediate::value):
+        (JSC::ARMv7Assembler::singleRegisterMask):
+        (JSC::ARMv7Assembler::doubleRegisterMask):
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::add_S):
+        (JSC::ARMv7Assembler::neg):
+        (JSC::ARMv7Assembler::orr_S):
+        (JSC::ARMv7Assembler::sub):
+        (JSC::ARMv7Assembler::sub_S):
+        (JSC::ARMv7Assembler::vadd_F64):
+        (JSC::ARMv7Assembler::vcmp_F64):
+        (JSC::ARMv7Assembler::vcvt_F64_S32):
+        (JSC::ARMv7Assembler::vcvtr_S32_F64):
+        (JSC::ARMv7Assembler::vdiv_F64):
+        (JSC::ARMv7Assembler::vldr):
+        (JSC::ARMv7Assembler::vmov_F64_0):
+        (JSC::ARMv7Assembler::vmov):
+        (JSC::ARMv7Assembler::vmul_F64):
+        (JSC::ARMv7Assembler::vstr):
+        (JSC::ARMv7Assembler::vsub_F64):
+        (JSC::ARMv7Assembler::vcvt):
+        (JSC::ARMv7Assembler::vmem):
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::fpTempRegisterAsSingle):
+        (JSC::MacroAssemblerARMv7::neg32):
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::divDouble):
+        (JSC::MacroAssemblerARMv7::convertInt32ToDouble):
+        (JSC::MacroAssemblerARMv7::branchConvertDoubleToInt32):
+        (JSC::MacroAssemblerARMv7::zeroDouble):
+        (JSC::MacroAssemblerARMv7::branchOr32):
+        (JSC::MacroAssemblerARMv7::set32):
+        (JSC::MacroAssemblerARMv7::set8):
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerX86Common.h:
+
+2010-07-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve reentrancy logic in polymorphic cache stubs
+        <https://bugs.webkit.org/show_bug.cgi?id=41482>
+        <rdar://problem/8094380>
+
+        Make the polymorphic cache stubs handle reentrancy
+        better.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+
+2010-07-01  Antti Koivisto  <koivisto@iki.fi>
+
+        Revert accidental commit.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+
+2010-06-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Add assertion, off by default, for when you forget to do adoptRef
+        https://bugs.webkit.org/show_bug.cgi?id=41422
+
+        * wtf/PassRefPtr.h: Tweaked formatting. Added a new adopted
+        function, called on the pointer by adoptRef, with an empty inline
+        default version, meant to be overloaded. Unified the inlining
+        with a macro named REF_DEREF_INLINE to make it clearer what's
+        going on in the refIfNotNull/derefIfNotNull functions. Renamed
+        releaseRef to leakRef, but left the old name in for compatibility
+        for now.
+
+        * wtf/RefCounted.h: Added code to require adoption and assert if
+        you don't call adoptRef. For now, it is turned off because of the
+        LOOSE_REF_COUNTED define in this header. Later we can turn it on
+        once we get everything working without asserting.
+
+2010-06-29  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 41238 - RegExp performance slow on Dromaeo benchmark
+
+        Other javascript engines appear to cache prior results of regular 
+        expression operations.
+
+        Suggest adding some sort of caching mechanism to regular expression 
+        processing.
+
+        Added a single entry cache of match() results to RegExp class.
+
+        Also added performance improvements to UString == operator.
+        First check the impls for equality.  Then get the length of
+        each of the non-null impls.  Next check the sizes for equality.
+        Then check the data for the case of different impls that point 
+        to the same data (most likely due to substrings from the beginning of
+        another string).  Lastly we check the underlying data for equality.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * runtime/UString.h:
+        (JSC::operator==):
+
+2010-06-29  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        WTF::HashSet iterators are quasi-mutable.  Changing the value through
+        dereferencing an iterator will not change the behavior of methods like
+        contains or find, but will change the behavior of iterating.
+
+        * wtf/HashSet.h:
+        (WTF::::begin):
+        (WTF::::end):
+        (WTF::::find):
+        (WTF::::remove):
+        * wtf/HashTable.h:
+
+2010-06-29  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Clean up the source lists in the GNUMakefile.am files
+        https://bugs.webkit.org/show_bug.cgi?id=41229
+
+        Clean up the GNUMakefile.am a little bit. Alphabetize and conglomerate
+        the source lists.
+
+        * GNUmakefile.am:
+
+2010-06-29  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix QtScript build after QScriptValuePrivate ctor changes
+        https://bugs.webkit.org/show_bug.cgi?id=41307
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::prototype):
+        * qt/benchmarks/qscriptengine/qscriptengine.pro:
+
+2010-06-28  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QScriptEngine API should contain a newArray function
+        https://bugs.webkit.org/show_bug.cgi?id=39115
+
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::newArray):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::newArray):
+        * qt/api/qscriptengine_p.h:
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::newArray):
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Install jsc as jsc-X where X is the major API version to allow
+        parallel installation of both GTK+ 2.x and 3.x versions.
+
+        * GNUmakefile.am:
+
+2010-06-28  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Kent Tamura.
+
+        add ENABLE_DIRECTORY_UPLOAD build support
+        https://bugs.webkit.org/show_bug.cgi?id=41100
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Revert to build jsc, since the tests expect this.
+
+        * GNUmakefile.am:
+
+2010-06-28  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Only one character lookahead should be enough for the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41213
+
+        The lexer had 4 character lookahead before, which required
+        a complex shifting mechanism. This can be improved by using
+        only one character lookahead for most decisions, and a
+        peek() function as a fallback when it is absolutely necessary.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::currentCharacter):
+        (JSC::Lexer::currentOffset):
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::shift):
+        (JSC::Lexer::peek):
+        (JSC::Lexer::getUnicodeCharacter):
+        (JSC::Lexer::shiftLineTerminator):
+        (JSC::Lexer::lastTokenWasRestrKeyword):
+        (JSC::Lexer::lex):
+        (JSC::Lexer::scanRegExp):
+        (JSC::Lexer::skipRegExp):
+        * parser/Lexer.h:
+
+2010-06-28  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Unreviewed build fix.
+
+        [EFL] Build fix for latest version of Ecore library.
+        Ecore recently changed return type of callbacks from int to Eina_Bool.
+
+        * wtf/efl/MainThreadEfl.cpp:
+        (WTF::timeoutFired): Return Eina_Bool instead of int.
+
+2010-06-28  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QScriptValue should have API for accessing object properties
+        https://bugs.webkit.org/show_bug.cgi?id=40903
+
+        Make possible to access properties inside QScriptValues. While this
+        still doesn't support the ResolveLocal parameter, it is already useful
+        for testing the API.
+
+        The tests from upstream QtScript weren't imported since most of them
+        depend on the setProperty() function as well. A simple test was created.
+
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::property):
+        * qt/api/qscriptvalue.h:
+        (QScriptValue::):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::property):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        (tst_QScriptValue::propertySimple):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Add support for GTK+3
+        https://bugs.webkit.org/show_bug.cgi?id=41253
+
+        Suffix jsc with the API version of the library, so that
+        libwebkitgtk 1.x and 3.x can install jsc.
+
+        * GNUmakefile.am:
+
+2010-06-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Turn ENABLE(SINGLE_THREADED) on.
+        https://bugs.webkit.org/show_bug.cgi?id=41135
+
+        Brew MP does not support preemptive multi-threading.
+        Disable threading for Brew MP.
+
+        * wtf/Platform.h:
+
+2010-06-26  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add an ENABLE_WEB_TIMING option for enabling Web Timing support.
+        https://bugs.webkit.org/show_bug.cgi?id=38924
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-25  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        We assume in testapi.c that the value aHeapRef refers to will not be
+        moved.  When we have movable objects, this will not be the case.
+
+        * API/tests/testapi.c:
+        (main):
+
+2010-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r61924.
+        http://trac.webkit.org/changeset/61924
+        https://bugs.webkit.org/show_bug.cgi?id=41240
+
+        It was rolled out, but cq+ wasn't removed (Requested by Ossy_
+        on #webkit).
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-06-25  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Merge RegExp constructor and RegExp::create methods into one.
+        Both of function are called with tree parameters and check whether 
+        flags (the third param) is given or not.
+        Simplify hash lookups in RegExpCache::create with giving them an extra 
+        iterator parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=41055
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-06-25  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Introduce QtScript benchmarks.
+
+        The QtScript performance should be tested regularly. The patch introduces
+        micro benchmarks for existing API.
+
+        [Qt] Performance of the QtScript API is not tested.
+        https://bugs.webkit.org/show_bug.cgi?id=40911
+
+        * qt/benchmarks/benchmarks.pri: Copied from JavaScriptCore/qt/tests/tests.pri.
+        * qt/benchmarks/benchmarks.pro: Added.
+        * qt/benchmarks/qscriptengine/qscriptengine.pro: Added.
+        * qt/benchmarks/qscriptengine/tst_qscriptengine.cpp: Added.
+        (tst_QScriptEngine::checkSyntax_data):
+        (tst_QScriptEngine::checkSyntax):
+        (tst_QScriptEngine::constructor):
+        (tst_QScriptEngine::evaluateString_data):
+        (tst_QScriptEngine::evaluateString):
+        (tst_QScriptEngine::evaluateProgram_data):
+        (tst_QScriptEngine::evaluateProgram):
+        (tst_QScriptEngine::newObject):
+        (tst_QScriptEngine::nullValue):
+        (tst_QScriptEngine::undefinedValue):
+        (tst_QScriptEngine::globalObject):
+        (tst_QScriptEngine::toStringHandle):
+        * qt/benchmarks/qscriptvalue/qscriptvalue.pro: Added.
+        * qt/benchmarks/qscriptvalue/tst_qscriptvalue.cpp: Added.
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::values_data):
+        (tst_QScriptValue::ctorBool):
+        (tst_QScriptValue::ctorReal):
+        (tst_QScriptValue::ctorNumber):
+        (tst_QScriptValue::ctorQString):
+        (tst_QScriptValue::ctorCString):
+        (tst_QScriptValue::ctorSpecial):
+        (tst_QScriptValue::ctorQScriptValue):
+        (tst_QScriptValue::isValid_data):
+        (tst_QScriptValue::isValid):
+        (tst_QScriptValue::isBool_data):
+        (tst_QScriptValue::isBool):
+        (tst_QScriptValue::isNumber_data):
+        (tst_QScriptValue::isNumber):
+        (tst_QScriptValue::isFunction_data):
+        (tst_QScriptValue::isFunction):
+        (tst_QScriptValue::isNull_data):
+        (tst_QScriptValue::isNull):
+        (tst_QScriptValue::isString_data):
+        (tst_QScriptValue::isString):
+        (tst_QScriptValue::isUndefined_data):
+        (tst_QScriptValue::isUndefined):
+        (tst_QScriptValue::isObject_data):
+        (tst_QScriptValue::isObject):
+        (tst_QScriptValue::isError_data):
+        (tst_QScriptValue::isError):
+        (tst_QScriptValue::toString_data):
+        (tst_QScriptValue::toString):
+        (tst_QScriptValue::toNumber_data):
+        (tst_QScriptValue::toNumber):
+        (tst_QScriptValue::toBool_data):
+        (tst_QScriptValue::toBool):
+        (tst_QScriptValue::toInteger_data):
+        (tst_QScriptValue::toInteger):
+        (tst_QScriptValue::toInt32_data):
+        (tst_QScriptValue::toInt32):
+        (tst_QScriptValue::toUInt32_data):
+        (tst_QScriptValue::toUInt32):
+        (tst_QScriptValue::toUInt16_data):
+        (tst_QScriptValue::toUInt16):
+        (tst_QScriptValue::toObject_data):
+        (tst_QScriptValue::toObject):
+        (tst_QScriptValue::equals_data):
+        (tst_QScriptValue::equals):
+        (tst_QScriptValue::strictlyEquals_data):
+        (tst_QScriptValue::strictlyEquals):
+        (tst_QScriptValue::instanceOf_data):
+        (tst_QScriptValue::instanceOf):
+
+2010-06-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove old js parser
+        https://bugs.webkit.org/show_bug.cgi?id=41222
+
+        Remove the old yacc parser, this also solves the tiger problem.  Which
+        was a conflict between yacc generated token values and those in the
+        custom parser
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pro:
+        * GNUmakefile.am:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * parser/Grammar.y: Removed.
+        * parser/JSParser.cpp:
+        * parser/JSParser.h:
+        * parser/Lexer.cpp:
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * wtf/Platform.h:
+
+2010-06-25  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        New QtScript API; setPrototype() and prototype().
+
+        This patch implements QScriptValue's prototype accessors.
+
+        [Qt] QScriptValue should have accessors to a prototype.
+        https://bugs.webkit.org/show_bug.cgi?id=39356
+
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::prototype):
+        (QScriptValue::setPrototype):
+        * qt/api/qscriptvalue.h:
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::prototype):
+        (QScriptValuePrivate::setPrototype):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        (tst_QScriptValue::getSetPrototype):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+
+2010-06-25  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [CMake] Add option to enable JIT.
+        JIT is disabled by default, but now it's possible to enable it through
+        an option to CMake: -DENABLE_JIT will enable it.
+        https://bugs.webkit.org/show_bug.cgi?id=40936
+
+        * CMakeLists.txt: Add missing files and re-sort.
+
+2010-06-25  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [CMake] Remove unused variable in EFL build system. It was previously
+        being used to set the flags of each port but it was superseded by
+        other flags.
+        https://bugs.webkit.org/show_bug.cgi?id=40931
+
+        * jsc/CMakeLists.txt:
+
+2010-06-25  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Aligning AssemblerBuffer to 128 bytes gives a 0.4% speedup on
+        sunspider.
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::AssemblerBuffer):
+
+2010-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r61842.
+        http://trac.webkit.org/changeset/61842
+        https://bugs.webkit.org/show_bug.cgi?id=41208
+
+        It broke Windows build (Requested by Ossy_ on #webkit).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.h: Removed.
+        * wtf/win/OwnPtrWin.h: Removed.
+
+2010-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r61833.
+        http://trac.webkit.org/changeset/61833
+        https://bugs.webkit.org/show_bug.cgi?id=41205
+
+        It broke Leopard and GTK (Requested by Ossy_ on #webkit).
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-06-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Adam Barth.
+
+        Change OwnPtrCommon to include platform-specific headers
+        https://bugs.webkit.org/show_bug.cgi?id=40279
+
+        Adding new type to OwnPtrCommon needlessly causes all ports to do full rebuilds.
+        Change OwnPtrCommon to include platform-specific headers to avoid all ports rebuilds.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.h: Added.
+        * wtf/win/OwnPtrWin.h: Added.
+
+2010-06-25  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Add the possibility for a head and footer section to create_jit_stubs.
+        https://bugs.webkit.org/show_bug.cgi?id=36050
+
+        * create_jit_stubs:
+
+2010-06-24  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Merge RegExp constructor and RegExp::create methods into one.
+        Both of function are called with tree parameters and check whether 
+        flags (the third param) is given or not.
+        Simplify hash lookups in RegExpCache::create with giving them an extra 
+        iterator parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=41055
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-06-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Incorrect use of '+ 4' and 0 instead of tag and payload offsets in JSValue32_64
+        https://bugs.webkit.org/show_bug.cgi?id=41193
+
+        I noticed a use of '+ 4' in some of the 32_64 code paths and realised there
+        were a few places where endianness was being hardcoded.  This patch fixes
+        the errors i could find through code inspection.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+
+2010-06-24  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        Temporarily get the tiger bot working again by disabling the
+        new JS parser.  GCC on tiger is miscompiling the parser and
+        I don't have access to a tiger machine right now.
+
+        * wtf/Platform.h:
+
+ 2010-06-21  Nathan Lawrence  <nlawrence@apple.com>
+
+         Reviewed by Geoff Garen.
+
+         https://bugs.webkit.org/show_bug.cgi?id=40128
+         Fixed broken debug functionality.
+
+         * interpreter/Interpreter.cpp:
+         (JSC::Interpreter::dumpRegisters):
+             Fixed to work with updated call frame.
+         * runtime/JSImmediate.h:
+         (JSC::JSValue::isCell):
+             Added assert for aligned cell.
+         * runtime/JSValue.cpp:
+         (JSC::JSValue::description):
+             Fixed to work with current JSValue implementation.
+         * runtime/JSZombie.cpp:
+         (JSC::JSZombie::leakedZombieStructure):
+             JSombies compile again.
+
+2010-06-24  Leandro Pereira  <leandro@profusion.mobi>
+
+        Unreviewed build fix.
+
+        * CMakeLists.txt: Add JSParser.cpp.
+
+2010-06-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Single character string replacement may replace too many characters
+        https://bugs.webkit.org/show_bug.cgi?id=41138
+        <rdar://problem/8097496>
+
+        Simple fix to stop the rope path of single character replacement
+        once the first replacement occurs.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::replaceCharacter):
+
+2010-06-24  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix the length of instruction stream controlled by constant pool
+        https://bugs.webkit.org/show_bug.cgi?id=40293
+
+        The initial/maximum length of instruction stream (m_maxDistance) should
+        be set when the first constant arrives to the constant pool. Otherwise
+        the constant pool could be placed into an uninterrupted sequence.
+
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::):
+
+2010-06-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        We assume bytecodeOffset will always return a value > 1,
+        so we adjust the failure case to return 1 instead of 0.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+
+2010-06-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Custom-written JavaScript parser
+        https://bugs.webkit.org/show_bug.cgi?id=34019
+
+        Implement a recursive descent parser similar to that used by V8 and
+        SpiderMonkey.  Greater than 2x improvement in SunSpider parsing tests.
+
+        The parser consists of a JSParser class that uses a TreeBuilder to actually
+        build the AST.  There are currently two builders -- the ASTBuilder and
+        SyntaxChecker which separate the job of building an AST for code generation
+        and simply checking syntactic correctness.
+
+        There's still some less than ideal code remaining in the parser to allow
+        us to retain the existing lexing code with minimal changes.  We'll tidy
+        this up at a later date.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * parser/ASTBuilder.h: Added.
+        (JSC::ASTBuilder::BinaryOpInfo::BinaryOpInfo):
+        (JSC::ASTBuilder::AssignmentInfo::AssignmentInfo):
+        (JSC::ASTBuilder::ASTBuilder):
+        (JSC::ASTBuilder::createSourceElements):
+        (JSC::ASTBuilder::varDeclarations):
+        (JSC::ASTBuilder::funcDeclarations):
+        (JSC::ASTBuilder::features):
+        (JSC::ASTBuilder::numConstants):
+        (JSC::ASTBuilder::appendToComma):
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::createLogicalNot):
+        (JSC::ASTBuilder::createUnaryPlus):
+        (JSC::ASTBuilder::createVoid):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createObjectLiteral):
+        (JSC::ASTBuilder::createArray):
+        (JSC::ASTBuilder::createNumberExpr):
+        (JSC::ASTBuilder::createString):
+        (JSC::ASTBuilder::createBoolean):
+        (JSC::ASTBuilder::createNull):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createRegex):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createConditionalExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArguments):
+        (JSC::ASTBuilder::createArgumentsList):
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::createPropertyList):
+        (JSC::ASTBuilder::createElementList):
+        (JSC::ASTBuilder::createFormalParameterList):
+        (JSC::ASTBuilder::createClause):
+        (JSC::ASTBuilder::createClauseList):
+        (JSC::ASTBuilder::setUsesArguments):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createEmptyStatement):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        (JSC::ASTBuilder::appendConstDecl):
+        (JSC::ASTBuilder::appendStatement):
+        (JSC::ASTBuilder::addVar):
+        (JSC::ASTBuilder::combineCommaNodes):
+        (JSC::ASTBuilder::evalCount):
+        (JSC::ASTBuilder::appendBinaryExpressionInfo):
+        (JSC::ASTBuilder::operatorStackPop):
+        (JSC::ASTBuilder::operatorStackHasHigherPrecedence):
+        (JSC::ASTBuilder::getFromOperandStack):
+        (JSC::ASTBuilder::shrinkOperandStackBy):
+        (JSC::ASTBuilder::appendBinaryOperation):
+        (JSC::ASTBuilder::operatorStackAppend):
+        (JSC::ASTBuilder::popOperandStack):
+        (JSC::ASTBuilder::appendUnaryToken):
+        (JSC::ASTBuilder::unaryTokenStackLastType):
+        (JSC::ASTBuilder::unaryTokenStackLastStart):
+        (JSC::ASTBuilder::unaryTokenStackRemoveLast):
+        (JSC::ASTBuilder::assignmentStackAppend):
+        (JSC::ASTBuilder::createAssignment):
+        (JSC::ASTBuilder::Scope::Scope):
+        (JSC::ASTBuilder::setExceptionLocation):
+        (JSC::ASTBuilder::incConstants):
+        (JSC::ASTBuilder::usesThis):
+        (JSC::ASTBuilder::usesCatch):
+        (JSC::ASTBuilder::usesClosures):
+        (JSC::ASTBuilder::usesArguments):
+        (JSC::ASTBuilder::usesAssignment):
+        (JSC::ASTBuilder::usesWith):
+        (JSC::ASTBuilder::usesEval):
+        (JSC::ASTBuilder::createNumber):
+        (JSC::ASTBuilder::makeTypeOfNode):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeNegateNode):
+        (JSC::ASTBuilder::makeBitwiseNotNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeAddNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeLeftShiftNode):
+        (JSC::ASTBuilder::makeRightShiftNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        * parser/JSParser.cpp: Added.
+        (JSC::JSParser::AllowInOverride::AllowInOverride):
+        (JSC::JSParser::AllowInOverride::~AllowInOverride):
+        (JSC::JSParser::token):
+        (JSC::JSParser::next):
+        (JSC::JSParser::consume):
+        (JSC::JSParser::match):
+        (JSC::JSParser::tokenStart):
+        (JSC::JSParser::tokenLine):
+        (JSC::JSParser::tokenEnd):
+        (JSC::JSParser::):
+        (JSC::JSParser::autoSemiColon):
+        (JSC::JSParser::canRecurse):
+        (JSC::JSParser::lastTokenEnd):
+        (JSC::jsParse):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::allowAutomaticSemicolon):
+        (JSC::JSParser::parseSourceElements):
+        (JSC::JSParser::parseVarDeclaration):
+        (JSC::JSParser::parseConstDeclaration):
+        (JSC::JSParser::parseDoWhileStatement):
+        (JSC::JSParser::parseWhileStatement):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseConstDeclarationList):
+        (JSC::JSParser::parseForStatement):
+        (JSC::JSParser::parseBreakStatement):
+        (JSC::JSParser::parseContinueStatement):
+        (JSC::JSParser::parseReturnStatement):
+        (JSC::JSParser::parseThrowStatement):
+        (JSC::JSParser::parseWithStatement):
+        (JSC::JSParser::parseSwitchStatement):
+        (JSC::JSParser::parseSwitchClauses):
+        (JSC::JSParser::parseSwitchDefaultClause):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseDebuggerStatement):
+        (JSC::JSParser::parseBlockStatement):
+        (JSC::JSParser::parseStatement):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionBody):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseFunctionDeclaration):
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+        (JSC::JSParser::parseExpressionStatement):
+        (JSC::JSParser::parseIfStatement):
+        (JSC::JSParser::parseExpression):
+        (JSC::JSParser::parseAssignmentExpression):
+        (JSC::JSParser::parseConditionalExpression):
+        (JSC::isUnaryOp):
+        (JSC::JSParser::isBinaryOperator):
+        (JSC::JSParser::parseBinaryExpression):
+        (JSC::JSParser::parseProperty):
+        (JSC::JSParser::parseObjectLiteral):
+        (JSC::JSParser::parseArrayLiteral):
+        (JSC::JSParser::parsePrimaryExpression):
+        (JSC::JSParser::parseArguments):
+        (JSC::JSParser::parseMemberExpression):
+        (JSC::JSParser::parseUnaryExpression):
+        * parser/JSParser.h: Added.
+        (JSC::):
+        (JSC::JSTokenInfo::JSTokenInfo):
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::setLastLineNumber):
+        (JSC::Lexer::lastLineNumber):
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/SyntaxChecker.h: Added.
+        (JSC::SyntaxChecker::SyntaxChecker):
+        (JSC::SyntaxChecker::createSourceElements):
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::appendToComma):
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeTypeOfNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::makeNegateNode):
+        (JSC::SyntaxChecker::makeBitwiseNotNode):
+        (JSC::SyntaxChecker::createLogicalNot):
+        (JSC::SyntaxChecker::createUnaryPlus):
+        (JSC::SyntaxChecker::createVoid):
+        (JSC::SyntaxChecker::thisExpr):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        (JSC::SyntaxChecker::createArray):
+        (JSC::SyntaxChecker::createNumberExpr):
+        (JSC::SyntaxChecker::createString):
+        (JSC::SyntaxChecker::createBoolean):
+        (JSC::SyntaxChecker::createNull):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegex):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createArguments):
+        (JSC::SyntaxChecker::createArgumentsList):
+        (JSC::SyntaxChecker::createProperty):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createElementList):
+        (JSC::SyntaxChecker::createFormalParameterList):
+        (JSC::SyntaxChecker::createClause):
+        (JSC::SyntaxChecker::createClauseList):
+        (JSC::SyntaxChecker::setUsesArguments):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createBlockStatement):
+        (JSC::SyntaxChecker::createExprStatement):
+        (JSC::SyntaxChecker::createIfStatement):
+        (JSC::SyntaxChecker::createForLoop):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createEmptyStatement):
+        (JSC::SyntaxChecker::createVarStatement):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createDoWhileStatement):
+        (JSC::SyntaxChecker::createLabelStatement):
+        (JSC::SyntaxChecker::createThrowStatement):
+        (JSC::SyntaxChecker::createDebugger):
+        (JSC::SyntaxChecker::createConstStatement):
+        (JSC::SyntaxChecker::appendConstDecl):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        (JSC::SyntaxChecker::appendStatement):
+        (JSC::SyntaxChecker::addVar):
+        (JSC::SyntaxChecker::combineCommaNodes):
+        (JSC::SyntaxChecker::evalCount):
+        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/JSGlobalData.h:
+        * wtf/Platform.h:
+        * wtf/ThreadSpecific.h:
+        (WTF::T):
+
+2010-06-23  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Optimization of the QScriptValuePrivate.
+
+        Patch change only internals of the QScriptValuePrivate.
+        Most of the QScriptValuePrivate's attributes were moved
+        into an union.
+
+        [Qt] Optimization of the QScriptVAluePrivate.
+        https://bugs.webkit.org/show_bug.cgi?id=40415
+
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::globalObject):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::~QScriptValuePrivate):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::toObject):
+        (QScriptValuePrivate::equals):
+        (QScriptValuePrivate::strictlyEquals):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::operator JSValueRef):
+        (QScriptValuePrivate::operator JSObjectRef):
+        (QScriptValuePrivate::refinedJSValue):
+
+2010-06-23  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] Implement ThreadSpecific with glib
+        https://bugs.webkit.org/show_bug.cgi?id=39829
+
+        Implement ThreadSpecific with glib's GStaticPrivate.
+        This patch makes it possible to build GTK port without pthread.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::::ThreadSpecific):
+        (WTF::::~ThreadSpecific):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::destroy):
+
+2010-06-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Unreviewed build fix.
+
+        * CMakeLists.txt: Add runtime/RegExpCache.cpp.
+
+2010-06-22  Renata Hodovan  <hodovan@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Adding regular expression caching to JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=38142
+
+        The cache is based on Round Robin eviction policy, and
+        can cache at most 256 character long regular expressions,
+        and at most 256 of them. These values can be changed at compile time.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::regExpCache):
+        * runtime/RegExpCache.cpp: Added.
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        (JSC::RegExpCache::RegExpCache):
+        * runtime/RegExpCache.h: Added.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpKey.h: Added.
+        (JSC::RegExpKey::RegExpKey):
+        (JSC::RegExpKey::getFlagsValue):
+        (WTF::operator==):
+        (WTF::):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+
+2010-06-22  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add native call support for ARM and Thumb-2 JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=40231
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * wtf/Platform.h:
+
+2010-06-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make JSC more resilient in the face of parse failures
+        https://bugs.webkit.org/show_bug.cgi?id=40951
+
+        A number of recent bugs have occurred due to issues like miscounting
+        BOMs, etc which lead to interesting crashes later on.  Adding this
+        logic hardens JSC in the face of these errors, and has no impact on
+        performance (32bit jit actually gets 0.7% faster but I put that down
+        to cache effects).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct):
+        (JSC::FunctionExecutable::generateJITCodeForCall):
+        (JSC::FunctionExecutable::generateJITCodeForConstruct):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::bytecodeForCall):
+        (JSC::FunctionExecutable::bytecodeForConstruct):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::numericCompareFunction):
+
+2010-06-21  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Adam Roben.
+
+        RetainPtr can't be used in HashMaps or HashSets
+        <https://bugs.webkit.org/show_bug.cgi?id=40938>
+        
+        Added hashing knowledge similar to that in COMPtr.h.
+
+        * wtf/RetainPtr.h:
+        (WTF::RetainPtr::RetainPtr):
+        New function, copied from COMPtr.h but for the type change.
+        (WTF::RetainPtr::isHashTableDeletedValue):
+        Ditto.
+        (WTF::RetainPtr::hashTableDeletedValue):
+        Ditto.
+        Added template code for HashTraits and PtrHash copied from COMPtr.h but for the type change.
+        The only difference is that constructDeletedValue() matches the RefPtr implementation (in HashTraits.h)
+        rather than the COMPtr implementation.
+
+2010-06-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Need to ensure that we grow the RegisterFile when creating a callframe for host code
+        https://bugs.webkit.org/show_bug.cgi?id=40858
+        <rdar://problem/8108986>
+
+        In the past the use of the callframe in hostcode was much more
+        limited.  Now that we expect the callframe to always be valid
+        we need to grow the RegisterFile so that this is actually the
+        case.  In this particular case the problem was failing to grow
+        the registerfile could lead to a callframe that extended beyond
+        RegisterFiler::end(), so vm re-entry would clobber the callframe
+        other scenarios could also lead to badness.
+
+        I was unable to construct a simple testcase to trigger badness,
+        and any such testcase would be so dependent on exact vm stack
+        layout that it would be unlikely to work as a testcase following
+        any callframe or register allocation changes anyway.
+
+        Thankfully the new assertion I added should help to catch these
+        failures in future, and triggers on a couple of tests currently.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::registerFile):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::init):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-06-21  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Speech Input Patch 0: Added compilation argument to conditionally compile pending patches.
+        https://bugs.webkit.org/show_bug.cgi?id=40878
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Use global new/delete operator overloading with USE_SYSTEM_MALLOC=1
+        https://bugs.webkit.org/show_bug.cgi?id=40653
+
+        Currently, other ports do not use global new/delete operator overloading
+        when USE_SYSTEM_MALLOC=1. Brew MP uses system malloc, but it needs to enable
+        "global fastMalloc new" because the default new/delete causes crash on device.
+        We need to replace them with Brew MP's MALLOC/FREE.
+
+        * wtf/FastMalloc.h:
+
+2010-06-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Work around a build problem with libjscore on Symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=40840
+
+        Sbsv2 sometimes have problems with debug/release configuration
+        determination causing QtWebKit in release to try linking with the debug
+        JavaScriptCore static library. This patch limit the jscore/jscored
+        r58306 fix necessary for mac builds only to the mac platform to prevent the
+        different name problem.
+
+        The real fix would be to fix qmake or the toolchain, this patch might
+        help meanwhile.
+
+        * JavaScriptCore.pri:
+
+2010-06-21  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Kent Tamura.
+
+        Buildfix after r61338.
+        https://bugs.webkit.org/show_bug.cgi?id=40888
+
+        roundUpAllocationSize is needed in RegisterFile.h.
+
+        * jit/ExecutableAllocator.h:
+
+2010-06-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Include <string.h> in StringExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=40808
+
+        Without string.h, RVCT 2.2 can't compile StringExtras.h.
+        It can't find strlen and strncmp.
+
+        * wtf/StringExtras.h:
+
+2010-06-19  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Don't use __attribute__((may_alias)) with the Intel compiler,
+        as it doesn't understand it.
+
+        * wtf/Vector.h:
+
+2010-06-19  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix compilation with the Intel C++ compiler (11.1.072).
+
+        Like RVCT, label pointers must be void*, not const void*.
+
+        * bytecode/Opcode.h:
+
+2010-06-19  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add the WTF_COMPILER_INTEL for when the Intel compiler is used
+        for building. Usually, the Intel compiler masquerades as
+        another compiler in the system and gets away with it, but some
+        times specific fixes are required (such as when using language
+        extensions).
+
+        * wtf/Platform.h:
+
+2010-06-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Incorrect handling of multiple BOMs scattered through a file.
+        https://bugs.webkit.org/show_bug.cgi?id=40865
+
+        When determining the offset of open and close braces in a source
+        with BOMs we were finishing our count early as we failed to account
+        for BOMs prior to the open/close brace positions effecting those
+        positions.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::sourceCode):
+
+2010-06-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Don't throw away exception information for functions that use exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=40786
+
+        Simple patch to stop JSC from throwing away the exception information
+        of a function that uses "exceptiony" features like try and throw.  This
+        is a speed up for catching expressions but it's difficult to quantify as
+        the old cost of reparsing is amortised over all exceptions caught in the
+        effected function.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::emitCatch):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitThrow):
+
+2010-06-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add PlatformStrategies and PluginStrategy classes.
+        https://bugs.webkit.org/show_bug.cgi?id=40850
+
+        * wtf/Platform.h:
+
+2010-06-18  Leandro Pereira  <leandro@profusion.mobi>
+
+        [EFL] Unreviewed build fix.
+
+        * wtf/CMakeLists.txt: Add MD5.cpp.
+
+2010-06-17  Shu Chang  <chang.shu@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix the link error on symbian with ENABLE_JIT=0.
+        1. Add "#if ENABLE(JIT)" in the header file;
+        2. Put feature enable/disable logic to a common.pri so
+        that both JavaScriptCore.pri and WebCore.pri can share.
+
+        https://bugs.webkit.org/show_bug.cgi?id=40780
+
+        * JavaScriptCore.pri:
+        * jit/ExecutableAllocator.h:
+
+2010-06-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use adoptRef and create functions in more code paths
+        https://bugs.webkit.org/show_bug.cgi?id=40760
+
+        * API/JSClassRef.h: Removed unneeded include of RefCounted.h.
+        * API/JSWeakObjectMapRefPrivate.cpp: Ditto.
+
+        * bytecode/CodeBlock.h:
+        (JSC::FunctionCodeBlock::FunctionCodeBlock): Use the
+        SharedSymbolTable::create function instead of calling new directly.
+
+        * runtime/SymbolTable.h: Added a create function to the SharedSymbolTable
+        class and made the constructor private.
+
+2010-06-17  Mark Brand  <mabrand@mabrand.nl>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] use "win32-g++*" scope to match all MinGW makespecs
+
+        The scope "win32-g++" comes from the name of the makespec. However, it
+        is frequently used to check for MinGW. This works fine as long as
+        win32-g++ is the only makespec for MinGW. Now we need the wildcard
+        to cover "win32-g++-cross" as well.
+
+        * JavaScriptCore.pro:
+
+2010-06-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Deploy adoptRef in more places, including all HTML and MathML elements
+        https://bugs.webkit.org/show_bug.cgi?id=39941
+
+        * wtf/ThreadSafeShared.h: Made the constructor protected and removed the
+        unneeded support for initial reference counts other than 1.
+
+2010-06-16  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Store matchBegin directly in the array of output instead of the stack.
+        https://bugs.webkit.org/show_bug.cgi?id=38988
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        (JSC::Yarr::RegexGenerator::generate):
+
+2010-06-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make JavaScriptCore build with clang++.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutVirtualRegister):
+        Explicitly cast to an int.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::compileRegex):
+        Return 0 instead of false.
+
+2010-06-15  Adam Roben  <aroben@apple.com>
+
+        Make WebCore's and JavaScriptCore's DerivedSources available for debugging in production builds
+
+        Fixes <http://webkit.org/b/40626> <rdar://problem/8094205>.
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Copy the contents of
+        JavaScriptCore's DerivedSources directory to
+        AppleInternal/Sources/JavaScriptCore.
+
+2010-06-15  Gabor Loki  <loki@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        Fix invalid access to non-static data member warning in JITPropertyAccess32_64 on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=40423
+
+        Using OBJECT_OFFSETOF macro instead of objectof to bypass access to
+        non-static data member warning.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2010-06-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename the rest of the *Tokenizer classes to *DocumentParser
+        https://bugs.webkit.org/show_bug.cgi?id=40507
+
+        * wtf/Platform.h:
+         - fixed a comment to match new names.
+
+2010-06-11  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Explicit conversions from QtScript types to JSC opaque types were removed.
+        https://bugs.webkit.org/show_bug.cgi?id=40412
+
+        Conversion between a JSC C types and a QtScript private types, takes
+        main part of the source code. In most cases a mapping between the types
+        is one to one. New cast operators were added to simplify the code.
+
+        The QScriptValuePrivate could be casted to the JSValueRef and the JSObjectRef.
+        The QScriptEnginePrivate could be casted to the JSGlobalContext.
+        The QScriptProgramPrivate could be casted to the JSStringRef.
+
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::evaluate):
+        (QScriptEnginePrivate::newObject):
+        (QScriptEnginePrivate::globalObject):
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::operator JSGlobalContextRef):
+        * qt/api/qscriptprogram_p.h:
+        (QScriptProgramPrivate::operator JSStringRef):
+        * qt/api/qscriptsyntaxcheckresult.cpp:
+        (QScriptSyntaxCheckResultPrivate::~QScriptSyntaxCheckResultPrivate):
+        (QScriptSyntaxCheckResultPrivate::errorMessage):
+        (QScriptSyntaxCheckResultPrivate::errorLineNumber):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::~QScriptValuePrivate):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::isFunction):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::toObject):
+        (QScriptValuePrivate::equals):
+        (QScriptValuePrivate::strictlyEquals):
+        (QScriptValuePrivate::instanceOf):
+        (QScriptValuePrivate::call):
+        (QScriptValuePrivate::operator JSValueRef):
+        (QScriptValuePrivate::operator JSObjectRef):
+        (QScriptValuePrivate::setValue):
+        (QScriptValuePrivate::inherits):
+        (QScriptValuePrivate::refinedJSValue):
+
+2010-05-31  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement the simple text code path.
+        https://bugs.webkit.org/show_bug.cgi?id=40077
+
+        Remove the FONT_FAST_PATH macro and use the Qt's
+        fast text implementation instead of the one of WebKit.
+
+        The Qt::TextBypassShaping flag is used to tell Qt to
+        only use the glyph advances.
+
+        Qt 4.7 is needed to get this flag thus the complex path is always
+        used if QtWebKit is compiled against an earlier version.
+
+        Contrary to the WebKit's implementation, the complex code path
+        is taken if the text is RightToLeft, justified or is formatted
+        with non-zero letter or word spacing.
+
+        * wtf/Platform.h:
+
+2010-06-11  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        add codePointCompare to JavaScriptCore.exp
+        https://bugs.webkit.org/show_bug.cgi?id=40426
+
+        * JavaScriptCore.exp:
+
+2010-06-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Math Javascript Bug on Safari 5 (webkit 533.16) under "32bit" mode
+        https://bugs.webkit.org/show_bug.cgi?id=40367
+
+        If we're in the slow case of right shift we must write the type tag as
+        the only reason we hit this code path is because we know we're working
+        with a double.  eg. we are guaranteed that the tag cannot be reused.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitRightShiftSlowCase):
+
+2010-06-10  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Remove weakRandomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=40291
+
+        weakRandomNumber is used nowhere. Currently, WeakRandom is used instead.
+
+        * wtf/RandomNumber.cpp:
+        * wtf/RandomNumber.h:
+
+2010-06-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Export StringImpl::ascii(). It might be not very useful, but it's a public function.
+
+        * JavaScriptCore.exp:
+
+2010-06-09  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Adam Treat.
+
+        [EFL] Allow building core libraries as shared objects to speed up
+        linking time on machines with small amounts of memory.
+        http://webkit.org/b/39899
+
+        * CMakeLists.txt: If building with shared core, install the lib.
+        * jsc/CMakeListsEfl.txt: Needs Glib and Ecore to link dynamically.
+        * wtf/CMakeLists.txt: If building with shared core, install the lib.
+
+2010-06-09  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by David Levin.
+
+        Remove some unused variable warnings from JITOpcodes
+        https://bugs.webkit.org/show_bug.cgi?id=40298
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+
+2010-05-18  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Shinichiro Hamaji.
+
+        Fix for Bug 34529 -  [CSSOM] issues with cssText and selectorText
+        Add U16_LENGTH that is needed to implement CSS character serialization.
+        https://bugs.webkit.org/show_bug.cgi?id=34529
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        * wtf/unicode/wince/UnicodeWince.h:
+
+2010-06-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r60830.
+        http://trac.webkit.org/changeset/60830
+        https://bugs.webkit.org/show_bug.cgi?id=40305
+
+        Broke the Windows build (Requested by abarth on #webkit).
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.h: Removed.
+        * wtf/win/OwnPtrWin.h: Removed.
+
+2010-06-08  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed. An attempt to fix test break.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-08  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Adam Barth.
+
+        Change OwnPtrCommon to include platform-specific headers
+        https://bugs.webkit.org/show_bug.cgi?id=40279
+
+        Adding new type to OwnPtrCommon needlessly causes all ports to do full rebuilds.
+        Change OwnPtrCommon to include platform-specific headers to avoid all ports rebuilds.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.h: Added.
+        * wtf/win/OwnPtrWin.h: Added.
+
+2010-06-07  MORITA Hajime  <morrita@google.com>
+        
+        Reviewed by Kent Tamura.
+
+        https://bugs.webkit.org/show_bug.cgi?id=40219
+        [Mac] ENABLE_METER_TAG should be enabled
+        
+        Added ENABLE_METER_TAG.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-07  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add more types to OwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=39667
+
+        Add ISSL and ISocket to the list of OwnPtr-ed type.
+
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.cpp:
+        (WTF::deleteOwnedPtr):
+
+2010-06-07  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Crash when compiling on Snow Leopard and running on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=31403
+
+        Disable the use of pthread_setname_np and other symbols
+        when targetting Leopard.
+
+        Use the defines TARGETING_XX instead of BUILDING_ON_XX 
+        for features that cannot be used before Snow Leopard.
+
+        * wtf/Platform.h:
+
+2010-06-07  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by NOBODY (JSVALUE32_64 build fix).
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+
+2010-06-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix pt 2).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-06-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix pt 1).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-06-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 40214 - Clean up error construction / throwing in JSC.
+        
+        The one egregious insanity here is that creating an error requires
+        a VM-entry-esqe-host call (the string argument is wrapped as a JS
+        object & pushed on the RegisterFile, then unwrapped back to a
+        UString).  Changing this also means you only require a global
+        object, not an ExecState, to create an error.
+
+        The methods to create error objects are also parameterized
+        requiring a switch on the type, which can be made cleaner and
+        faster by moving to a separate method per error type.  Code to add
+        divot information to error had been duplicated, and is coalesced
+        back into a single function.
+
+        Convenience methods added to create & throw type & syntax error
+        with a default error message, since this is a common case.
+
+        Also, errors are currently thrown either using
+        "throwError(exec, error)" or "exec->setException(error)" - unify
+        on the former, since this is more commonly used.  Add
+        "throwVMError(exec, error)" equivalents, as a convenience for
+        cases where the result was being wrapped in "JSValue::encode(...)".
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeError):
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewError):
+        (JSC::BytecodeGenerator::emitThrowExpressionTooDeepException):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThrowableExpressionData::emitThrowError):
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::PostfixErrorNode::emitBytecode):
+        (JSC::PrefixErrorNode::emitBytecode):
+        (JSC::AssignErrorNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (functionRun):
+        (functionLoad):
+        (functionCheckSyntax):
+        * parser/Nodes.h:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        (JSC::dateProtoFuncToJSON):
+        * runtime/Error.cpp:
+        (JSC::createError):
+        (JSC::createEvalError):
+        (JSC::createRangeError):
+        (JSC::createReferenceError):
+        (JSC::createSyntaxError):
+        (JSC::createTypeError):
+        (JSC::createURIError):
+        (JSC::addErrorSourceInfo):
+        (JSC::addErrorDivotInfo):
+        (JSC::addErrorInfo):
+        (JSC::hasErrorInfo):
+        (JSC::throwError):
+        (JSC::throwTypeError):
+        (JSC::throwSyntaxError):
+        * runtime/Error.h:
+        (JSC::throwVMError):
+        (JSC::throwVMTypeError):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructWithErrorConstructor):
+        (JSC::callErrorConstructor):
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        (JSC::ErrorInstance::create):
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createStackOverflowError):
+        (JSC::createUndefinedVariableError):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        (JSC::throwOutOfMemoryError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compile):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::from):
+        * runtime/Identifier.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::put):
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSObject.cpp:
+        (JSC::throwSetterError):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::JSObject::defaultValue):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::synthesizeObject):
+        (JSC::JSValue::synthesizePrototype):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::constructWithNativeErrorConstructor):
+        (JSC::callNativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncToString):
+
+2010-06-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add PLATFORM(BREWMP) guard for using std::xxx
+        https://bugs.webkit.org/show_bug.cgi?id=39710
+
+        Build fix for BREW MP.
+
+        * wtf/MathExtras.h:
+
+2010-06-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        HTML5 parser should be within 1% of old parser performance
+        https://bugs.webkit.org/show_bug.cgi?id=40172
+
+        Fix cast in this operator= to allow for assignment between vectors with
+        different inline capacities (as clearly intended by its author).
+
+        * wtf/Vector.h:
+        (WTF::::operator):
+
+2010-06-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        New QtScript API; QScriptValue::instanceOf.
+
+        New function create an easy way to check value's prototype hierarchy.
+
+        [Qt] QScriptValue should have an instanceOf method
+        https://bugs.webkit.org/show_bug.cgi?id=40120
+
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::instanceOf):
+        * qt/api/qscriptvalue.h:
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::instanceOf):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_comparison.cpp:
+        (tst_QScriptValue::instanceOf_initData):
+        (tst_QScriptValue::instanceOf_makeData):
+        (tst_QScriptValue::instanceOf_test):
+
+2010-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (interpreter build fix).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-06-04  Mark Rowe  <mrowe@apple.com>
+
+        Silence some warnings seen on the build bot.
+
+        * JavaScriptCore.JSVALUE32_64only.exp: Add a trailing newline.
+        * JavaScriptCore.JSVALUE32only.exp: Ditto.
+        * JavaScriptCore.JSVALUE64only.exp: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Remove the .exp files from all targets so that Xcode doesn't
+        complain about not knowing how to compile them.
+
+2010-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 40187 - Change function signature of NativeConstructor to match NativeFunction
+
+        Mostly for consistency, but constructor & args arguments are redundant,
+        and this will help if we wish to be able to JIT calls to more constructors.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::construct):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeConstruct):
+        * interpreter/Interpreter.h:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructWithArrayConstructor):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructWithBooleanConstructor):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ConstructData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructWithDateConstructor):
+        * runtime/Error.cpp:
+        (JSC::constructNativeError):
+        (JSC::Error::create):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructWithErrorConstructor):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructWithFunctionConstructor):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::constructWithNativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::errorStructure):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructWithObjectConstructor):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructWithRegExpConstructor):
+        * runtime/StringConstructor.cpp:
+        (JSC::constructWithStringConstructor):
+
+2010-06-04  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a takeFirst() method to Deque and use it where appropriate.
+        https://bugs.webkit.org/show_bug.cgi?id=40089
+
+        * wtf/Deque.h:
+        (WTF::::takeFirst):
+        * wtf/MainThread.cpp:
+        (WTF::dispatchFunctionsFromMainThread):
+        * wtf/MessageQueue.h:
+        (WTF::::tryGetMessage):
+
+2010-06-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Remove a QEXPECT_FAIL flag from an autotest.
+
+        Test tst_QScriptEngine::globalObject pass after 36600 bug
+        fix have been applied.
+
+        [Qt] Expected fail in the tst_QScriptEngine::globalObject should be removed.
+        https://bugs.webkit.org/show_bug.cgi?id=40114
+
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::globalObject):
+
+2010-06-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix QScriptValue::equals.
+
+        Handling for a few edge cases were added. Now comparison between
+        NaN, an invalid objects should works as supposed.
+
+        [Qt] QScriptValue::equals problems
+        https://bugs.webkit.org/show_bug.cgi?id=40110
+
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::equals):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::equals):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_comparison.cpp:
+        (tst_QScriptValue::equals_initData):
+        (tst_QScriptValue::equals_makeData):
+        (tst_QScriptValue::equals_test):
+
+2010-06-03  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        New states in QScriptValuePrivate.
+
+        The CSpecial state was divided into CNull and CUndefined. It simplify
+        the QScriptValue code by avoiding a few "cast" and "if".
+        Moreover the MSVS compiler didn't like casting between a double and an
+        enum which is avoided now.
+
+        [Qt] The QScriptValuePrivate::CSpecial is too generic.
+        https://bugs.webkit.org/show_bug.cgi?id=40067
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::toObject):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::isNumberBased):
+
+2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Qt build fix).
+
+        * wtf/Platform.h:
+
+2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 40150 - ENABLE_JIT_OPTIMIZE_NATIVE_CALL on all x86/x86_64 platforms
+        This was fixed in bug #40094.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/Platform.h:
+
+2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Interpreter build fix).
+
+        * JavaScriptCore.JSVALUE32_64only.exp:
+        * JavaScriptCore.JSVALUE32only.exp:
+        * JavaScriptCore.JSVALUE64only.exp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix II).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-06-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 40094 - The return type of NativeFunction should be EncodedJSValue
+        On Windows & Linux, using JSVALUE32_64, EncodedJSValue is returned in registers, but JSValue is not.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::call):
+        * JavaScriptCore.exp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeCall):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionCheckSyntax):
+        (functionSetSamplingFlags):
+        (functionClearSamplingFlags):
+        (functionReadline):
+        (functionQuit):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        (JSC::arrayConstructorIsArray):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CallData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        (JSC::dateProtoFuncToJSON):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/JSCell.h:
+        (JSC::getCallData):
+        (JSC::getConstructData):
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSObject.cpp:
+        (JSC::callDefaultValueFunction):
+        * runtime/JSValue.h:
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::callObjectConstructor):
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpObject.cpp:
+        (JSC::callRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::stringProtoFuncTrim):
+        (JSC::stringProtoFuncTrimLeft):
+        (JSC::stringProtoFuncTrimRight):
+
+2010-06-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add value-representation specific sections to the mac export file.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * DerivedSources.make:
+        * JavaScriptCore.JSVALUE32_64only.exp: Added.
+        * JavaScriptCore.JSVALUE32only.exp: Added.
+        * JavaScriptCore.JSVALUE64only.exp: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-06-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/8054988> Work around an LLVM GCC code generation bug that results in crashes inside PCRE.
+
+        * pcre/pcre_exec.cpp:
+        (repeatInformationFromInstructionOffset): Change the type of instructionOffset to int.  There's no good
+        reason for it to be a short, and using int prevents this code from triggering the LLVM GCC bug.
+
+2010-06-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix the QScriptValue::strictlyEquals function.
+
+        Handling for a few edge cases was added.
+
+        New autotest that covers the QScriptValue::strictlyEquals function.
+
+        [Qt] QScriptValue::strictlyEquals is broken
+        https://bugs.webkit.org/show_bug.cgi?id=36600
+
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::strictlyEquals):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::strictlyEquals):
+        * qt/tests/qscriptvalue/qscriptvalue.pro:
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_comparison.cpp: Added.
+        (tst_QScriptValue::strictlyEquals_initData):
+        (tst_QScriptValue::strictlyEquals_makeData):
+        (tst_QScriptValue::strictlyEquals_test):
+
+2010-06-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        New function QScriptEngine::newObject.
+
+        The function creates a object of class Object and returns it
+        as a QScriptValue.
+
+        [Qt] QScriptEngine API should contain a newObject function
+        https://bugs.webkit.org/show_bug.cgi?id=39114
+
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::newObject):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::newObject):
+        * qt/api/qscriptengine_p.h:
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::newObject):
+
+2010-06-02  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+        https://bugs.webkit.org/show_bug.cgi?id=40011
+
+        Thumb-2 build fix: The offset parameter of ldrh should be encoded as an
+        imm12 immediate constant in load16. If it is not fit in the instruction
+        a temporary register has to be used.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load16):
+
+2010-06-02  Sterling Swigart  <sswigart@google.com>
+
+        Reviewed by David Levin.
+
+        Image Resizer Patch 0: Added compilation argument to conditionally compile pending patches.
+        https://bugs.webkit.org/show_bug.cgi?id=39906
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 40021 - Refactor bytecode generation for calls so that register for this & args are allocated together
+
+        This is a useful stepping stone towards reversing argument order.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addParameter):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::thisRegister):
+        (JSC::CallArguments::argumentRegister):
+        (JSC::CallArguments::callFrame):
+        (JSC::CallArguments::count):
+        (JSC::BytecodeGenerator::shouldEmitProfileHooks):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::NewExprNode::emitBytecode):
+        (JSC::CallArguments::CallArguments):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+2010-06-01  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Explicitly use PTHREAD_MUTEX_NORMAL to create pthread mutex.
+        https://bugs.webkit.org/show_bug.cgi?id=39893
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::Mutex::Mutex):
+
+2010-06-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Use DEFINE_STATIC_LOCAL for threadMapMutex and threadMap
+        https://bugs.webkit.org/show_bug.cgi?id=39831
+
+        Use DEFINE_STATIC_LOCAL for static local variables.
+
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::identifierByGthreadHandle):
+
+2010-06-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Shinichiro Hamaji.
+
+        Fix style errors of dtoa
+        https://bugs.webkit.org/show_bug.cgi?id=39972
+
+        Fix all errors reported by check-webkit-style.
+
+        * wtf/dtoa.cpp:
+        * wtf/dtoa.h:
+
+2010-05-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * wtf/OwnArrayPtr.h:
+        (WTF::OwnArrayPtr::set): Fix the assertion in here to match the one in OwnPtr.
+        At some point someone fixed the "asserts when assigning to 0 and the pointer is
+        already 0" issue in OwnPtr but forgot to do it here.
+
+2010-05-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Updated exported symbols.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Disabled ENABLE_JIT_OPTIMIZE_NATIVE_CALL on Windows for now, until I
+        can figure out why it's crashing.
+
+        * wtf/Platform.h:
+
+2010-05-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed Windows crash seen on buildbot.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall): __fastcall puts the first
+        argument in ecx.
+
+2010-05-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Updated exported symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: disable a little more stuff when JIT_OPTIMIZE_NATIVE_CALL
+        is disabled.
+
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        * wtf/Platform.h:
+
+2010-05-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Updated exported symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig, Gavin Barraclough, Oliver Hunt.
+
+        Simplified the host calling convention.
+        
+        22.5% speedup on 32-bit host function calls. 9.5% speedup on 64-bit host
+        function calls.
+        
+        No change on SunSpider.
+        
+        All JS calls (but not constructs, yet) now go through the normal JS
+        calling convention via the RegisterFile. As a result, the host calling
+        convention, which used to be this
+
+            JSValue (JSC_HOST_CALL *NativeFunction)(ExecState*, JSObject*, JSValue thisValue, const ArgList&)
+            
+        is now this
+
+            JSValue (JSC_HOST_CALL *NativeFunction)(ExecState*)
+            
+        Callee, 'this', and argument access all hapen relative to the ExecState*,
+        which is a pointer into the RegisterFile.
+        
+        This patch comes in two parts.
+        
+        PART ONE: Functional code changes.
+        
+        * wtf/Platform.h: Disabled optimized calls on platforms I didn't test.
+        We can re-enable once we verify that host calls on these platforms are
+        correct.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::calculatedFunctionName): Updated for change to
+        ExecState::callee().
+
+        (JSC::DebuggerCallFrame::thisObject): Updated for removal of ExecState::thisValue().
+
+        * interpreter/CallFrame.cpp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::callee):
+        (JSC::ExecState::scopeChain):
+        (JSC::ExecState::init): Changed callee() to be JSObject* instead of
+        JSFunction* -- now, it might be some other callable host object.
+
+        (JSC::ExecState::hostThisRegister):
+        (JSC::ExecState::hostThisValue):
+        (JSC::ExecState::argumentCount):
+        (JSC::ExecState::argumentCountIncludingThis):
+        (JSC::ExecState::argument):
+        (JSC::ExecState::setArgumentCountIncludingThis):
+        (JSC::ExecState::setCallee): Added convenient accessors for arguments
+        from within a host function. Removed thisValue() because it was too
+        tempting to use incorrectly, and it only had one or two clients, anyway.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval): Updated for removal of ExecState::thisValue().
+
+        (JSC::Interpreter::throwException): Be sure to shrink the register file
+        before invoking the exception handler, to reduce the chances that the
+        handler will re-throw in the case of stack overflow. (Re-throwing is now
+        more likely than it used to be, since standardizing the calling convention
+        implicitly added stack overflow checks to some places where they used to be missing.)
+
+        (JSC::Interpreter::execute): Clarified the scope of DynamicGlobalObjectScope.
+        Updated for CallFrame::init API change.
+
+        (JSC::Interpreter::executeCall): Clarified scope of DynamicGlobalObjectScope.
+        Updated for CallFrame::init API change. Added support for calling a host
+        function.
+
+        (JSC::Interpreter::executeConstruct): Clarified scope of DynamicGlobalObjectScope.
+        Updated for CallFrame::init API change. 
+
+        (JSC::Interpreter::prepareForRepeatCall): Updated for CallFrame::init API change. 
+
+        (JSC::Interpreter::privateExecute): Updated for CallFrame::init API change.
+        Added some explicit JSValue(JSObject*) initialization, since relaxing
+        the JSFunction* restriction on callee has made register types more ambiguous.
+        Removed toThisObject() conversion, since all callees do it themselves now.
+        Updated host function call for new host function signature. Updated for
+        change to ExecState::argumentCount() API.
+
+        * interpreter/Register.h:
+        (JSC::Register::):
+        (JSC::Register::operator=):
+        (JSC::Register::function): Changed callee() to be JSObject* instead of
+        JSFunction* -- now, it might be some other callable host object.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall): Deleted a bunch of code that
+        set up the arguments to host functions -- all but one of the arguments
+        are gone now. This is the actual optimization.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Updated for ExecState and Register API
+        changes noted above. Removed toThisObject() conversion, since all callees
+        do it themselves now.
+        
+        * runtime/ArgList.h:
+        (JSC::ArgList::ArgList): ArgList is getting close to unused. Added a
+        temporary shim for converting from ExecState* to ArgList where it's still
+        necessary.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::Arguments): Updated for ExecState and Register API
+        changes noted above. 
+
+        * runtime/CallData.cpp:
+        (JSC::call): Changed call always to call Interpreter::executeCall, even
+        for host functions. This ensures that the normal calling convention is
+        set up in the RegsiterFile when calling from C++ to host function.
+
+        * runtime/CallData.h: Changed host function signature as described above.
+
+        * runtime/ConstructData.cpp:
+        (JSC::construct): Moved JSFunction::construct code here so I could nix
+        JSFunction::call and JSFunction::call. We want a JSFunction-agnostic
+        way to call and construct, so that everything works naturally for non-
+        JSFunction objects. 
+
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        * runtime/JSFunction.h: Updated for ExecState and Register API changes
+        noted above. Nixed JSFunction::call and JSFunction::construct, noted above.
+ 
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Ditto.
+
+        PART TWO: Global search and replace.
+        
+        In the areas below, I used global search-and-replace to change
+            (ExecState*, JSObject*, JSValue, const ArgList&) => (ExecState*)
+            args.size() => exec->argumentCount()
+            args.at(i) => exec->argument(i)
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::call):
+        * JavaScriptCore.exp:
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionCheckSyntax):
+        (functionSetSamplingFlags):
+        (functionClearSamplingFlags):
+        (functionReadline):
+        (functionQuit):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        (JSC::arrayConstructorIsArray):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::fillStructuresUsingTimeArgs):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        (JSC::dateProtoFuncToJSON):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSString.h:
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::callObjectConstructor):
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/Operations.h:
+        (JSC::jsString):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::test):
+        (JSC::RegExpObject::exec):
+        (JSC::callRegExpObject):
+        (JSC::RegExpObject::match):
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::stringProtoFuncTrim):
+        (JSC::stringProtoFuncTrimLeft):
+        (JSC::stringProtoFuncTrimRight):
+
+2010-05-28  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix the JSObjectSetPrototype function.
+
+        A cycle in a prototype chain can cause an application hang or
+        even crash.
+        A check for a prototype chain cycles was added to
+        the JSObjectSetPrototype.
+
+        JSObjectSetPrototype doesn't check for cycle in prototype chain.
+        https://bugs.webkit.org/show_bug.cgi?id=39360
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPrototype):
+        * API/tests/testapi.c:
+        (assertTrue):
+        (checkForCycleInPrototypeChain):
+        (main):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/JSObject.h:
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+
+2010-05-28  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix MIPS JIT DoubleGreaterThanOrEqual Operands
+        https://bugs.webkit.org/show_bug.cgi?id=39504
+
+        Swapped two operands of left and right for DoubleGreaterThanOrEqual.
+        This patch fixed two layout tests as follows.
+        fast/js/comparison-operators-greater.html
+        fast/js/comparison-operators-less.html
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchDouble):
+
+2010-05-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Move jit compilation from linking thunks into cti_vm_lazyLink methods.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-05-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 39898 - Move arity check into callee.
+        
+        We can reduce the size of the virtual call trampolines by moving the arity check
+        into the callee functions.  As a following step we will be able to remove the
+        check for native function / codeblocks by performing translation in a lazy stub.
+        
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::init):
+        (JSC::ExecState::setReturnPC):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::generateJITCodeForCall):
+        (JSC::FunctionExecutable::generateJITCodeForConstruct):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::FunctionExecutable::generatedJITCodeForCallWithArityCheck):
+        (JSC::FunctionExecutable::generatedJITCodeForConstructWithArityCheck):
+
+2010-05-27  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Darin Adler.
+
+        UTF-16 code points compare() for String objects
+        https://bugs.webkit.org/show_bug.cgi?id=39701
+
+        Moving compare() implementation from UString to StringImpl for it to be shared
+        with String. Adding overloaded free functions codePointCompare() in StringImpl
+        and WTFString. Renaming function compare in UString to codePointCompare to be
+        consistent.
+
+        * runtime/JSArray.cpp:
+        (JSC::compareByStringPairForQSort):
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        (JSC::codePointCompare):
+        * wtf/text/StringImpl.cpp:
+        (WebCore::codePointCompare):
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.cpp:
+        (WebCore::codePointCompare):
+        * wtf/text/WTFString.h:
+
+2010-05-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kent Tamura.
+
+        Null characters handled incorrectly in ToNumber conversion
+        https://bugs.webkit.org/show_bug.cgi?id=38088
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt): Changed code to use UTF8String().data() instead of
+        ascii() to fix the thread safety issue. Code path is covered by existing
+        tests in run-javascriptcore-tests.
+        (JSC::parseFloat): Moved comment to UString::toDouble since the issue
+        affects all clients, not just parseFloat. Specifically, this also affects
+        standard JavaScript numeric conversion, ToNumber.
+
+        * runtime/UString.cpp:
+        (JSC::UString::toDouble): Added a comment about incorrect space skipping.
+        Changed trailing junk check to use the length of the CString instead of
+        checking for a null character. Also got rid of a little unneeded logic
+        in the case where we tolerate trailing junk.
+
+2010-05-27  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Search for the new allocation one word at a time.  Improves
+        performance on SunSpider by approximately 1%.
+        http://bugs.webkit.org/show_bug.cgi?id=39758
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocate):
+        * runtime/Collector.h:
+        (JSC::CollectorBitmap::advanceToNextPossibleFreeCell):
+
+2010-05-27  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes for Windows after recent changes.
+
+        * wscript:
+
+2010-05-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        More build fixage for make dist.
+
+        * GNUmakefile.am:
+
+2010-05-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        RVCT does not have strnstr.
+        https://bugs.webkit.org/show_bug.cgi?id=39719
+
+        Add COMPILER(RVCT) guard to strnstr in StringExtras.h as RVCT does not provide strnstr.
+
+        * wtf/StringExtras.h:
+
+2010-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 39795 - Add support for YARR JIT generation of greedy quantified parens at the end of the main disjunction.
+        (relanding r60267)
+
+        If the last item in a main disjunction is a quantified set of parentheses,
+        this is easier to code generate for than the general case for quantified
+        parentheses. This is because we never need to backtrack into the parentheses
+        - the first match will be the final and accepted match.
+
+        This patch also somewhat reverts a recent change to when fallback to PCRE
+        occurs. At the minute the compiler is tracking on patterns which will
+        require JIT fallback. This is handy from a performance perspective (it saves
+        the failed attempt at JIT compilation), but it means introducing knowledge
+        of the JITs capabilities into the other layers of the regex compilers. For
+        the specific feature of back-references, add a flag tracking their presence
+        on the pattern, and make these expressions fallback without attempting to
+        JIT. For parentheses, return to detecting which cases are have or have not
+        been handled during JIT compilation.
+
+        18% progression on tagcloud, ~1.5% overall on sunspidey.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isMainDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::RegexGenerator::shouldFallBack):
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+
+2010-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (revert).
+
+        Temporarily rolling out r60267, I appear to have hoesed perf at the last minute. :-/ Fixing.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::TermGenerationState::term):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+
+2010-05-26  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2010-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 39795 - Add support for YARR JIT generation of greedy quantified parens at the end of the main disjunction.
+
+        If the last item in a main disjunction is a quantified set of parentheses,
+        this is easier to code generate for than the general case for quantified
+        parentheses. This is because we never need to backtrack into the parentheses
+        - the first match will be the final and accepted match.
+
+        This patch also somewhat reverts a recent change to when fallback to PCRE
+        occurs. At the minute the compiler is tracking on patterns which will
+        require JIT fallback. This is handy from a performance perspective (it saves
+        the failed attempt at JIT compilation), but it means introducing knowledge
+        of the JITs capabilities into the other layers of the regex compilers. For
+        the specific feature of back-references, add a flag tracking their presence
+        on the pattern, and make these expressions fallback without attempting to
+        JIT. For parentheses, return to detecting which cases are have or have not
+        been handled during JIT compilation.
+
+        18% progression on tagcloud, ~1.5% overall on sunspidey.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isMainDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::RegexGenerator::shouldFallBack):
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+
+2010-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed a crash seen on the Leopard bot, caused by merge.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Get the return address from the callframe,
+        since it's no longer passed to us as an argument.
+
+2010-05-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed build failure caused by merge.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): On error, return a single value, since this
+        function no longer returns a pair.
+
+2010-05-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/8020221>
+        
+        Fixed a crash seen on Windows when calling a function with too many
+        arguments.
+        
+        SunSpider reports no change.
+        
+        No test because the ASSERT I added fires in existing tests.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Make sure to grow the registerFile when too
+        many arguments have been provided, since the caller only allocated enough
+        registerFile space for the arguments it provided, not enough for the extra
+        copy of arguments we're going to need.
+
+2010-05-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Build fix for JSFunction
+        https://bugs.webkit.org/show_bug.cgi?id=39658
+
+        MSVC can't compile one of JSFunction constructors when JIT is disabled.
+        "PassRefPtr<NativeExecutable>" causes the compile error as NativeExecutable is not defined. 
+        Add ENABLE(JIT) guard to the constructor.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSFunction.h:
+
+2010-05-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 39643 - Clean up code generation in the JIT of stub function calls for op_call.
+
+        Presently, as soon as op-call strays off the hot path we set up a set of values on
+        the stack to be passed as arguments to cti functions, in case any should be called.
+
+        Instead, hoist the setup of the callframe to happen slightly sooner, and make the
+        cti functions to compile & check arity read these values from the callframe. This
+        allows up to remove the deprecated methods to manually set up cti arguments, rather
+        than using JITStubCall.h.
+
+        * interpreter/CallFrame.h:
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2010-05-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+        Relanding r60075.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitGetByIdExceptionInfo):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_get_callee):
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_callee):
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiNativeConstruct):
+        (JSC::):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createNotAnObjectError):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::NativeExecutable):
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        * runtime/JSFunction.h:
+        * wtf/Platform.h:
+
+== Rolled over to ChangeLog-2010-05-24 ==
diff --git a/Source/JavaScriptCore/Configurations/Base.xcconfig b/Source/JavaScriptCore/Configurations/Base.xcconfig
index a189159..12d0efd 100644
--- a/Source/JavaScriptCore/Configurations/Base.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Base.xcconfig
@@ -25,7 +25,6 @@ DEBUG_INFORMATION_FORMAT = dwarf;
 GCC_C_LANGUAGE_STANDARD = gnu99;
 GCC_DEBUGGING_SYMBOLS = default;
 GCC_DYNAMIC_NO_PIC = NO;
-GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
 GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(REAL_PLATFORM_NAME));
@@ -77,6 +76,12 @@ REAL_PLATFORM_NAME_macosx = macosx;
 TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
 
 
+JAVASCRIPTCORE_FRAMEWORKS_DIR = $(JAVASCRIPTCORE_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
+JAVASCRIPTCORE_FRAMEWORKS_DIR_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+JAVASCRIPTCORE_FRAMEWORKS_DIR_iphonesimulator = $(JAVASCRIPTCORE_FRAMEWORKS_DIR_iphoneos);
+JAVASCRIPTCORE_FRAMEWORKS_DIR_macosx = $(SYSTEM_LIBRARY_DIR)/Frameworks;
+
+
 // DEBUG_DEFINES, GCC_OPTIMIZATION_LEVEL, STRIP_INSTALLED_PRODUCT and DEAD_CODE_STRIPPING vary between the debug and normal variants.
 // We set up the values for each variant here, and have the Debug configuration in the Xcode project use the _debug variant.
 DEBUG_DEFINES_debug = ;
@@ -112,12 +117,23 @@ TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSI
 TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
 TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
 TARGET_GCC_VERSION_macosx_1060 = GCC_42;
-TARGET_GCC_VERSION_macosx_1070 = LLVM_GCC_42;
+TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1070_$(CONFIGURATION));
+TARGET_GCC_VERSION_macosx_1070_Debug = LLVM_COMPILER;
+TARGET_GCC_VERSION_macosx_1070_Release = LLVM_GCC_42;
+TARGET_GCC_VERSION_macosx_1070_Production = LLVM_GCC_42;
 
 GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
 GCC_VERSION_GCC_40 = 4.0;
 GCC_VERSION_GCC_42 = 4.2;
 GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
+
+// FIXME: Disable C++ exceptions in the LLVM Compiler once it supports enabling Obj-C exceptions without C++ exceptions.
+GCC_ENABLE_CPP_EXCEPTIONS = $(GCC_ENABLE_CPP_EXCEPTIONS_$(TARGET_GCC_VERSION));
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_40 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_42 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_GCC = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_COMPILER = YES;
 
 // If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
 SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 3971037..73d3a47 100644
--- a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -23,8 +23,8 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 // The contents of this file must be kept in sync with FeatureDefines.xcconfig in JavaScriptCore,
-// WebCore and WebKit.  Also the default values of the ENABLE_FEATURE_NAME macros in build-webkit
-// should match the values below, but they do not need to be in the same order.
+// WebCore, WebKit and WebKit2.  Also the default values of the ENABLE_FEATURE_NAME macros in
+// build-webkit should match the values below, but they do not need to be in the same order.
 
 // Keep this list of features (not enabled/disabled state) in sync with FeatureDefines.vsprops
 // and FeatureDefinesCairo.vsprops in WebKitLibraries/win/tools/vsprops.
@@ -66,6 +66,8 @@ ENABLE_DATAGRID = ;
 ENABLE_DATALIST = $(ENABLE_DATALIST_$(REAL_PLATFORM_NAME));
 ENABLE_DATALIST_macosx = ENABLE_DATALIST;
 
+ENABLE_DATA_TRANSFER_ITEMS = ;
+
 ENABLE_DEVICE_ORIENTATION = ;
 ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
@@ -89,8 +91,11 @@ ENABLE_MATHML = ENABLE_MATHML;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
+ENABLE_PAGE_VISIBILITY_API = ;
 ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 
+ENABLE_QUOTA = ;
+
 ENABLE_REGISTER_PROTOCOL_HANDLER = ;
 
 ENABLE_SHARED_WORKERS = $(ENABLE_SHARED_WORKERS_$(REAL_PLATFORM_NAME));
@@ -107,6 +112,7 @@ ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
+ENABLE_VIDEO_TRACK = ;
 
 ENABLE_MEDIA_STATISTICS = ;
 
@@ -125,4 +131,4 @@ ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_WEBGL) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_WEBGL) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_QUOTA) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig b/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
index adf594e..dd2a2e9 100644
--- a/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
+++ b/Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig
@@ -43,7 +43,7 @@ OTHER_LDFLAGS_macosx_1070 = -Xlinker -objc_gc_compaction;
 GCC_PREFIX_HEADER = JavaScriptCorePrefix.h;
 HEADER_SEARCH_PATHS = "${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore" $(HEADER_SEARCH_PATHS);
 INFOPLIST_FILE = Info.plist;
-INSTALL_PATH = $(SYSTEM_LIBRARY_DIR)/Frameworks;
+INSTALL_PATH = $(JAVASCRIPTCORE_FRAMEWORKS_DIR);
 PRODUCT_NAME = JavaScriptCore;
 
 OTHER_CFLAGS = $(OTHER_CFLAGS_$(CONFIGURATION)_$(CURRENT_VARIANT));
diff --git a/Source/JavaScriptCore/Configurations/Version.xcconfig b/Source/JavaScriptCore/Configurations/Version.xcconfig
index cee5010..8ea0822 100644
--- a/Source/JavaScriptCore/Configurations/Version.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 20;
+MINOR_VERSION = 30;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/JavaScriptCore/DerivedSources.make b/Source/JavaScriptCore/DerivedSources.make
index 0ff9cdf..9a8c2cc 100644
--- a/Source/JavaScriptCore/DerivedSources.make
+++ b/Source/JavaScriptCore/DerivedSources.make
@@ -44,6 +44,7 @@ all : \
     Lexer.lut.h \
     MathObject.lut.h \
     NumberConstructor.lut.h \
+    ObjectConstructor.lut.h \
     RegExpConstructor.lut.h \
     RegExpJitTables.h \
     RegExpObject.lut.h \
@@ -83,7 +84,6 @@ HeaderDetection.h : DerivedSources.make /System/Library/CoreServices/SystemVersi
 	rm -f $@
 	echo "/* This is a generated file. Do not edit. */" > $@
 	if [ -f $(SDKROOT)/System/Library/Frameworks/System.framework/PrivateHeaders/pthread_machdep.h ]; then echo "#define HAVE_PTHREAD_MACHDEP_H 1" >> $@; else echo >> $@; fi
-	if [ -f $(SDKROOT)/System/Library/Frameworks/AppKit.framework/PrivateHeaders/NSScrollerImpPair_Private.h ]; then echo "#define USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER 1" >> $@; else echo >> $@; fi
 
 else
 
diff --git a/Source/JavaScriptCore/DerivedSources.pro b/Source/JavaScriptCore/DerivedSources.pro
index eac4dd9..061ae56 100644
--- a/Source/JavaScriptCore/DerivedSources.pro
+++ b/Source/JavaScriptCore/DerivedSources.pro
@@ -19,6 +19,7 @@ LUT_FILES += \
     runtime/JSONObject.cpp \
     runtime/MathObject.cpp \
     runtime/NumberConstructor.cpp \
+    runtime/ObjectConstructor.cpp \
     runtime/RegExpConstructor.cpp \
     runtime/RegExpObject.cpp \
     runtime/StringPrototype.cpp
diff --git a/Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/APIShims.h b/Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/APIShims.h
new file mode 100644
index 0000000..92e712a
--- /dev/null
+++ b/Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/APIShims.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/API/APIShims.h>
diff --git a/Source/JavaScriptCore/GNUmakefile.am b/Source/JavaScriptCore/GNUmakefile.am
index e6ccf2e..9030a21 100644
--- a/Source/JavaScriptCore/GNUmakefile.am
+++ b/Source/JavaScriptCore/GNUmakefile.am
@@ -1,3 +1,5 @@
+include $(srcdir)/Source/JavaScriptCore/GNUmakefile.list.am
+
 javascriptcore_cppflags += \
 	-I$(srcdir)/Source \
 	-I$(srcdir)/Source/JavaScriptCore \
@@ -5,6 +7,7 @@ javascriptcore_cppflags += \
 	-I$(srcdir)/Source/JavaScriptCore/assembler \
 	-I$(srcdir)/Source/JavaScriptCore/bytecode \
 	-I$(srcdir)/Source/JavaScriptCore/bytecompiler \
+	-I$(srcdir)/Source/JavaScriptCore/heap \
 	-I$(srcdir)/Source/JavaScriptCore/debugger \
 	-I$(srcdir)/Source/JavaScriptCore/ForwardingHeaders \
 	-I$(srcdir)/Source/JavaScriptCore/interpreter \
@@ -24,583 +27,6 @@ javascriptcore_cppflags += \
 	-I$(top_builddir)/Source/JavaScriptCore/parser \
 	-I$(top_builddir)/Source/JavaScriptCore/runtime
 
-javascriptcore_h_api += \
-	Source/JavaScriptCore/API/JSBase.h \
-	Source/JavaScriptCore/API/JSContextRef.h \
-	Source/JavaScriptCore/API/JSObjectRef.h \
-	Source/JavaScriptCore/API/JSStringRef.h \
-	Source/JavaScriptCore/API/JSStringRefBSTR.h \
-	Source/JavaScriptCore/API/JSStringRefCF.h \
-	Source/JavaScriptCore/API/JSValueRef.h \
-	Source/JavaScriptCore/API/JavaScript.h \
-	Source/JavaScriptCore/API/JavaScriptCore.h \
-	Source/JavaScriptCore/API/WebKitAvailability.h
-
-javascriptcore_built_nosources += \
-	Source/JavaScriptCore/Lexer.lut.h \
-	Source/JavaScriptCore/RegExpJitTables.h \
-	Source/JavaScriptCore/runtime/ArrayPrototype.lut.h \
-	Source/JavaScriptCore/runtime/DatePrototype.lut.h \
-	Source/JavaScriptCore/runtime/JSONObject.lut.h \
-	Source/JavaScriptCore/runtime/MathObject.lut.h \
-	Source/JavaScriptCore/runtime/NumberConstructor.lut.h \
-	Source/JavaScriptCore/runtime/RegExpConstructor.lut.h \
-	Source/JavaScriptCore/runtime/RegExpObject.lut.h \
-	Source/JavaScriptCore/runtime/StringPrototype.lut.h
-
-javascriptcore_sources += \
-	Source/JavaScriptCore/API/APICast.h \
-	Source/JavaScriptCore/API/APIShims.h \
-	Source/JavaScriptCore/API/JSBase.cpp \
-	Source/JavaScriptCore/API/JSBasePrivate.h \
-	Source/JavaScriptCore/API/JSCallbackConstructor.cpp \
-	Source/JavaScriptCore/API/JSCallbackConstructor.h \
-	Source/JavaScriptCore/API/JSCallbackFunction.cpp \
-	Source/JavaScriptCore/API/JSCallbackFunction.h \
-	Source/JavaScriptCore/API/JSCallbackObject.cpp \
-	Source/JavaScriptCore/API/JSCallbackObjectFunctions.h \
-	Source/JavaScriptCore/API/JSCallbackObject.h \
-	Source/JavaScriptCore/API/JSClassRef.cpp \
-	Source/JavaScriptCore/API/JSClassRef.h \
-	Source/JavaScriptCore/API/JSContextRef.cpp \
-	Source/JavaScriptCore/API/JSContextRefPrivate.h \
-	Source/JavaScriptCore/API/JSObjectRef.cpp \
-	Source/JavaScriptCore/API/JSObjectRefPrivate.h \
-	Source/JavaScriptCore/API/JSRetainPtr.h \
-	Source/JavaScriptCore/API/JSStringRef.cpp \
-	Source/JavaScriptCore/API/JSValueRef.cpp \
-	Source/JavaScriptCore/API/JSWeakObjectMapRefInternal.h \
-	Source/JavaScriptCore/API/OpaqueJSString.cpp \
-	Source/JavaScriptCore/API/OpaqueJSString.h \
-	Source/JavaScriptCore/assembler/AbstractMacroAssembler.h \
-	Source/JavaScriptCore/assembler/ARMAssembler.cpp \
-	Source/JavaScriptCore/assembler/ARMAssembler.h \
-	Source/JavaScriptCore/assembler/ARMv7Assembler.cpp \
-	Source/JavaScriptCore/assembler/ARMv7Assembler.h \
-	Source/JavaScriptCore/assembler/AssemblerBuffer.h \
-	Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h \
-	Source/JavaScriptCore/assembler/CodeLocation.h \
-	Source/JavaScriptCore/assembler/LinkBuffer.h \
-	Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp \
-	Source/JavaScriptCore/assembler/MacroAssemblerARM.h \
-	Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h \
-	Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h \
-	Source/JavaScriptCore/assembler/MacroAssembler.h \
-	Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h \
-	Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h \
-	Source/JavaScriptCore/assembler/MacroAssemblerX86.h \
-	Source/JavaScriptCore/assembler/RepatchBuffer.h \
-	Source/JavaScriptCore/assembler/X86Assembler.h \
-	Source/JavaScriptCore/bytecode/CodeBlock.cpp \
-	Source/JavaScriptCore/bytecode/CodeBlock.h \
-	Source/JavaScriptCore/bytecode/EvalCodeCache.h \
-	Source/JavaScriptCore/bytecode/Instruction.h \
-	Source/JavaScriptCore/bytecode/JumpTable.cpp \
-	Source/JavaScriptCore/bytecode/JumpTable.h \
-	Source/JavaScriptCore/bytecode/Opcode.cpp \
-	Source/JavaScriptCore/bytecode/Opcode.h \
-	Source/JavaScriptCore/bytecode/SamplingTool.cpp \
-	Source/JavaScriptCore/bytecode/SamplingTool.h \
-	Source/JavaScriptCore/bytecode/StructureStubInfo.cpp \
-	Source/JavaScriptCore/bytecode/StructureStubInfo.h \
-	Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp \
-	Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h \
-	Source/JavaScriptCore/bytecompiler/Label.h \
-	Source/JavaScriptCore/bytecompiler/LabelScope.h \
-	Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp \
-	Source/JavaScriptCore/bytecompiler/RegisterID.h \
-	Source/JavaScriptCore/config.h \
-	Source/JavaScriptCore/debugger/DebuggerActivation.cpp \
-	Source/JavaScriptCore/debugger/DebuggerActivation.h \
-	Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp \
-	Source/JavaScriptCore/debugger/DebuggerCallFrame.h \
-	Source/JavaScriptCore/debugger/Debugger.cpp \
-	Source/JavaScriptCore/debugger/Debugger.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/APICast.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScriptCore.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScript.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSBase.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSContextRef.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSObjectRef.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSRetainPtr.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRefCF.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRef.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSValueRef.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/OpaqueJSString.h \
-	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/WebKitAvailability.h \
-	Source/JavaScriptCore/icu/unicode/parseerr.h \
-	Source/JavaScriptCore/icu/unicode/platform.h \
-	Source/JavaScriptCore/icu/unicode/putil.h \
-	Source/JavaScriptCore/icu/unicode/uchar.h \
-	Source/JavaScriptCore/icu/unicode/ucnv_err.h \
-	Source/JavaScriptCore/icu/unicode/ucnv.h \
-	Source/JavaScriptCore/icu/unicode/ucol.h \
-	Source/JavaScriptCore/icu/unicode/uconfig.h \
-	Source/JavaScriptCore/icu/unicode/uenum.h \
-	Source/JavaScriptCore/icu/unicode/uiter.h \
-	Source/JavaScriptCore/icu/unicode/uloc.h \
-	Source/JavaScriptCore/icu/unicode/umachine.h \
-	Source/JavaScriptCore/icu/unicode/unorm.h \
-	Source/JavaScriptCore/icu/unicode/urename.h \
-	Source/JavaScriptCore/icu/unicode/uset.h \
-	Source/JavaScriptCore/icu/unicode/ustring.h \
-	Source/JavaScriptCore/icu/unicode/utf16.h \
-	Source/JavaScriptCore/icu/unicode/utf8.h \
-	Source/JavaScriptCore/icu/unicode/utf.h \
-	Source/JavaScriptCore/icu/unicode/utf_old.h \
-	Source/JavaScriptCore/icu/unicode/utypes.h \
-	Source/JavaScriptCore/icu/unicode/uversion.h \
-	Source/JavaScriptCore/interpreter/CachedCall.h \
-	Source/JavaScriptCore/interpreter/CallFrameClosure.h \
-	Source/JavaScriptCore/interpreter/CallFrame.cpp \
-	Source/JavaScriptCore/interpreter/CallFrame.h \
-	Source/JavaScriptCore/interpreter/Interpreter.cpp \
-	Source/JavaScriptCore/interpreter/Interpreter.h \
-	Source/JavaScriptCore/interpreter/RegisterFile.cpp \
-	Source/JavaScriptCore/interpreter/RegisterFile.h \
-	Source/JavaScriptCore/interpreter/Register.h \
-	Source/JavaScriptCore/JavaScriptCorePrefix.h \
-	Source/JavaScriptCore/jit/ExecutableAllocator.cpp \
-	Source/JavaScriptCore/jit/ExecutableAllocator.h \
-	Source/JavaScriptCore/jit/JITArithmetic32_64.cpp \
-	Source/JavaScriptCore/jit/JITArithmetic.cpp \
-	Source/JavaScriptCore/jit/JITCall32_64.cpp \
-	Source/JavaScriptCore/jit/JITCall.cpp \
-	Source/JavaScriptCore/jit/JITCode.h \
-	Source/JavaScriptCore/jit/JIT.cpp \
-	Source/JavaScriptCore/jit/JIT.h \
-	Source/JavaScriptCore/jit/JITInlineMethods.h \
-	Source/JavaScriptCore/jit/JITOpcodes32_64.cpp \
-	Source/JavaScriptCore/jit/JITOpcodes.cpp \
-	Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp \
-	Source/JavaScriptCore/jit/JITPropertyAccess.cpp \
-	Source/JavaScriptCore/jit/JITStubCall.h \
-	Source/JavaScriptCore/jit/JITStubs.cpp \
-	Source/JavaScriptCore/jit/JITStubs.h \
-	Source/JavaScriptCore/jit/JSInterfaceJIT.h \
-	Source/JavaScriptCore/jit/SpecializedThunkJIT.h \
-	Source/JavaScriptCore/jit/ThunkGenerators.cpp \
-	Source/JavaScriptCore/jit/ThunkGenerators.h \
-	Source/JavaScriptCore/os-win32/stdbool.h \
-	Source/JavaScriptCore/os-win32/stdint.h \
-	Source/JavaScriptCore/parser/ASTBuilder.h \
-	Source/JavaScriptCore/parser/JSParser.cpp \
-	Source/JavaScriptCore/parser/JSParser.h \
-	Source/JavaScriptCore/parser/Lexer.cpp \
-	Source/JavaScriptCore/parser/Lexer.h \
-	Source/JavaScriptCore/parser/NodeConstructors.h \
-	Source/JavaScriptCore/parser/NodeInfo.h \
-	Source/JavaScriptCore/parser/Nodes.cpp \
-	Source/JavaScriptCore/parser/Nodes.h \
-	Source/JavaScriptCore/parser/ParserArena.cpp \
-	Source/JavaScriptCore/parser/ParserArena.h \
-	Source/JavaScriptCore/parser/Parser.cpp \
-	Source/JavaScriptCore/parser/Parser.h \
-	Source/JavaScriptCore/parser/ResultType.h \
-	Source/JavaScriptCore/parser/SourceCode.h \
-	Source/JavaScriptCore/parser/SourceProvider.h \
-	Source/JavaScriptCore/parser/SourceProviderCache.cpp \
-	Source/JavaScriptCore/parser/SourceProviderCache.h \
-	Source/JavaScriptCore/parser/SourceProviderCacheItem.h \
-	Source/JavaScriptCore/parser/SyntaxChecker.h \
-	Source/JavaScriptCore/profiler/CallIdentifier.h \
-	Source/JavaScriptCore/profiler/Profile.cpp \
-	Source/JavaScriptCore/profiler/ProfileGenerator.cpp \
-	Source/JavaScriptCore/profiler/ProfileGenerator.h \
-	Source/JavaScriptCore/profiler/Profile.h \
-	Source/JavaScriptCore/profiler/ProfileNode.cpp \
-	Source/JavaScriptCore/profiler/ProfileNode.h \
-	Source/JavaScriptCore/profiler/Profiler.cpp \
-	Source/JavaScriptCore/profiler/Profiler.h \
-	Source/JavaScriptCore/runtime/ArgList.cpp \
-	Source/JavaScriptCore/runtime/ArgList.h \
-	Source/JavaScriptCore/runtime/Arguments.cpp \
-	Source/JavaScriptCore/runtime/Arguments.h \
-	Source/JavaScriptCore/runtime/ArrayConstructor.cpp \
-	Source/JavaScriptCore/runtime/ArrayConstructor.h \
-	Source/JavaScriptCore/runtime/ArrayPrototype.cpp \
-	Source/JavaScriptCore/runtime/ArrayPrototype.h \
-	Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h \
-	Source/JavaScriptCore/runtime/BooleanConstructor.cpp \
-	Source/JavaScriptCore/runtime/BooleanConstructor.h \
-	Source/JavaScriptCore/runtime/BooleanObject.cpp \
-	Source/JavaScriptCore/runtime/BooleanObject.h \
-	Source/JavaScriptCore/runtime/BooleanPrototype.cpp \
-	Source/JavaScriptCore/runtime/BooleanPrototype.h \
-	Source/JavaScriptCore/runtime/CachedTranscendentalFunction.h \
-	Source/JavaScriptCore/runtime/CallData.cpp \
-	Source/JavaScriptCore/runtime/CallData.h \
-	Source/JavaScriptCore/runtime/ClassInfo.h \
-	Source/JavaScriptCore/runtime/MarkedBlock.cpp \
-	Source/JavaScriptCore/runtime/MarkedBlock.h \
-	Source/JavaScriptCore/runtime/MarkedSpace.cpp \
-	Source/JavaScriptCore/runtime/MarkedSpace.h \
-	Source/JavaScriptCore/runtime/Heap.cpp \
-	Source/JavaScriptCore/runtime/Heap.h \
-	Source/JavaScriptCore/runtime/CommonIdentifiers.cpp \
-	Source/JavaScriptCore/runtime/CommonIdentifiers.h \
-	Source/JavaScriptCore/runtime/Completion.cpp \
-	Source/JavaScriptCore/runtime/Completion.h \
-	Source/JavaScriptCore/runtime/ConstructData.cpp \
-	Source/JavaScriptCore/runtime/ConstructData.h \
-	Source/JavaScriptCore/runtime/DateConstructor.cpp \
-	Source/JavaScriptCore/runtime/DateConstructor.h \
-	Source/JavaScriptCore/runtime/DateConversion.cpp \
-	Source/JavaScriptCore/runtime/DateConversion.h \
-	Source/JavaScriptCore/runtime/DateInstanceCache.h \
-	Source/JavaScriptCore/runtime/DateInstance.cpp \
-	Source/JavaScriptCore/runtime/DateInstance.h \
-	Source/JavaScriptCore/runtime/DatePrototype.cpp \
-	Source/JavaScriptCore/runtime/DatePrototype.h \
-	Source/JavaScriptCore/runtime/ErrorConstructor.cpp \
-	Source/JavaScriptCore/runtime/ErrorConstructor.h \
-	Source/JavaScriptCore/runtime/Error.cpp \
-	Source/JavaScriptCore/runtime/Error.h \
-	Source/JavaScriptCore/runtime/ErrorInstance.cpp \
-	Source/JavaScriptCore/runtime/ErrorInstance.h \
-	Source/JavaScriptCore/runtime/ErrorPrototype.cpp \
-	Source/JavaScriptCore/runtime/ErrorPrototype.h \
-	Source/JavaScriptCore/runtime/ExceptionHelpers.cpp \
-	Source/JavaScriptCore/runtime/ExceptionHelpers.h \
-	Source/JavaScriptCore/runtime/Executable.cpp \
-	Source/JavaScriptCore/runtime/Executable.h \
-	Source/JavaScriptCore/runtime/FunctionConstructor.cpp \
-	Source/JavaScriptCore/runtime/FunctionConstructor.h \
-	Source/JavaScriptCore/runtime/FunctionPrototype.cpp \
-	Source/JavaScriptCore/runtime/FunctionPrototype.h \
-	Source/JavaScriptCore/runtime/GCActivityCallback.cpp \
-	Source/JavaScriptCore/runtime/GCActivityCallback.h \
-	Source/JavaScriptCore/runtime/GCHandle.cpp \
-	Source/JavaScriptCore/runtime/GCHandle.h \
-	Source/JavaScriptCore/runtime/GetterSetter.cpp \
-	Source/JavaScriptCore/runtime/GetterSetter.h \
-	Source/JavaScriptCore/runtime/GlobalEvalFunction.cpp \
-	Source/JavaScriptCore/runtime/GlobalEvalFunction.h \
-	Source/JavaScriptCore/runtime/Identifier.cpp \
-	Source/JavaScriptCore/runtime/Identifier.h \
-	Source/JavaScriptCore/runtime/InitializeThreading.cpp \
-	Source/JavaScriptCore/runtime/InitializeThreading.h \
-	Source/JavaScriptCore/runtime/InternalFunction.cpp \
-	Source/JavaScriptCore/runtime/InternalFunction.h \
-	Source/JavaScriptCore/runtime/JSActivation.cpp \
-	Source/JavaScriptCore/runtime/JSActivation.h \
-	Source/JavaScriptCore/runtime/JSAPIValueWrapper.cpp \
-	Source/JavaScriptCore/runtime/JSAPIValueWrapper.h \
-	Source/JavaScriptCore/runtime/JSArray.cpp \
-	Source/JavaScriptCore/runtime/JSArray.h \
-	Source/JavaScriptCore/runtime/JSByteArray.cpp \
-	Source/JavaScriptCore/runtime/JSByteArray.h \
-	Source/JavaScriptCore/runtime/JSCell.cpp \
-	Source/JavaScriptCore/runtime/JSCell.h \
-	Source/JavaScriptCore/runtime/JSFunction.cpp \
-	Source/JavaScriptCore/runtime/JSFunction.h \
-	Source/JavaScriptCore/runtime/JSGlobalData.cpp \
-	Source/JavaScriptCore/runtime/JSGlobalData.h \
-	Source/JavaScriptCore/runtime/JSGlobalObject.cpp \
-	Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp \
-	Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h \
-	Source/JavaScriptCore/runtime/JSGlobalObject.h \
-	Source/JavaScriptCore/runtime/JSImmediate.cpp \
-	Source/JavaScriptCore/runtime/JSImmediate.h \
-	Source/JavaScriptCore/runtime/JSLock.cpp \
-	Source/JavaScriptCore/runtime/JSLock.h \
-	Source/JavaScriptCore/runtime/JSNotAnObject.cpp \
-	Source/JavaScriptCore/runtime/JSNotAnObject.h \
-	Source/JavaScriptCore/runtime/JSNumberCell.cpp \
-	Source/JavaScriptCore/runtime/JSNumberCell.h \
-	Source/JavaScriptCore/runtime/JSObject.cpp \
-	Source/JavaScriptCore/runtime/JSObject.h \
-	Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp \
-	Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h \
-	Source/JavaScriptCore/runtime/JSONObject.cpp \
-	Source/JavaScriptCore/runtime/JSONObject.h \
-	Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp \
-	Source/JavaScriptCore/runtime/JSPropertyNameIterator.h \
-	Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp \
-	Source/JavaScriptCore/runtime/JSStaticScopeObject.h \
-	Source/JavaScriptCore/runtime/JSStringBuilder.h \
-	Source/JavaScriptCore/runtime/JSString.cpp \
-	Source/JavaScriptCore/runtime/JSString.h \
-	Source/JavaScriptCore/runtime/JSType.h \
-	Source/JavaScriptCore/runtime/JSTypeInfo.h \
-	Source/JavaScriptCore/runtime/JSValue.cpp \
-	Source/JavaScriptCore/runtime/JSValue.h \
-	Source/JavaScriptCore/runtime/JSVariableObject.cpp \
-	Source/JavaScriptCore/runtime/JSVariableObject.h \
-	Source/JavaScriptCore/runtime/JSWrapperObject.cpp \
-	Source/JavaScriptCore/runtime/JSWrapperObject.h \
-	Source/JavaScriptCore/runtime/JSZombie.h \
-	Source/JavaScriptCore/runtime/LiteralParser.cpp \
-	Source/JavaScriptCore/runtime/LiteralParser.h \
-	Source/JavaScriptCore/runtime/Lookup.cpp \
-	Source/JavaScriptCore/runtime/Lookup.h \
-	Source/JavaScriptCore/runtime/MachineStackMarker.cpp \
-	Source/JavaScriptCore/runtime/MachineStackMarker.h \
-        Source/JavaScriptCore/runtime/ConservativeSet.cpp \
-        Source/JavaScriptCore/runtime/ConservativeSet.h \
-	Source/JavaScriptCore/runtime/MarkStack.cpp \
-	Source/JavaScriptCore/runtime/MarkStack.h \
-	Source/JavaScriptCore/runtime/MathObject.cpp \
-	Source/JavaScriptCore/runtime/MathObject.h \
-	Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp \
-	Source/JavaScriptCore/runtime/NativeErrorConstructor.h \
-	Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp \
-	Source/JavaScriptCore/runtime/NativeErrorPrototype.h \
-	Source/JavaScriptCore/runtime/NativeFunctionWrapper.h \
-	Source/JavaScriptCore/runtime/NumberConstructor.cpp \
-	Source/JavaScriptCore/runtime/NumberConstructor.h \
-	Source/JavaScriptCore/runtime/NumberObject.cpp \
-	Source/JavaScriptCore/runtime/NumberObject.h \
-	Source/JavaScriptCore/runtime/NumberPrototype.cpp \
-	Source/JavaScriptCore/runtime/NumberPrototype.h \
-	Source/JavaScriptCore/runtime/NumericStrings.h \
-	Source/JavaScriptCore/runtime/ObjectConstructor.cpp \
-	Source/JavaScriptCore/runtime/ObjectConstructor.h \
-	Source/JavaScriptCore/runtime/ObjectPrototype.cpp \
-	Source/JavaScriptCore/runtime/ObjectPrototype.h \
-	Source/JavaScriptCore/runtime/Operations.cpp \
-	Source/JavaScriptCore/runtime/Operations.h \
-	Source/JavaScriptCore/runtime/PropertyDescriptor.cpp \
-	Source/JavaScriptCore/runtime/PropertyDescriptor.h \
-	Source/JavaScriptCore/runtime/PropertyMapHashTable.h \
-	Source/JavaScriptCore/runtime/PropertyNameArray.cpp \
-	Source/JavaScriptCore/runtime/PropertyNameArray.h \
-	Source/JavaScriptCore/runtime/PropertySlot.cpp \
-	Source/JavaScriptCore/runtime/PropertySlot.h \
-	Source/JavaScriptCore/runtime/Protect.h \
-	Source/JavaScriptCore/runtime/PrototypeFunction.cpp \
-	Source/JavaScriptCore/runtime/PrototypeFunction.h \
-	Source/JavaScriptCore/runtime/PutPropertySlot.h \
-	Source/JavaScriptCore/runtime/RegExpCache.cpp \
-	Source/JavaScriptCore/runtime/RegExpCache.h \
-	Source/JavaScriptCore/runtime/RegExpConstructor.cpp \
-	Source/JavaScriptCore/runtime/RegExpConstructor.h \
-	Source/JavaScriptCore/runtime/RegExp.cpp \
-	Source/JavaScriptCore/runtime/RegExp.h \
-	Source/JavaScriptCore/runtime/RegExpKey.h \
-	Source/JavaScriptCore/runtime/RegExpMatchesArray.h \
-	Source/JavaScriptCore/runtime/RegExpObject.cpp \
-	Source/JavaScriptCore/runtime/RegExpObject.h \
-	Source/JavaScriptCore/runtime/RegExpPrototype.cpp \
-	Source/JavaScriptCore/runtime/RegExpPrototype.h \
-	Source/JavaScriptCore/runtime/RopeImpl.cpp \
-	Source/JavaScriptCore/runtime/RopeImpl.h \
-	Source/JavaScriptCore/runtime/ScopeChain.cpp \
-	Source/JavaScriptCore/runtime/ScopeChain.h \
-	Source/JavaScriptCore/runtime/ScopeChainMark.h \
-	Source/JavaScriptCore/runtime/SmallStrings.cpp \
-	Source/JavaScriptCore/runtime/SmallStrings.h \
-	Source/JavaScriptCore/runtime/StrictEvalActivation.cpp \
-	Source/JavaScriptCore/runtime/StrictEvalActivation.h \
-	Source/JavaScriptCore/runtime/StringConstructor.cpp \
-	Source/JavaScriptCore/runtime/StringConstructor.h \
-	Source/JavaScriptCore/runtime/StringObject.cpp \
-	Source/JavaScriptCore/runtime/StringObject.h \
-	Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h \
-	Source/JavaScriptCore/runtime/StringPrototype.cpp \
-	Source/JavaScriptCore/runtime/StringPrototype.h \
-	Source/JavaScriptCore/runtime/StringRecursionChecker.cpp \
-	Source/JavaScriptCore/runtime/StringRecursionChecker.h \
-	Source/JavaScriptCore/runtime/StructureChain.cpp \
-	Source/JavaScriptCore/runtime/StructureChain.h \
-	Source/JavaScriptCore/runtime/Structure.cpp \
-	Source/JavaScriptCore/runtime/Structure.h \
-	Source/JavaScriptCore/runtime/StructureTransitionTable.h \
-	Source/JavaScriptCore/runtime/SymbolTable.h \
-	Source/JavaScriptCore/runtime/Terminator.h \
-	Source/JavaScriptCore/runtime/TimeoutChecker.cpp \
-	Source/JavaScriptCore/runtime/TimeoutChecker.h \
-	Source/JavaScriptCore/runtime/Tracing.h \
-	Source/JavaScriptCore/runtime/UString.cpp \
-	Source/JavaScriptCore/runtime/UString.h \
-	Source/JavaScriptCore/runtime/UStringBuilder.h \
-	Source/JavaScriptCore/runtime/UStringConcatenate.h \
-	Source/JavaScriptCore/runtime/WeakGCMap.h \
-	Source/JavaScriptCore/runtime/WeakGCPtr.h \
-	Source/JavaScriptCore/runtime/WeakRandom.h \
-	Source/JavaScriptCore/runtime/WriteBarrier.h \
-	Source/JavaScriptCore/wtf/AlwaysInline.h \
-	Source/JavaScriptCore/wtf/ASCIICType.h \
-	Source/JavaScriptCore/wtf/Assertions.cpp \
-	Source/JavaScriptCore/wtf/Assertions.h \
-	Source/JavaScriptCore/wtf/Atomics.h \
-	Source/JavaScriptCore/wtf/AVLTree.h \
-	Source/JavaScriptCore/wtf/Bitmap.h \
-	Source/JavaScriptCore/wtf/BloomFilter.h \
-	Source/JavaScriptCore/wtf/BumpPointerAllocator.h \
-	Source/JavaScriptCore/wtf/ByteArray.cpp \
-	Source/JavaScriptCore/wtf/ByteArray.h \
-	Source/JavaScriptCore/wtf/CrossThreadRefCounted.h \
-	Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.cpp \
-	Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.h \
-	Source/JavaScriptCore/wtf/CurrentTime.cpp \
-	Source/JavaScriptCore/wtf/CurrentTime.h \
-	Source/JavaScriptCore/wtf/DateMath.cpp \
-	Source/JavaScriptCore/wtf/DateMath.h \
-	Source/JavaScriptCore/wtf/DecimalNumber.h \
-	Source/JavaScriptCore/wtf/DecimalNumber.cpp \
-	Source/JavaScriptCore/wtf/Decoder.h \
-	Source/JavaScriptCore/wtf/Deque.h \
-	Source/JavaScriptCore/wtf/DisallowCType.h \
-	Source/JavaScriptCore/wtf/dtoa.cpp \
-	Source/JavaScriptCore/wtf/dtoa.h \
-	Source/JavaScriptCore/wtf/Encoder.h \
-	Source/JavaScriptCore/wtf/FastAllocBase.h \
-	Source/JavaScriptCore/wtf/FastMalloc.cpp \
-	Source/JavaScriptCore/wtf/FastMalloc.h \
-	Source/JavaScriptCore/wtf/FixedArray.h \
-	Source/JavaScriptCore/wtf/Forward.h \
-	Source/JavaScriptCore/wtf/GetPtr.h \
-	Source/JavaScriptCore/wtf/gobject/GOwnPtr.cpp \
-	Source/JavaScriptCore/wtf/gobject/GOwnPtr.h \
-	Source/JavaScriptCore/wtf/gobject/GRefPtr.cpp \
-	Source/JavaScriptCore/wtf/gobject/GRefPtr.h \
-	Source/JavaScriptCore/wtf/gobject/GTypedefs.h \
-	Source/JavaScriptCore/wtf/gtk/MainThreadGtk.cpp \
-	Source/JavaScriptCore/wtf/gtk/ThreadingGtk.cpp \
-	Source/JavaScriptCore/wtf/HashCountedSet.h \
-	Source/JavaScriptCore/wtf/HashFunctions.h \
-	Source/JavaScriptCore/wtf/HashIterators.h \
-	Source/JavaScriptCore/wtf/HashMap.h \
-	Source/JavaScriptCore/wtf/HashSet.h \
-	Source/JavaScriptCore/wtf/HashTable.cpp \
-	Source/JavaScriptCore/wtf/HashTable.h \
-	Source/JavaScriptCore/wtf/HashTraits.h \
-	Source/JavaScriptCore/wtf/ListHashSet.h \
-	Source/JavaScriptCore/wtf/ListRefPtr.h \
-	Source/JavaScriptCore/wtf/Locker.h \
-	Source/JavaScriptCore/wtf/MainThread.cpp \
-	Source/JavaScriptCore/wtf/MainThread.h \
-	Source/JavaScriptCore/wtf/MallocZoneSupport.h \
-	Source/JavaScriptCore/wtf/MathExtras.h \
-	Source/JavaScriptCore/wtf/MD5.cpp \
-	Source/JavaScriptCore/wtf/MD5.h \
-	Source/JavaScriptCore/wtf/MessageQueue.h \
-	Source/JavaScriptCore/wtf/NonCopyingSort.h \
-	Source/JavaScriptCore/wtf/Noncopyable.h \
-	Source/JavaScriptCore/wtf/NotFound.h \
-	Source/JavaScriptCore/wtf/NullPtr.h \
-	Source/JavaScriptCore/wtf/OSAllocator.h \
-	Source/JavaScriptCore/wtf/OSRandomSource.cpp \
-	Source/JavaScriptCore/wtf/OSRandomSource.h \
-	Source/JavaScriptCore/wtf/OwnArrayPtr.h \
-	Source/JavaScriptCore/wtf/OwnFastMallocPtr.h \
-	Source/JavaScriptCore/wtf/OwnPtrCommon.h \
-	Source/JavaScriptCore/wtf/OwnPtr.h \
-	Source/JavaScriptCore/wtf/PageAllocation.h \
-	Source/JavaScriptCore/wtf/PageAllocationAligned.cpp \
-	Source/JavaScriptCore/wtf/PageAllocationAligned.h \
-	Source/JavaScriptCore/wtf/PageReservation.h \
-	Source/JavaScriptCore/wtf/PageBlock.cpp \
-	Source/JavaScriptCore/wtf/PageBlock.h \
-	Source/JavaScriptCore/wtf/PassOwnArrayPtr.h \
-	Source/JavaScriptCore/wtf/PassOwnPtr.h \
-	Source/JavaScriptCore/wtf/PassRefPtr.h \
-	Source/JavaScriptCore/wtf/Platform.h \
-	Source/JavaScriptCore/wtf/PossiblyNull.h \
-	Source/JavaScriptCore/wtf/RandomNumber.cpp \
-	Source/JavaScriptCore/wtf/RandomNumber.h \
-	Source/JavaScriptCore/wtf/RandomNumberSeed.h \
-	Source/JavaScriptCore/wtf/RefCounted.h \
-	Source/JavaScriptCore/wtf/RefCountedLeakCounter.cpp \
-	Source/JavaScriptCore/wtf/RefCountedLeakCounter.h \
-	Source/JavaScriptCore/wtf/RefPtr.h \
-	Source/JavaScriptCore/wtf/RefPtrHashMap.h \
-	Source/JavaScriptCore/wtf/RetainPtr.h \
-	Source/JavaScriptCore/wtf/SegmentedVector.h \
-	Source/JavaScriptCore/wtf/StackBounds.cpp \
-	Source/JavaScriptCore/wtf/StackBounds.h \
-	Source/JavaScriptCore/wtf/StaticConstructors.h \
-	Source/JavaScriptCore/wtf/StdLibExtras.h \
-	Source/JavaScriptCore/wtf/StringExtras.h \
-	Source/JavaScriptCore/wtf/StringHasher.h \
-	Source/JavaScriptCore/wtf/TCPackedCache.h \
-	Source/JavaScriptCore/wtf/TCPageMap.h \
-	Source/JavaScriptCore/wtf/TCSpinLock.h \
-	Source/JavaScriptCore/wtf/TCSystemAlloc.cpp \
-	Source/JavaScriptCore/wtf/TCSystemAlloc.h \
-	Source/JavaScriptCore/wtf/text/AtomicString.cpp \
-	Source/JavaScriptCore/wtf/text/AtomicString.h \
-	Source/JavaScriptCore/wtf/text/AtomicStringHash.h \
-	Source/JavaScriptCore/wtf/text/AtomicStringImpl.h \
-	Source/JavaScriptCore/wtf/text/CString.cpp \
-	Source/JavaScriptCore/wtf/text/CString.h \
-	Source/JavaScriptCore/wtf/text/StringBuffer.h \
-	Source/JavaScriptCore/wtf/text/StringBuilder.cpp \
-	Source/JavaScriptCore/wtf/text/StringBuilder.h \
-	Source/JavaScriptCore/wtf/text/StringConcatenate.h \
-	Source/JavaScriptCore/wtf/text/StringHash.h \
-	Source/JavaScriptCore/wtf/text/StringImplBase.h \
-	Source/JavaScriptCore/wtf/text/StringImpl.cpp \
-	Source/JavaScriptCore/wtf/text/StringImpl.h \
-	Source/JavaScriptCore/wtf/text/StringStatics.cpp \
-	Source/JavaScriptCore/wtf/text/TextPosition.h \
-	Source/JavaScriptCore/wtf/text/WTFString.cpp \
-	Source/JavaScriptCore/wtf/text/WTFString.h \
-	Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp \
-	Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h \
-	Source/JavaScriptCore/wtf/Threading.cpp \
-	Source/JavaScriptCore/wtf/Threading.h \
-	Source/JavaScriptCore/wtf/ThreadingPrimitives.h \
-	Source/JavaScriptCore/wtf/ThreadingPthreads.cpp \
-	Source/JavaScriptCore/wtf/ThreadSafeShared.h \
-	Source/JavaScriptCore/wtf/ThreadSpecific.h \
-	Source/JavaScriptCore/wtf/TypeTraits.cpp \
-	Source/JavaScriptCore/wtf/TypeTraits.h \
-	Source/JavaScriptCore/wtf/unicode/CharacterNames.h \
-	Source/JavaScriptCore/wtf/unicode/CollatorDefault.cpp \
-	Source/JavaScriptCore/wtf/unicode/Collator.h \
-	Source/JavaScriptCore/wtf/unicode/Unicode.h \
-	Source/JavaScriptCore/wtf/unicode/UTF8.cpp \
-	Source/JavaScriptCore/wtf/unicode/UTF8.h \
-	Source/JavaScriptCore/wtf/UnusedParam.h \
-	Source/JavaScriptCore/wtf/ValueCheck.h \
-	Source/JavaScriptCore/wtf/Vector.h \
-	Source/JavaScriptCore/wtf/VectorTraits.h \
-	Source/JavaScriptCore/wtf/VMTags.h \
-	Source/JavaScriptCore/wtf/WTFThreadData.cpp \
-	Source/JavaScriptCore/wtf/WTFThreadData.h \
-	Source/JavaScriptCore/yarr/Yarr.h \
-	Source/JavaScriptCore/yarr/YarrInterpreter.cpp \
-	Source/JavaScriptCore/yarr/YarrInterpreter.h \
-	Source/JavaScriptCore/yarr/YarrJIT.cpp \
-	Source/JavaScriptCore/yarr/YarrJIT.h \
-	Source/JavaScriptCore/yarr/YarrParser.h \
-	Source/JavaScriptCore/yarr/YarrPattern.cpp \
-	Source/JavaScriptCore/yarr/YarrPattern.h \
-	Source/JavaScriptCore/yarr/YarrSyntaxChecker.cpp \
-	Source/JavaScriptCore/yarr/YarrSyntaxChecker.h
-
-if TARGET_WIN32
-javascriptcore_sources += \
-	Source/JavaScriptCore/runtime/MarkStackWin.cpp \
-	Source/JavaScriptCore/wtf/OSAllocatorWin.cpp
-else
-javascriptcore_sources += \
-	Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp \
-	Source/JavaScriptCore/runtime/MarkStackPosix.cpp \
-	Source/JavaScriptCore/wtf/OSAllocatorPosix.cpp
-endif
-
-# ----
-# icu unicode backend
-# ----
-if USE_ICU_UNICODE
-javascriptcore_sources += \
-	Source/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp \
-	Source/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
-endif # USE_ICU_UNICODE
-
-# ----
-# glib unicode backend
-# ----
-if USE_GLIB_UNICODE
-javascriptcore_sources += \
-	Source/JavaScriptCore/wtf/unicode/UnicodeMacrosFromICU.h \
-	Source/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h \
-	Source/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
-endif
-
 Source/JavaScriptCore/Lexer.lut.h: $(srcdir)/Source/JavaScriptCore/create_hash_table $(srcdir)/Source/JavaScriptCore/parser/Keywords.table
 	$(AM_V_GEN)$(PERL) $^ > $@
 
@@ -619,18 +45,6 @@ noinst_PROGRAMS += \
 	Programs/jsc \
 	Programs/minidom
 
-# minidom
-Programs_minidom_SOURCES = \
-	Source/JavaScriptCore/API/tests/JSNode.c \
-	Source/JavaScriptCore/API/tests/JSNode.h \
-	Source/JavaScriptCore/API/tests/JSNodeList.c \
-	Source/JavaScriptCore/API/tests/JSNodeList.h \
-	Source/JavaScriptCore/API/tests/Node.c \
-	Source/JavaScriptCore/API/tests/Node.h \
-	Source/JavaScriptCore/API/tests/NodeList.c \
-	Source/JavaScriptCore/API/tests/NodeList.h \
-	Source/JavaScriptCore/API/tests/minidom.c
-
 Programs_minidom_CPPFLAGS = \
 	$(global_cppflags) \
 	$(javascriptcore_cppflags)
@@ -657,9 +71,6 @@ Programs/jsc-@WEBKITGTK_API_MAJOR_VERSION@$(EXEEXT): Programs/jsc$(EXEEXT)
 Programs_jsc_@WEBKITGTK_API_MAJOR_VERSION@_LDADD =
 Programs_jsc_@WEBKITGTK_API_MAJOR_VERSION@_SOURCES =
 
-Programs_jsc_SOURCES = \
-	Source/JavaScriptCore/jsc.cpp
-
 Programs_jsc_CPPFLAGS = \
 	$(global_cppflags) \
 	$(javascriptcore_cppflags)
@@ -687,6 +98,7 @@ EXTRA_DIST += \
 	Source/JavaScriptCore/THANKS
 
 # Clean rules for JavaScriptCore
+# FIXME: Should this list be generated from javascriptcore_built_nosources?
 CLEANFILES += \
 	Source/JavaScriptCore/runtime/ArrayPrototype.lut.h \
 	Source/JavaScriptCore/runtime/DatePrototype.lut.h \
diff --git a/Source/JavaScriptCore/GNUmakefile.list.am b/Source/JavaScriptCore/GNUmakefile.list.am
new file mode 100644
index 0000000..ade4691
--- /dev/null
+++ b/Source/JavaScriptCore/GNUmakefile.list.am
@@ -0,0 +1,603 @@
+javascriptcore_h_api += \
+	Source/JavaScriptCore/API/JSBase.h \
+	Source/JavaScriptCore/API/JSContextRef.h \
+	Source/JavaScriptCore/API/JSObjectRef.h \
+	Source/JavaScriptCore/API/JSStringRef.h \
+	Source/JavaScriptCore/API/JSStringRefBSTR.h \
+	Source/JavaScriptCore/API/JSStringRefCF.h \
+	Source/JavaScriptCore/API/JSValueRef.h \
+	Source/JavaScriptCore/API/JavaScript.h \
+	Source/JavaScriptCore/API/JavaScriptCore.h \
+	Source/JavaScriptCore/API/WebKitAvailability.h
+
+javascriptcore_built_nosources += \
+	Source/JavaScriptCore/Lexer.lut.h \
+	Source/JavaScriptCore/RegExpJitTables.h \
+	Source/JavaScriptCore/runtime/ArrayPrototype.lut.h \
+	Source/JavaScriptCore/runtime/DatePrototype.lut.h \
+	Source/JavaScriptCore/runtime/JSONObject.lut.h \
+	Source/JavaScriptCore/runtime/MathObject.lut.h \
+	Source/JavaScriptCore/runtime/NumberConstructor.lut.h \
+	Source/JavaScriptCore/runtime/ObjectConstructor.lut.h \
+	Source/JavaScriptCore/runtime/RegExpConstructor.lut.h \
+	Source/JavaScriptCore/runtime/RegExpObject.lut.h \
+	Source/JavaScriptCore/runtime/StringPrototype.lut.h
+
+javascriptcore_sources += \
+	Source/JavaScriptCore/API/APICast.h \
+	Source/JavaScriptCore/API/APIShims.h \
+	Source/JavaScriptCore/API/JSBase.cpp \
+	Source/JavaScriptCore/API/JSBasePrivate.h \
+	Source/JavaScriptCore/API/JSCallbackConstructor.cpp \
+	Source/JavaScriptCore/API/JSCallbackConstructor.h \
+	Source/JavaScriptCore/API/JSCallbackFunction.cpp \
+	Source/JavaScriptCore/API/JSCallbackFunction.h \
+	Source/JavaScriptCore/API/JSCallbackObject.cpp \
+	Source/JavaScriptCore/API/JSCallbackObjectFunctions.h \
+	Source/JavaScriptCore/API/JSCallbackObject.h \
+	Source/JavaScriptCore/API/JSClassRef.cpp \
+	Source/JavaScriptCore/API/JSClassRef.h \
+	Source/JavaScriptCore/API/JSContextRef.cpp \
+	Source/JavaScriptCore/API/JSContextRefPrivate.h \
+	Source/JavaScriptCore/API/JSObjectRef.cpp \
+	Source/JavaScriptCore/API/JSObjectRefPrivate.h \
+	Source/JavaScriptCore/API/JSRetainPtr.h \
+	Source/JavaScriptCore/API/JSStringRef.cpp \
+	Source/JavaScriptCore/API/JSValueRef.cpp \
+	Source/JavaScriptCore/API/JSWeakObjectMapRefInternal.h \
+	Source/JavaScriptCore/API/OpaqueJSString.cpp \
+	Source/JavaScriptCore/API/OpaqueJSString.h \
+	Source/JavaScriptCore/assembler/AbstractMacroAssembler.h \
+	Source/JavaScriptCore/assembler/ARMAssembler.cpp \
+	Source/JavaScriptCore/assembler/ARMAssembler.h \
+	Source/JavaScriptCore/assembler/ARMv7Assembler.cpp \
+	Source/JavaScriptCore/assembler/ARMv7Assembler.h \
+	Source/JavaScriptCore/assembler/AssemblerBuffer.h \
+	Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h \
+	Source/JavaScriptCore/assembler/CodeLocation.h \
+	Source/JavaScriptCore/assembler/LinkBuffer.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp \
+	Source/JavaScriptCore/assembler/MacroAssemblerARM.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h \
+	Source/JavaScriptCore/assembler/MacroAssembler.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerX86.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerSH4.h \
+	Source/JavaScriptCore/assembler/MacroAssemblerSH4.cpp \
+	Source/JavaScriptCore/assembler/SH4Assembler.h \
+	Source/JavaScriptCore/assembler/RepatchBuffer.h \
+	Source/JavaScriptCore/assembler/X86Assembler.h \
+	Source/JavaScriptCore/bytecode/CodeBlock.cpp \
+	Source/JavaScriptCore/bytecode/CodeBlock.h \
+	Source/JavaScriptCore/bytecode/EvalCodeCache.h \
+	Source/JavaScriptCore/bytecode/Instruction.h \
+	Source/JavaScriptCore/bytecode/JumpTable.cpp \
+	Source/JavaScriptCore/bytecode/JumpTable.h \
+	Source/JavaScriptCore/bytecode/Opcode.cpp \
+	Source/JavaScriptCore/bytecode/Opcode.h \
+	Source/JavaScriptCore/bytecode/SamplingTool.cpp \
+	Source/JavaScriptCore/bytecode/SamplingTool.h \
+	Source/JavaScriptCore/bytecode/StructureStubInfo.cpp \
+	Source/JavaScriptCore/bytecode/StructureStubInfo.h \
+	Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp \
+	Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h \
+	Source/JavaScriptCore/bytecompiler/Label.h \
+	Source/JavaScriptCore/bytecompiler/LabelScope.h \
+	Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp \
+	Source/JavaScriptCore/bytecompiler/RegisterID.h \
+	Source/JavaScriptCore/heap/ConservativeRoots.cpp \
+	Source/JavaScriptCore/heap/ConservativeRoots.h \
+	Source/JavaScriptCore/heap/Handle.h \
+	Source/JavaScriptCore/heap/HandleHeap.cpp \
+	Source/JavaScriptCore/heap/HandleHeap.h \
+	Source/JavaScriptCore/heap/HandleStack.cpp \
+	Source/JavaScriptCore/heap/HandleStack.h \
+	Source/JavaScriptCore/heap/Heap.cpp \
+	Source/JavaScriptCore/heap/Heap.h \
+	Source/JavaScriptCore/heap/Local.h \
+	Source/JavaScriptCore/heap/LocalScope.h \
+	Source/JavaScriptCore/heap/MachineStackMarker.cpp \
+	Source/JavaScriptCore/heap/MachineStackMarker.h \
+	Source/JavaScriptCore/heap/MarkStack.cpp \
+	Source/JavaScriptCore/heap/MarkStack.h \
+	Source/JavaScriptCore/heap/MarkedBlock.cpp \
+	Source/JavaScriptCore/heap/MarkedBlock.h \
+	Source/JavaScriptCore/heap/MarkedSpace.cpp \
+	Source/JavaScriptCore/heap/MarkedSpace.h \
+	Source/JavaScriptCore/heap/Strong.h \
+	Source/JavaScriptCore/heap/Weak.h \
+	Source/JavaScriptCore/config.h \
+	Source/JavaScriptCore/debugger/DebuggerActivation.cpp \
+	Source/JavaScriptCore/debugger/DebuggerActivation.h \
+	Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp \
+	Source/JavaScriptCore/debugger/DebuggerCallFrame.h \
+	Source/JavaScriptCore/debugger/Debugger.cpp \
+	Source/JavaScriptCore/debugger/Debugger.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/APICast.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/APIShims.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScriptCore.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScript.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSBase.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSContextRef.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSObjectRef.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSRetainPtr.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRefCF.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRef.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSValueRef.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/OpaqueJSString.h \
+	Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/WebKitAvailability.h \
+	Source/JavaScriptCore/icu/unicode/parseerr.h \
+	Source/JavaScriptCore/icu/unicode/platform.h \
+	Source/JavaScriptCore/icu/unicode/putil.h \
+	Source/JavaScriptCore/icu/unicode/uchar.h \
+	Source/JavaScriptCore/icu/unicode/ucnv_err.h \
+	Source/JavaScriptCore/icu/unicode/ucnv.h \
+	Source/JavaScriptCore/icu/unicode/ucol.h \
+	Source/JavaScriptCore/icu/unicode/uconfig.h \
+	Source/JavaScriptCore/icu/unicode/uenum.h \
+	Source/JavaScriptCore/icu/unicode/uiter.h \
+	Source/JavaScriptCore/icu/unicode/uloc.h \
+	Source/JavaScriptCore/icu/unicode/umachine.h \
+	Source/JavaScriptCore/icu/unicode/unorm.h \
+	Source/JavaScriptCore/icu/unicode/urename.h \
+	Source/JavaScriptCore/icu/unicode/uset.h \
+	Source/JavaScriptCore/icu/unicode/ustring.h \
+	Source/JavaScriptCore/icu/unicode/utf16.h \
+	Source/JavaScriptCore/icu/unicode/utf8.h \
+	Source/JavaScriptCore/icu/unicode/utf.h \
+	Source/JavaScriptCore/icu/unicode/utf_old.h \
+	Source/JavaScriptCore/icu/unicode/utypes.h \
+	Source/JavaScriptCore/icu/unicode/uversion.h \
+	Source/JavaScriptCore/interpreter/CachedCall.h \
+	Source/JavaScriptCore/interpreter/CallFrameClosure.h \
+	Source/JavaScriptCore/interpreter/CallFrame.cpp \
+	Source/JavaScriptCore/interpreter/CallFrame.h \
+	Source/JavaScriptCore/interpreter/Interpreter.cpp \
+	Source/JavaScriptCore/interpreter/Interpreter.h \
+	Source/JavaScriptCore/interpreter/RegisterFile.cpp \
+	Source/JavaScriptCore/interpreter/RegisterFile.h \
+	Source/JavaScriptCore/interpreter/Register.h \
+	Source/JavaScriptCore/JavaScriptCorePrefix.h \
+	Source/JavaScriptCore/jit/ExecutableAllocator.cpp \
+	Source/JavaScriptCore/jit/ExecutableAllocator.h \
+	Source/JavaScriptCore/jit/JITArithmetic32_64.cpp \
+	Source/JavaScriptCore/jit/JITArithmetic.cpp \
+	Source/JavaScriptCore/jit/JITCall32_64.cpp \
+	Source/JavaScriptCore/jit/JITCall.cpp \
+	Source/JavaScriptCore/jit/JITCode.h \
+	Source/JavaScriptCore/jit/JIT.cpp \
+	Source/JavaScriptCore/jit/JIT.h \
+	Source/JavaScriptCore/jit/JITInlineMethods.h \
+	Source/JavaScriptCore/jit/JITOpcodes32_64.cpp \
+	Source/JavaScriptCore/jit/JITOpcodes.cpp \
+	Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp \
+	Source/JavaScriptCore/jit/JITPropertyAccess.cpp \
+	Source/JavaScriptCore/jit/JITStubCall.h \
+	Source/JavaScriptCore/jit/JITStubs.cpp \
+	Source/JavaScriptCore/jit/JITStubs.h \
+	Source/JavaScriptCore/jit/JSInterfaceJIT.h \
+	Source/JavaScriptCore/jit/SpecializedThunkJIT.h \
+	Source/JavaScriptCore/jit/ThunkGenerators.cpp \
+	Source/JavaScriptCore/jit/ThunkGenerators.h \
+	Source/JavaScriptCore/os-win32/stdbool.h \
+	Source/JavaScriptCore/os-win32/stdint.h \
+	Source/JavaScriptCore/parser/ASTBuilder.h \
+	Source/JavaScriptCore/parser/JSParser.cpp \
+	Source/JavaScriptCore/parser/JSParser.h \
+	Source/JavaScriptCore/parser/Lexer.cpp \
+	Source/JavaScriptCore/parser/Lexer.h \
+	Source/JavaScriptCore/parser/NodeConstructors.h \
+	Source/JavaScriptCore/parser/NodeInfo.h \
+	Source/JavaScriptCore/parser/Nodes.cpp \
+	Source/JavaScriptCore/parser/Nodes.h \
+	Source/JavaScriptCore/parser/ParserArena.cpp \
+	Source/JavaScriptCore/parser/ParserArena.h \
+	Source/JavaScriptCore/parser/Parser.cpp \
+	Source/JavaScriptCore/parser/Parser.h \
+	Source/JavaScriptCore/parser/ResultType.h \
+	Source/JavaScriptCore/parser/SourceCode.h \
+	Source/JavaScriptCore/parser/SourceProvider.h \
+	Source/JavaScriptCore/parser/SourceProviderCache.cpp \
+	Source/JavaScriptCore/parser/SourceProviderCache.h \
+	Source/JavaScriptCore/parser/SourceProviderCacheItem.h \
+	Source/JavaScriptCore/parser/SyntaxChecker.h \
+	Source/JavaScriptCore/profiler/CallIdentifier.h \
+	Source/JavaScriptCore/profiler/Profile.cpp \
+	Source/JavaScriptCore/profiler/ProfileGenerator.cpp \
+	Source/JavaScriptCore/profiler/ProfileGenerator.h \
+	Source/JavaScriptCore/profiler/Profile.h \
+	Source/JavaScriptCore/profiler/ProfileNode.cpp \
+	Source/JavaScriptCore/profiler/ProfileNode.h \
+	Source/JavaScriptCore/profiler/Profiler.cpp \
+	Source/JavaScriptCore/profiler/Profiler.h \
+	Source/JavaScriptCore/runtime/ArgList.cpp \
+	Source/JavaScriptCore/runtime/ArgList.h \
+	Source/JavaScriptCore/runtime/Arguments.cpp \
+	Source/JavaScriptCore/runtime/Arguments.h \
+	Source/JavaScriptCore/runtime/ArrayConstructor.cpp \
+	Source/JavaScriptCore/runtime/ArrayConstructor.h \
+	Source/JavaScriptCore/runtime/ArrayPrototype.cpp \
+	Source/JavaScriptCore/runtime/ArrayPrototype.h \
+	Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h \
+	Source/JavaScriptCore/runtime/BooleanConstructor.cpp \
+	Source/JavaScriptCore/runtime/BooleanConstructor.h \
+	Source/JavaScriptCore/runtime/BooleanObject.cpp \
+	Source/JavaScriptCore/runtime/BooleanObject.h \
+	Source/JavaScriptCore/runtime/BooleanPrototype.cpp \
+	Source/JavaScriptCore/runtime/BooleanPrototype.h \
+	Source/JavaScriptCore/runtime/CachedTranscendentalFunction.h \
+	Source/JavaScriptCore/runtime/CallData.cpp \
+	Source/JavaScriptCore/runtime/CallData.h \
+	Source/JavaScriptCore/runtime/ClassInfo.h \
+	Source/JavaScriptCore/runtime/CommonIdentifiers.cpp \
+	Source/JavaScriptCore/runtime/CommonIdentifiers.h \
+	Source/JavaScriptCore/runtime/Completion.cpp \
+	Source/JavaScriptCore/runtime/Completion.h \
+	Source/JavaScriptCore/runtime/ConstructData.cpp \
+	Source/JavaScriptCore/runtime/ConstructData.h \
+	Source/JavaScriptCore/runtime/DateConstructor.cpp \
+	Source/JavaScriptCore/runtime/DateConstructor.h \
+	Source/JavaScriptCore/runtime/DateConversion.cpp \
+	Source/JavaScriptCore/runtime/DateConversion.h \
+	Source/JavaScriptCore/runtime/DateInstanceCache.h \
+	Source/JavaScriptCore/runtime/DateInstance.cpp \
+	Source/JavaScriptCore/runtime/DateInstance.h \
+	Source/JavaScriptCore/runtime/DatePrototype.cpp \
+	Source/JavaScriptCore/runtime/DatePrototype.h \
+	Source/JavaScriptCore/runtime/ErrorConstructor.cpp \
+	Source/JavaScriptCore/runtime/ErrorConstructor.h \
+	Source/JavaScriptCore/runtime/Error.cpp \
+	Source/JavaScriptCore/runtime/Error.h \
+	Source/JavaScriptCore/runtime/ErrorInstance.cpp \
+	Source/JavaScriptCore/runtime/ErrorInstance.h \
+	Source/JavaScriptCore/runtime/ErrorPrototype.cpp \
+	Source/JavaScriptCore/runtime/ErrorPrototype.h \
+	Source/JavaScriptCore/runtime/ExceptionHelpers.cpp \
+	Source/JavaScriptCore/runtime/ExceptionHelpers.h \
+	Source/JavaScriptCore/runtime/Executable.cpp \
+	Source/JavaScriptCore/runtime/Executable.h \
+	Source/JavaScriptCore/runtime/FunctionConstructor.cpp \
+	Source/JavaScriptCore/runtime/FunctionConstructor.h \
+	Source/JavaScriptCore/runtime/FunctionPrototype.cpp \
+	Source/JavaScriptCore/runtime/FunctionPrototype.h \
+	Source/JavaScriptCore/runtime/GCActivityCallback.cpp \
+	Source/JavaScriptCore/runtime/GCActivityCallback.h \
+	Source/JavaScriptCore/runtime/GetterSetter.cpp \
+	Source/JavaScriptCore/runtime/GetterSetter.h \
+	Source/JavaScriptCore/runtime/Identifier.cpp \
+	Source/JavaScriptCore/runtime/Identifier.h \
+	Source/JavaScriptCore/runtime/InitializeThreading.cpp \
+	Source/JavaScriptCore/runtime/InitializeThreading.h \
+	Source/JavaScriptCore/runtime/InternalFunction.cpp \
+	Source/JavaScriptCore/runtime/InternalFunction.h \
+	Source/JavaScriptCore/runtime/JSActivation.cpp \
+	Source/JavaScriptCore/runtime/JSActivation.h \
+	Source/JavaScriptCore/runtime/JSAPIValueWrapper.cpp \
+	Source/JavaScriptCore/runtime/JSAPIValueWrapper.h \
+	Source/JavaScriptCore/runtime/JSArray.cpp \
+	Source/JavaScriptCore/runtime/JSArray.h \
+	Source/JavaScriptCore/runtime/JSByteArray.cpp \
+	Source/JavaScriptCore/runtime/JSByteArray.h \
+	Source/JavaScriptCore/runtime/JSCell.cpp \
+	Source/JavaScriptCore/runtime/JSCell.h \
+	Source/JavaScriptCore/runtime/JSFunction.cpp \
+	Source/JavaScriptCore/runtime/JSFunction.h \
+	Source/JavaScriptCore/runtime/JSGlobalData.cpp \
+	Source/JavaScriptCore/runtime/JSGlobalData.h \
+	Source/JavaScriptCore/runtime/JSGlobalObject.cpp \
+	Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp \
+	Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h \
+	Source/JavaScriptCore/runtime/JSGlobalObject.h \
+	Source/JavaScriptCore/runtime/JSLock.cpp \
+	Source/JavaScriptCore/runtime/JSLock.h \
+	Source/JavaScriptCore/runtime/JSNotAnObject.cpp \
+	Source/JavaScriptCore/runtime/JSNotAnObject.h \
+	Source/JavaScriptCore/runtime/JSObject.cpp \
+	Source/JavaScriptCore/runtime/JSObject.h \
+	Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp \
+	Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h \
+	Source/JavaScriptCore/runtime/JSONObject.cpp \
+	Source/JavaScriptCore/runtime/JSONObject.h \
+	Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp \
+	Source/JavaScriptCore/runtime/JSPropertyNameIterator.h \
+	Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp \
+	Source/JavaScriptCore/runtime/JSStaticScopeObject.h \
+	Source/JavaScriptCore/runtime/JSStringBuilder.h \
+	Source/JavaScriptCore/runtime/JSString.cpp \
+	Source/JavaScriptCore/runtime/JSString.h \
+	Source/JavaScriptCore/runtime/JSType.h \
+	Source/JavaScriptCore/runtime/JSTypeInfo.h \
+	Source/JavaScriptCore/runtime/JSValue.cpp \
+	Source/JavaScriptCore/runtime/JSValue.h \
+	Source/JavaScriptCore/runtime/JSValueInlineMethods.h \
+	Source/JavaScriptCore/runtime/JSVariableObject.cpp \
+	Source/JavaScriptCore/runtime/JSVariableObject.h \
+	Source/JavaScriptCore/runtime/JSWrapperObject.cpp \
+	Source/JavaScriptCore/runtime/JSWrapperObject.h \
+	Source/JavaScriptCore/runtime/JSZombie.h \
+	Source/JavaScriptCore/runtime/LiteralParser.cpp \
+	Source/JavaScriptCore/runtime/LiteralParser.h \
+	Source/JavaScriptCore/runtime/Lookup.cpp \
+	Source/JavaScriptCore/runtime/Lookup.h \
+	Source/JavaScriptCore/runtime/MathObject.cpp \
+	Source/JavaScriptCore/runtime/MathObject.h \
+	Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp \
+	Source/JavaScriptCore/runtime/NativeErrorConstructor.h \
+	Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp \
+	Source/JavaScriptCore/runtime/NativeErrorPrototype.h \
+	Source/JavaScriptCore/runtime/NumberConstructor.cpp \
+	Source/JavaScriptCore/runtime/NumberConstructor.h \
+	Source/JavaScriptCore/runtime/NumberObject.cpp \
+	Source/JavaScriptCore/runtime/NumberObject.h \
+	Source/JavaScriptCore/runtime/NumberPrototype.cpp \
+	Source/JavaScriptCore/runtime/NumberPrototype.h \
+	Source/JavaScriptCore/runtime/NumericStrings.h \
+	Source/JavaScriptCore/runtime/ObjectConstructor.cpp \
+	Source/JavaScriptCore/runtime/ObjectConstructor.h \
+	Source/JavaScriptCore/runtime/ObjectPrototype.cpp \
+	Source/JavaScriptCore/runtime/ObjectPrototype.h \
+	Source/JavaScriptCore/runtime/Operations.cpp \
+	Source/JavaScriptCore/runtime/Operations.h \
+	Source/JavaScriptCore/runtime/PropertyDescriptor.cpp \
+	Source/JavaScriptCore/runtime/PropertyDescriptor.h \
+	Source/JavaScriptCore/runtime/PropertyMapHashTable.h \
+	Source/JavaScriptCore/runtime/PropertyNameArray.cpp \
+	Source/JavaScriptCore/runtime/PropertyNameArray.h \
+	Source/JavaScriptCore/runtime/PropertySlot.cpp \
+	Source/JavaScriptCore/runtime/PropertySlot.h \
+	Source/JavaScriptCore/runtime/Protect.h \
+	Source/JavaScriptCore/runtime/PutPropertySlot.h \
+	Source/JavaScriptCore/runtime/RegExpCache.cpp \
+	Source/JavaScriptCore/runtime/RegExpCache.h \
+	Source/JavaScriptCore/runtime/RegExpConstructor.cpp \
+	Source/JavaScriptCore/runtime/RegExpConstructor.h \
+	Source/JavaScriptCore/runtime/RegExp.cpp \
+	Source/JavaScriptCore/runtime/RegExp.h \
+	Source/JavaScriptCore/runtime/RegExpKey.h \
+	Source/JavaScriptCore/runtime/RegExpMatchesArray.h \
+	Source/JavaScriptCore/runtime/RegExpObject.cpp \
+	Source/JavaScriptCore/runtime/RegExpObject.h \
+	Source/JavaScriptCore/runtime/RegExpPrototype.cpp \
+	Source/JavaScriptCore/runtime/RegExpPrototype.h \
+	Source/JavaScriptCore/runtime/RopeImpl.cpp \
+	Source/JavaScriptCore/runtime/RopeImpl.h \
+	Source/JavaScriptCore/runtime/ScopeChain.cpp \
+	Source/JavaScriptCore/runtime/ScopeChain.h \
+	Source/JavaScriptCore/runtime/ScopeChainMark.h \
+	Source/JavaScriptCore/runtime/SmallStrings.cpp \
+	Source/JavaScriptCore/runtime/SmallStrings.h \
+	Source/JavaScriptCore/runtime/StrictEvalActivation.cpp \
+	Source/JavaScriptCore/runtime/StrictEvalActivation.h \
+	Source/JavaScriptCore/runtime/StringConstructor.cpp \
+	Source/JavaScriptCore/runtime/StringConstructor.h \
+	Source/JavaScriptCore/runtime/StringObject.cpp \
+	Source/JavaScriptCore/runtime/StringObject.h \
+	Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h \
+	Source/JavaScriptCore/runtime/StringPrototype.cpp \
+	Source/JavaScriptCore/runtime/StringPrototype.h \
+	Source/JavaScriptCore/runtime/StringRecursionChecker.cpp \
+	Source/JavaScriptCore/runtime/StringRecursionChecker.h \
+	Source/JavaScriptCore/runtime/StructureChain.cpp \
+	Source/JavaScriptCore/runtime/StructureChain.h \
+	Source/JavaScriptCore/runtime/Structure.cpp \
+	Source/JavaScriptCore/runtime/Structure.h \
+	Source/JavaScriptCore/runtime/StructureTransitionTable.h \
+	Source/JavaScriptCore/runtime/SymbolTable.h \
+	Source/JavaScriptCore/runtime/Terminator.h \
+	Source/JavaScriptCore/runtime/TimeoutChecker.cpp \
+	Source/JavaScriptCore/runtime/TimeoutChecker.h \
+	Source/JavaScriptCore/runtime/Tracing.h \
+	Source/JavaScriptCore/runtime/UString.cpp \
+	Source/JavaScriptCore/runtime/UString.h \
+	Source/JavaScriptCore/runtime/UStringBuilder.h \
+	Source/JavaScriptCore/runtime/UStringConcatenate.h \
+	Source/JavaScriptCore/runtime/WeakGCMap.h \
+	Source/JavaScriptCore/runtime/WeakRandom.h \
+	Source/JavaScriptCore/runtime/WriteBarrier.h \
+	Source/JavaScriptCore/wtf/AlwaysInline.h \
+	Source/JavaScriptCore/wtf/ASCIICType.h \
+	Source/JavaScriptCore/wtf/Assertions.cpp \
+	Source/JavaScriptCore/wtf/Assertions.h \
+	Source/JavaScriptCore/wtf/Atomics.h \
+	Source/JavaScriptCore/wtf/AVLTree.h \
+	Source/JavaScriptCore/wtf/Bitmap.h \
+	Source/JavaScriptCore/wtf/BlockStack.h \
+	Source/JavaScriptCore/wtf/BloomFilter.h \
+	Source/JavaScriptCore/wtf/BumpPointerAllocator.h \
+	Source/JavaScriptCore/wtf/ByteArray.cpp \
+	Source/JavaScriptCore/wtf/ByteArray.h \
+	Source/JavaScriptCore/wtf/CrossThreadRefCounted.h \
+	Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.cpp \
+	Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.h \
+	Source/JavaScriptCore/wtf/CurrentTime.cpp \
+	Source/JavaScriptCore/wtf/CurrentTime.h \
+	Source/JavaScriptCore/wtf/DateMath.cpp \
+	Source/JavaScriptCore/wtf/DateMath.h \
+	Source/JavaScriptCore/wtf/DecimalNumber.h \
+	Source/JavaScriptCore/wtf/DecimalNumber.cpp \
+	Source/JavaScriptCore/wtf/Decoder.h \
+	Source/JavaScriptCore/wtf/Deque.h \
+	Source/JavaScriptCore/wtf/DisallowCType.h \
+	Source/JavaScriptCore/wtf/DoublyLinkedList.h \
+	Source/JavaScriptCore/wtf/dtoa.cpp \
+	Source/JavaScriptCore/wtf/dtoa.h \
+	Source/JavaScriptCore/wtf/DynamicAnnotations.cpp \
+	Source/JavaScriptCore/wtf/DynamicAnnotations.h \
+	Source/JavaScriptCore/wtf/Encoder.h \
+	Source/JavaScriptCore/wtf/FastAllocBase.h \
+	Source/JavaScriptCore/wtf/FastMalloc.cpp \
+	Source/JavaScriptCore/wtf/FastMalloc.h \
+	Source/JavaScriptCore/wtf/FixedArray.h \
+	Source/JavaScriptCore/wtf/Forward.h \
+	Source/JavaScriptCore/wtf/GetPtr.h \
+	Source/JavaScriptCore/wtf/gobject/GOwnPtr.cpp \
+	Source/JavaScriptCore/wtf/gobject/GOwnPtr.h \
+	Source/JavaScriptCore/wtf/gobject/GRefPtr.cpp \
+	Source/JavaScriptCore/wtf/gobject/GRefPtr.h \
+	Source/JavaScriptCore/wtf/gobject/GTypedefs.h \
+	Source/JavaScriptCore/wtf/gtk/MainThreadGtk.cpp \
+	Source/JavaScriptCore/wtf/gtk/ThreadingGtk.cpp \
+	Source/JavaScriptCore/wtf/HashCountedSet.h \
+	Source/JavaScriptCore/wtf/HashFunctions.h \
+	Source/JavaScriptCore/wtf/HashIterators.h \
+	Source/JavaScriptCore/wtf/HashMap.h \
+	Source/JavaScriptCore/wtf/HashSet.h \
+	Source/JavaScriptCore/wtf/HashTable.cpp \
+	Source/JavaScriptCore/wtf/HashTable.h \
+	Source/JavaScriptCore/wtf/HashTraits.h \
+	Source/JavaScriptCore/wtf/HexNumber.h \
+	Source/JavaScriptCore/wtf/ListHashSet.h \
+	Source/JavaScriptCore/wtf/ListRefPtr.h \
+	Source/JavaScriptCore/wtf/Locker.h \
+	Source/JavaScriptCore/wtf/MainThread.cpp \
+	Source/JavaScriptCore/wtf/MainThread.h \
+	Source/JavaScriptCore/wtf/MallocZoneSupport.h \
+	Source/JavaScriptCore/wtf/MathExtras.h \
+	Source/JavaScriptCore/wtf/MD5.cpp \
+	Source/JavaScriptCore/wtf/MD5.h \
+	Source/JavaScriptCore/wtf/MessageQueue.h \
+	Source/JavaScriptCore/wtf/NonCopyingSort.h \
+	Source/JavaScriptCore/wtf/Noncopyable.h \
+	Source/JavaScriptCore/wtf/NotFound.h \
+	Source/JavaScriptCore/wtf/NullPtr.h \
+	Source/JavaScriptCore/wtf/OSAllocator.h \
+	Source/JavaScriptCore/wtf/OSRandomSource.cpp \
+	Source/JavaScriptCore/wtf/OSRandomSource.h \
+	Source/JavaScriptCore/wtf/OwnArrayPtr.h \
+	Source/JavaScriptCore/wtf/OwnFastMallocPtr.h \
+	Source/JavaScriptCore/wtf/OwnPtrCommon.h \
+	Source/JavaScriptCore/wtf/OwnPtr.h \
+	Source/JavaScriptCore/wtf/PageAllocation.h \
+	Source/JavaScriptCore/wtf/PageAllocationAligned.cpp \
+	Source/JavaScriptCore/wtf/PageAllocationAligned.h \
+	Source/JavaScriptCore/wtf/PageReservation.h \
+	Source/JavaScriptCore/wtf/PageBlock.cpp \
+	Source/JavaScriptCore/wtf/PageBlock.h \
+	Source/JavaScriptCore/wtf/PassOwnArrayPtr.h \
+	Source/JavaScriptCore/wtf/PassOwnPtr.h \
+	Source/JavaScriptCore/wtf/PassRefPtr.h \
+	Source/JavaScriptCore/wtf/Platform.h \
+	Source/JavaScriptCore/wtf/PossiblyNull.h \
+	Source/JavaScriptCore/wtf/RandomNumber.cpp \
+	Source/JavaScriptCore/wtf/RandomNumber.h \
+	Source/JavaScriptCore/wtf/RandomNumberSeed.h \
+	Source/JavaScriptCore/wtf/RefCounted.h \
+	Source/JavaScriptCore/wtf/RefCountedLeakCounter.cpp \
+	Source/JavaScriptCore/wtf/RefCountedLeakCounter.h \
+	Source/JavaScriptCore/wtf/RefPtr.h \
+	Source/JavaScriptCore/wtf/RefPtrHashMap.h \
+	Source/JavaScriptCore/wtf/RetainPtr.h \
+	Source/JavaScriptCore/wtf/SegmentedVector.h \
+	Source/JavaScriptCore/wtf/SentinelLinkedList.h \
+	Source/JavaScriptCore/wtf/SHA1.cpp \
+	Source/JavaScriptCore/wtf/SHA1.h \
+	Source/JavaScriptCore/wtf/SinglyLinkedList.h \
+	Source/JavaScriptCore/wtf/StackBounds.cpp \
+	Source/JavaScriptCore/wtf/StackBounds.h \
+	Source/JavaScriptCore/wtf/StaticConstructors.h \
+	Source/JavaScriptCore/wtf/StdLibExtras.h \
+	Source/JavaScriptCore/wtf/StringExtras.h \
+	Source/JavaScriptCore/wtf/StringHasher.h \
+	Source/JavaScriptCore/wtf/TCPackedCache.h \
+	Source/JavaScriptCore/wtf/TCPageMap.h \
+	Source/JavaScriptCore/wtf/TCSpinLock.h \
+	Source/JavaScriptCore/wtf/TCSystemAlloc.cpp \
+	Source/JavaScriptCore/wtf/TCSystemAlloc.h \
+	Source/JavaScriptCore/wtf/text/AtomicString.cpp \
+	Source/JavaScriptCore/wtf/text/AtomicString.h \
+	Source/JavaScriptCore/wtf/text/AtomicStringHash.h \
+	Source/JavaScriptCore/wtf/text/AtomicStringImpl.h \
+	Source/JavaScriptCore/wtf/text/CString.cpp \
+	Source/JavaScriptCore/wtf/text/CString.h \
+	Source/JavaScriptCore/wtf/text/StringBuffer.h \
+	Source/JavaScriptCore/wtf/text/StringBuilder.cpp \
+	Source/JavaScriptCore/wtf/text/StringBuilder.h \
+	Source/JavaScriptCore/wtf/text/StringConcatenate.h \
+	Source/JavaScriptCore/wtf/text/StringHash.h \
+	Source/JavaScriptCore/wtf/text/StringImplBase.h \
+	Source/JavaScriptCore/wtf/text/StringImpl.cpp \
+	Source/JavaScriptCore/wtf/text/StringImpl.h \
+	Source/JavaScriptCore/wtf/text/StringStatics.cpp \
+	Source/JavaScriptCore/wtf/text/TextPosition.h \
+	Source/JavaScriptCore/wtf/text/WTFString.cpp \
+	Source/JavaScriptCore/wtf/text/WTFString.h \
+	Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp \
+	Source/JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h \
+	Source/JavaScriptCore/wtf/Threading.cpp \
+	Source/JavaScriptCore/wtf/Threading.h \
+	Source/JavaScriptCore/wtf/ThreadingPrimitives.h \
+	Source/JavaScriptCore/wtf/ThreadingPthreads.cpp \
+	Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h \
+	Source/JavaScriptCore/wtf/ThreadSpecific.h \
+	Source/JavaScriptCore/wtf/TypeTraits.cpp \
+	Source/JavaScriptCore/wtf/TypeTraits.h \
+	Source/JavaScriptCore/wtf/unicode/CharacterNames.h \
+	Source/JavaScriptCore/wtf/unicode/CollatorDefault.cpp \
+	Source/JavaScriptCore/wtf/unicode/Collator.h \
+	Source/JavaScriptCore/wtf/unicode/Unicode.h \
+	Source/JavaScriptCore/wtf/unicode/UTF8.cpp \
+	Source/JavaScriptCore/wtf/unicode/UTF8.h \
+	Source/JavaScriptCore/wtf/UnusedParam.h \
+	Source/JavaScriptCore/wtf/ValueCheck.h \
+	Source/JavaScriptCore/wtf/Vector.h \
+	Source/JavaScriptCore/wtf/VectorTraits.h \
+	Source/JavaScriptCore/wtf/VMTags.h \
+	Source/JavaScriptCore/wtf/WTFThreadData.cpp \
+	Source/JavaScriptCore/wtf/WTFThreadData.h \
+	Source/JavaScriptCore/yarr/Yarr.h \
+	Source/JavaScriptCore/yarr/YarrInterpreter.cpp \
+	Source/JavaScriptCore/yarr/YarrInterpreter.h \
+	Source/JavaScriptCore/yarr/YarrJIT.cpp \
+	Source/JavaScriptCore/yarr/YarrJIT.h \
+	Source/JavaScriptCore/yarr/YarrParser.h \
+	Source/JavaScriptCore/yarr/YarrPattern.cpp \
+	Source/JavaScriptCore/yarr/YarrPattern.h \
+	Source/JavaScriptCore/yarr/YarrSyntaxChecker.cpp \
+	Source/JavaScriptCore/yarr/YarrSyntaxChecker.h
+
+if TARGET_WIN32
+javascriptcore_sources += \
+	Source/JavaScriptCore/heap/MarkStackWin.cpp \
+	Source/JavaScriptCore/wtf/OSAllocatorWin.cpp
+else
+javascriptcore_sources += \
+	Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp \
+	Source/JavaScriptCore/heap/MarkStackPosix.cpp \
+	Source/JavaScriptCore/wtf/OSAllocatorPosix.cpp
+endif
+
+# ----
+# icu unicode backend
+# ----
+if USE_ICU_UNICODE
+javascriptcore_sources += \
+	Source/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp \
+	Source/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
+endif # USE_ICU_UNICODE
+
+# ----
+# glib unicode backend
+# ----
+if USE_GLIB_UNICODE
+javascriptcore_sources += \
+	Source/JavaScriptCore/wtf/unicode/UnicodeMacrosFromICU.h \
+	Source/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h \
+	Source/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
+endif # USE_GLIB_UNICODE
+
+# minidom
+Programs_minidom_SOURCES = \
+	Source/JavaScriptCore/API/tests/JSNode.c \
+	Source/JavaScriptCore/API/tests/JSNode.h \
+	Source/JavaScriptCore/API/tests/JSNodeList.c \
+	Source/JavaScriptCore/API/tests/JSNodeList.h \
+	Source/JavaScriptCore/API/tests/Node.c \
+	Source/JavaScriptCore/API/tests/Node.h \
+	Source/JavaScriptCore/API/tests/NodeList.c \
+	Source/JavaScriptCore/API/tests/NodeList.h \
+	Source/JavaScriptCore/API/tests/minidom.c
+
+Programs_jsc_SOURCES = \
+	Source/JavaScriptCore/jsc.cpp
diff --git a/Source/JavaScriptCore/JavaScriptCore.JSVALUE32_64only.exp b/Source/JavaScriptCore/JavaScriptCore.JSVALUE32_64only.exp
index 7e520ae..f9eee85 100644
--- a/Source/JavaScriptCore/JavaScriptCore.JSVALUE32_64only.exp
+++ b/Source/JavaScriptCore/JavaScriptCore.JSVALUE32_64only.exp
@@ -1,2 +1 @@
-__ZN3JSC10JSFunctionC1EPNS_9ExecStateEPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFxS2_E
-__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFxS2_E
+__ZN3JSC10JSFunctionC1EPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureEiRKNS_10IdentifierEPFxS2_E
diff --git a/Source/JavaScriptCore/JavaScriptCore.JSVALUE64only.exp b/Source/JavaScriptCore/JavaScriptCore.JSVALUE64only.exp
index 73efb9d..eaa9f51 100644
--- a/Source/JavaScriptCore/JavaScriptCore.JSVALUE64only.exp
+++ b/Source/JavaScriptCore/JavaScriptCore.JSVALUE64only.exp
@@ -1,2 +1 @@
-__ZN3JSC10JSFunctionC1EPNS_9ExecStateEPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFPvS2_E
-__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFPvS2_E
+__ZN3JSC10JSFunctionC1EPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureEiRKNS_10IdentifierEPFPvS2_E
diff --git a/Source/JavaScriptCore/JavaScriptCore.exp b/Source/JavaScriptCore/JavaScriptCore.exp
index 564d7db..1b00c66 100644
--- a/Source/JavaScriptCore/JavaScriptCore.exp
+++ b/Source/JavaScriptCore/JavaScriptCore.exp
@@ -97,6 +97,8 @@ _WTFReportBacktrace
 _WTFReportError
 _WTFReportFatalError
 __ZN14OpaqueJSString6createERKN3JSC7UStringE
+__ZN3JSC10HandleHeap12writeBarrierEPNS_7JSValueERKS1_
+__ZN3JSC10HandleHeap4growEv
 __ZN3JSC10Identifier11addSlowCaseEPNS_12JSGlobalDataEPN3WTF10StringImplE
 __ZN3JSC10Identifier11addSlowCaseEPNS_9ExecStateEPN3WTF10StringImplE
 __ZN3JSC10Identifier27checkCurrentIdentifierTableEPNS_12JSGlobalDataE
@@ -106,18 +108,20 @@ __ZN3JSC10Identifier4fromEPNS_9ExecStateEi
 __ZN3JSC10Identifier4fromEPNS_9ExecStateEj
 __ZN3JSC10Identifier5equalEPKN3WTF10StringImplEPKc
 __ZN3JSC10Identifier8toUInt32ERKNS_7UStringERb
-__ZN3JSC10JSFunction4infoE
 __ZN3JSC10JSFunction4nameEPNS_9ExecStateE
+__ZN3JSC10JSFunction6s_infoE
 __ZN3JSC10throwErrorEPNS_9ExecStateENS_7JSValueE
 __ZN3JSC10throwErrorEPNS_9ExecStateEPNS_8JSObjectE
-__ZN3JSC11JSByteArray15createStructureENS_7JSValueE
-__ZN3JSC11JSByteArrayC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEPNS3_9ByteArrayEPKNS_9ClassInfoE
+__ZN3JSC11JSByteArray13s_defaultInfoE
+__ZN3JSC11JSByteArray15createStructureERNS_12JSGlobalDataENS_7JSValueEPKNS_9ClassInfoE
+__ZN3JSC11JSByteArrayC1EPNS_9ExecStateEPNS_9StructureEPN3WTF9ByteArrayE
+__ZN3JSC11MarkedSpace21allocateFromSizeClassERNS0_9SizeClassE
 __ZN3JSC11ParserArena5resetEv
 __ZN3JSC11checkSyntaxEPNS_9ExecStateERKNS_10SourceCodeE
 __ZN3JSC11createErrorEPNS_9ExecStateERKNS_7UStringE
-__ZN3JSC12DateInstance4infoE
-__ZN3JSC12DateInstanceC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEd
-__ZN3JSC12DateInstanceC1EPNS_9ExecStateEd
+__ZN3JSC11regExpFlagsERKNS_7UStringE
+__ZN3JSC12DateInstance6s_infoE
+__ZN3JSC12DateInstanceC1EPNS_9ExecStateEPNS_9StructureEd
 __ZN3JSC12JSGlobalData10ClientDataD2Ev
 __ZN3JSC12JSGlobalData11jsArrayVPtrE
 __ZN3JSC12JSGlobalData12createLeakedENS_15ThreadStackTypeE
@@ -128,10 +132,11 @@ __ZN3JSC12JSGlobalData14dumpSampleDataEPNS_9ExecStateE
 __ZN3JSC12JSGlobalData14resetDateCacheEv
 __ZN3JSC12JSGlobalData14sharedInstanceEv
 __ZN3JSC12JSGlobalData15dumpRegExpTraceEv
+__ZN3JSC12JSGlobalData22clearBuiltinStructuresEv
 __ZN3JSC12JSGlobalData6createENS_15ThreadStackTypeE
 __ZN3JSC12JSGlobalDataD1Ev
-__ZN3JSC12RegExpObject4infoE
-__ZN3JSC12RegExpObjectC1EPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEENS4_INS_6RegExpEEE
+__ZN3JSC12RegExpObject6s_infoE
+__ZN3JSC12RegExpObjectC1EPNS_14JSGlobalObjectEPNS_9StructureEN3WTF17NonNullPassRefPtrINS_6RegExpEEE
 __ZN3JSC12SamplingTool5setupEv
 __ZN3JSC12SmallStrings17createEmptyStringEPNS_12JSGlobalDataE
 __ZN3JSC12SmallStrings27createSingleCharacterStringEPNS_12JSGlobalDataEh
@@ -141,10 +146,8 @@ __ZN3JSC12StringObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
 __ZN3JSC12StringObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
 __ZN3JSC12StringObject24getOwnPropertyDescriptorEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
 __ZN3JSC12StringObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
-__ZN3JSC12StringObject4infoE
-__ZN3JSC12StringObjectC2EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_7UStringE
-__ZN3JSC12WeakGCHandle4poolEv
-__ZN3JSC12jsNumberCellEPNS_9ExecStateEd
+__ZN3JSC12StringObject6s_infoE
+__ZN3JSC12StringObjectC2EPNS_9ExecStateEPNS_9StructureERKNS_7UStringE
 __ZN3JSC12nonInlineNaNEv
 __ZN3JSC13SamplingFlags4stopEv
 __ZN3JSC13SamplingFlags5startEv
@@ -155,30 +158,33 @@ __ZN3JSC14JSGlobalObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSO
 __ZN3JSC14JSGlobalObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectEj
 __ZN3JSC14JSGlobalObject12markChildrenERNS_9MarkStackE
 __ZN3JSC14JSGlobalObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
-__ZN3JSC14JSGlobalObject25destroyJSGlobalObjectDataEPv
 __ZN3JSC14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE  
 __ZN3JSC14JSGlobalObject4initEPNS_8JSObjectE
 __ZN3JSC14JSGlobalObjectD2Ev
 __ZN3JSC14JSGlobalObjectnwEmPNS_12JSGlobalDataE
+__ZN3JSC14MachineThreads16addCurrentThreadEv
 __ZN3JSC14SamplingThread4stopEv
 __ZN3JSC14SamplingThread5startEj
 __ZN3JSC14TimeoutChecker10didTimeOutEPNS_9ExecStateE
 __ZN3JSC14TimeoutChecker5resetEv
 __ZN3JSC14throwTypeErrorEPNS_9ExecStateE
 __ZN3JSC15JSWrapperObject12markChildrenERNS_9MarkStackE
+__ZN3JSC15WeakHandleOwner26isReachableFromOpaqueRootsENS_6HandleINS_7UnknownEEEPvRNS_9MarkStackE
+__ZN3JSC15WeakHandleOwner8finalizeENS_6HandleINS_7UnknownEEEPv
+__ZN3JSC15WeakHandleOwnerD2Ev
 __ZN3JSC15createTypeErrorEPNS_9ExecStateERKNS_7UStringE
-__ZN3JSC16InternalFunction4infoE
+__ZN3JSC16InternalFunction12vtableAnchorEv
 __ZN3JSC16InternalFunction4nameEPNS_9ExecStateE
-__ZN3JSC16InternalFunctionC2EPNS_12JSGlobalDataEPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_10IdentifierE
+__ZN3JSC16InternalFunction6s_infoE
+__ZN3JSC16InternalFunctionC2EPNS_12JSGlobalDataEPNS_14JSGlobalObjectEPNS_9StructureERKNS_10IdentifierE
 __ZN3JSC16JSVariableObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
 __ZN3JSC16JSVariableObject14symbolTableGetERKNS_10IdentifierERNS_18PropertyDescriptorE
 __ZN3JSC16JSVariableObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
-__ZN3JSC16WeakGCHandlePool4freeEPNS_12WeakGCHandleE
 __ZN3JSC16createRangeErrorEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC16throwSyntaxErrorEPNS_9ExecStateE
 __ZN3JSC17BytecodeGenerator21setDumpsGeneratedCodeEb
 __ZN3JSC17PropertyNameArray3addEPN3WTF10StringImplE
-__ZN3JSC17constructFunctionEPNS_9ExecStateERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
+__ZN3JSC17constructFunctionEPNS_9ExecStateEPNS_14JSGlobalObjectERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
 __ZN3JSC17createSyntaxErrorEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC18DebuggerActivationC1ERNS_12JSGlobalDataEPNS_8JSObjectE
 __ZN3JSC18PropertyDescriptor11setWritableEb
@@ -196,17 +202,19 @@ __ZN3JSC19initializeThreadingEv
 __ZN3JSC20MarkedArgumentBuffer10slowAppendENS_7JSValueE
 __ZN3JSC20createReferenceErrorEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC22globalMemoryStatisticsEv
+__ZN3JSC22objectConstructorTableE
 __ZN3JSC23AbstractSamplingCounter4dumpEv
 __ZN3JSC23objectProtoFuncToStringEPNS_9ExecStateE
 __ZN3JSC23setUpStaticFunctionSlotEPNS_9ExecStateEPKNS_9HashEntryEPNS_8JSObjectERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3JSC24DynamicGlobalObjectScopeC1EPNS_9ExecStateEPNS_14JSGlobalObjectE
-__ZN3JSC24JSObjectWithGlobalObjectC2EPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEE
-__ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
+__ZN3JSC24DynamicGlobalObjectScopeC1ERNS_12JSGlobalDataEPNS_14JSGlobalObjectE
+__ZN3JSC24JSObjectWithGlobalObjectC2EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC24JSObjectWithGlobalObjectC2ERNS_12JSGlobalDataEPNS_14JSGlobalObjectEPNS_9StructureE
 __ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
 __ZN3JSC25evaluateInGlobalCallFrameERKNS_7UStringERNS_7JSValueEPNS_14JSGlobalObjectE
 __ZN3JSC35createInterruptedExecutionExceptionEPNS_12JSGlobalDataE
 __ZN3JSC3NaNE
-__ZN3JSC4Heap15addWeakGCHandleEPNS_6JSCellE
+__ZN3JSC4Heap16activityCallbackEv
+__ZN3JSC4Heap16allocateSlowCaseEm
 __ZN3JSC4Heap16objectTypeCountsEv
 __ZN3JSC4Heap17collectAllGarbageEv
 __ZN3JSC4Heap17globalObjectCountEv
@@ -218,12 +226,11 @@ __ZN3JSC4Heap29reportExtraMemoryCostSlowCaseEm
 __ZN3JSC4Heap6isBusyEv
 __ZN3JSC4Heap7destroyEv
 __ZN3JSC4Heap7protectENS_7JSValueE
-__ZN3JSC4Heap8allocateEm
 __ZN3JSC4Heap9unprotectENS_7JSValueE
-__ZN3JSC4callEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataES2_RKNS_7ArgListE
 __ZN3JSC4Yarr11YarrPatternC1ERKNS_7UStringEbbPPKc
 __ZN3JSC4Yarr11byteCompileERNS0_11YarrPatternEPN3WTF20BumpPointerAllocatorE
 __ZN3JSC4Yarr9interpretEPNS0_15BytecodePatternEPKtjjPi
+__ZN3JSC4callEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataES2_RKNS_7ArgListE
 __ZN3JSC6JSCell11getCallDataERNS_8CallDataE
 __ZN3JSC6JSCell11getJSNumberEv
 __ZN3JSC6JSCell14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
@@ -238,20 +245,21 @@ __ZN3JSC6JSCell9getObjectEv
 __ZN3JSC6JSLock12DropAllLocksC1ENS_14JSLockBehaviorE
 __ZN3JSC6JSLock12DropAllLocksC1EPNS_9ExecStateE
 __ZN3JSC6JSLock12DropAllLocksD1Ev
+__ZN3JSC6JSLock26currentThreadIsHoldingLockEv
 __ZN3JSC6JSLock4lockENS_14JSLockBehaviorE
 __ZN3JSC6JSLock6unlockENS_14JSLockBehaviorE
 __ZN3JSC6JSLock9lockCountEv
 __ZN3JSC6JSLockC1EPNS_9ExecStateE
-__ZN3JSC6RegExp6createEPNS_12JSGlobalDataERKNS_7UStringES5_
+__ZN3JSC6RegExp6createEPNS_12JSGlobalDataERKNS_7UStringENS_11RegExpFlagsE
 __ZN3JSC6RegExpD1Ev
 __ZN3JSC7JSArray12markChildrenERNS_9MarkStackE
 __ZN3JSC7JSArray15setSubclassDataEPv
 __ZN3JSC7JSArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3JSC7JSArray4infoE
+__ZN3JSC7JSArray6s_infoE
 __ZN3JSC7JSArray9setLengthEj
-__ZN3JSC7JSArrayC1EN3WTF17NonNullPassRefPtrINS_9StructureEEE
-__ZN3JSC7JSArrayC1ERNS_12JSGlobalDataEN3WTF17NonNullPassRefPtrINS_9StructureEEERKNS_7ArgListE
-__ZN3JSC7JSArrayC2EN3WTF17NonNullPassRefPtrINS_9StructureEEE
+__ZN3JSC7JSArrayC1ERNS_12JSGlobalDataEPNS_9StructureE
+__ZN3JSC7JSArrayC1ERNS_12JSGlobalDataEPNS_9StructureERKNS_7ArgListE
+__ZN3JSC7JSArrayC2ERNS_12JSGlobalDataEPNS_9StructureE
 __ZN3JSC7JSArrayD2Ev
 __ZN3JSC7JSValue13isValidCalleeEv
 __ZN3JSC7Profile10restoreAllEv
@@ -281,7 +289,6 @@ __ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
 __ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateEj
 __ZN3JSC8JSObject15unwrappedObjectEv
 __ZN3JSC8JSObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
-__ZN3JSC8JSObject17createInheritorIDEv
 __ZN3JSC8JSObject17defineOwnPropertyEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorEb
 __ZN3JSC8JSObject17putDirectFunctionEPNS_9ExecStateEPNS_10JSFunctionEj
 __ZN3JSC8JSObject17putDirectFunctionEPNS_9ExecStateEPNS_16InternalFunctionEj
@@ -300,26 +307,25 @@ __ZN3JSC8JSObject23allocatePropertyStorageEmm
 __ZN3JSC8JSObject24getOwnPropertyDescriptorEPNS_9ExecStateERKNS_10IdentifierERNS_18PropertyDescriptorE
 __ZN3JSC8JSObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
 __ZN3JSC8JSObject3putEPNS_9ExecStateEjNS_7JSValueE  
+__ZN3JSC8JSObject6s_infoE
 __ZN3JSC8Profiler13stopProfilingEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC8Profiler14startProfilingEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC8Profiler8profilerEv
-__ZN3JSC8evaluateEPNS_9ExecStateERNS_10ScopeChainERKNS_10SourceCodeENS_7JSValueE
+__ZN3JSC8evaluateEPNS_9ExecStateEPNS_14ScopeChainNodeERKNS_10SourceCodeENS_7JSValueE
+__ZN3JSC8isZombieEPKNS_6JSCellE
 __ZN3JSC9CodeBlockD1Ev
 __ZN3JSC9CodeBlockD2Ev
 __ZN3JSC9MarkStack10s_pageSizeE
 __ZN3JSC9MarkStack18initializePagesizeEv
-__ZN3JSC9Structure13hasTransitionEPN3WTF10StringImplEj
-__ZN3JSC9Structure17stopIgnoringLeaksEv
-__ZN3JSC9Structure18startIgnoringLeaksEv
-__ZN3JSC9Structure21addPropertyTransitionEPS0_RKNS_10IdentifierEjPNS_6JSCellERm
-__ZN3JSC9Structure22materializePropertyMapEv
-__ZN3JSC9Structure25changePrototypeTransitionEPS0_NS_7JSValueE
-__ZN3JSC9Structure27despecifyDictionaryFunctionERKNS_10IdentifierE
-__ZN3JSC9Structure27despecifyFunctionTransitionEPS0_RKNS_10IdentifierE
-__ZN3JSC9Structure28addPropertyWithoutTransitionERKNS_10IdentifierEjPNS_6JSCellE
-__ZN3JSC9Structure3getEPKN3WTF10StringImplERjRPNS_6JSCellE
+__ZN3JSC9Structure21addPropertyTransitionERNS_12JSGlobalDataEPS0_RKNS_10IdentifierEjPNS_6JSCellERm
+__ZN3JSC9Structure22materializePropertyMapERNS_12JSGlobalDataE
+__ZN3JSC9Structure25changePrototypeTransitionERNS_12JSGlobalDataEPS0_NS_7JSValueE
+__ZN3JSC9Structure27despecifyDictionaryFunctionERNS_12JSGlobalDataERKNS_10IdentifierE
+__ZN3JSC9Structure27despecifyFunctionTransitionERNS_12JSGlobalDataEPS0_RKNS_10IdentifierE
+__ZN3JSC9Structure28addPropertyWithoutTransitionERNS_12JSGlobalDataERKNS_10IdentifierEjPNS_6JSCellE
+__ZN3JSC9Structure3getERNS_12JSGlobalDataEPN3WTF10StringImplERjRPNS_6JSCellE
 __ZN3JSC9Structure40addPropertyTransitionToExistingStructureEPS0_RKNS_10IdentifierEjPNS_6JSCellERm
-__ZN3JSC9StructureC1ENS_7JSValueERKNS_8TypeInfoEj
+__ZN3JSC9StructureC1ERNS_12JSGlobalDataENS_7JSValueERKNS_8TypeInfoEjPKNS_9ClassInfoE
 __ZN3JSC9StructureD1Ev
 __ZN3JSC9constructEPNS_9ExecStateENS_7JSValueENS_13ConstructTypeERKNS_13ConstructDataERKNS_7ArgListE
 __ZN3JSCeqERKNS_7UStringEPKc
@@ -334,7 +340,7 @@ __ZN3WTF10StringImpl18simplifyWhiteSpaceEv
 __ZN3WTF10StringImpl19characterStartingAtEj
 __ZN3WTF10StringImpl19createUninitializedEjRPt
 __ZN3WTF10StringImpl22containsOnlyWhitespaceEv
-__ZN3WTF10StringImpl23defaultWritingDirectionEv
+__ZN3WTF10StringImpl23defaultWritingDirectionEPb
 __ZN3WTF10StringImpl23reverseFindIgnoringCaseEPS0_j
 __ZN3WTF10StringImpl37createStrippingNullCharactersSlowCaseEPKtj
 __ZN3WTF10StringImpl4findEPFbtEj
@@ -368,14 +374,13 @@ __ZN3WTF11dtoaRoundDPEPcdiRbRiRj
 __ZN3WTF11dtoaRoundSFEPcdiRbRiRj
 __ZN3WTF11fastReallocEPvm
 __ZN3WTF12AtomicString11addSlowCaseEPNS_10StringImplE
+__ZN3WTF12AtomicString16fromUTF8InternalEPKcS2_
 __ZN3WTF12AtomicString3addEPKc
 __ZN3WTF12AtomicString3addEPKt
 __ZN3WTF12AtomicString3addEPKtj
 __ZN3WTF12AtomicString3addEPKtjj
 __ZN3WTF12AtomicString4findEPKtjj
 __ZN3WTF12AtomicString4initEv
-__ZN3WTF12AtomicString8fromUTF8EPKc
-__ZN3WTF12AtomicString8fromUTF8EPKcm
 __ZN3WTF12createThreadEPFPvS0_ES0_
 __ZN3WTF12createThreadEPFPvS0_ES0_PKc
 __ZN3WTF12detachThreadEj
@@ -383,6 +388,7 @@ __ZN3WTF12isMainThreadEv
 __ZN3WTF12randomNumberEv
 __ZN3WTF13StringBuilder11reifyStringEv
 __ZN3WTF13StringBuilder11shrinkToFitEv
+__ZN3WTF13StringBuilder15reserveCapacityEj
 __ZN3WTF13StringBuilder6appendEPKcj
 __ZN3WTF13StringBuilder6appendEPKtj
 __ZN3WTF13StringBuilder6resizeEj
@@ -405,13 +411,13 @@ __ZN3WTF15charactersToIntEPKtmPb
 __ZN3WTF16callOnMainThreadEPFvPvES0_
 __ZN3WTF16codePointCompareERKNS_6StringES2_
 __ZN3WTF16fastZeroedMallocEm
-__ZN3WTF17charactersToFloatEPKtmPb
+__ZN3WTF17charactersToFloatEPKtmPbS2_
 __ZN3WTF17equalIgnoringCaseEPKtPKcj
 __ZN3WTF17equalIgnoringCaseEPNS_10StringImplEPKc
 __ZN3WTF17equalIgnoringCaseEPNS_10StringImplES1_
 __ZN3WTF18calculateDSTOffsetEdd
 __ZN3WTF18calculateUTCOffsetEv
-__ZN3WTF18charactersToDoubleEPKtmPb
+__ZN3WTF18charactersToDoubleEPKtmPbS2_
 __ZN3WTF18dateToDaysFrom1970Eiii
 __ZN3WTF18monthFromDayInYearEib
 __ZN3WTF19initializeThreadingEv
@@ -425,12 +431,14 @@ __ZN3WTF21RefCountedLeakCounter9incrementEv
 __ZN3WTF21RefCountedLeakCounterC1EPKc
 __ZN3WTF21RefCountedLeakCounterD1Ev
 __ZN3WTF21charactersToIntStrictEPKtmPbi
+__ZN3WTF22cancelCallOnMainThreadEPFvPvES0_
 __ZN3WTF22charactersToUIntStrictEPKtmPbi
 __ZN3WTF23callOnMainThreadAndWaitEPFvPvES0_
 __ZN3WTF23dayInMonthFromDayInYearEib
 __ZN3WTF23waitForThreadCompletionEjPPv
 __ZN3WTF27releaseFastMallocFreeMemoryEv
 __ZN3WTF28setMainThreadCallbacksPausedEb
+__ZN3WTF29cryptographicallyRandomNumberEv
 __ZN3WTF29cryptographicallyRandomValuesEPvm
 __ZN3WTF36lockAtomicallyInitializedStaticMutexEv
 __ZN3WTF37parseDateFromNullTerminatedCharactersEPKc
@@ -439,6 +447,9 @@ __ZN3WTF39initializeMainThreadToProcessMainThreadEv
 __ZN3WTF3MD58addBytesEPKhm
 __ZN3WTF3MD58checksumERNS_6VectorIhLm16EEE
 __ZN3WTF3MD5C1Ev
+__ZN3WTF4SHA111computeHashERNS_6VectorIhLm20EEE
+__ZN3WTF4SHA18addBytesEPKhm
+__ZN3WTF4SHA1C1Ev
 __ZN3WTF4dtoaEPcdRbRiRj
 __ZN3WTF5Mutex4lockEv
 __ZN3WTF5Mutex6unlockEv
@@ -503,7 +514,6 @@ __ZNK3JSC11Interpreter14retrieveCallerEPNS_9ExecStateEPNS_10JSFunctionE
 __ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_7JSValueE
 __ZNK3JSC12PropertySlot14functionGetterEPNS_9ExecStateE
 __ZNK3JSC14JSGlobalObject14isDynamicScopeERb
-__ZNK3JSC16InternalFunction9classInfoEv
 __ZNK3JSC16JSVariableObject16isVariableObjectEv
 __ZNK3JSC17DebuggerCallFrame10thisObjectEv
 __ZNK3JSC17DebuggerCallFrame12functionNameEv
@@ -518,7 +528,6 @@ __ZNK3JSC18PropertyDescriptor6getterEv
 __ZNK3JSC18PropertyDescriptor6setterEv
 __ZNK3JSC18PropertyDescriptor8writableEv
 __ZNK3JSC19SourceProviderCache8byteSizeEv
-__ZNK3JSC24JSObjectWithGlobalObject12globalObjectEv
 __ZNK3JSC4Heap11objectCountEv
 __ZNK3JSC4Heap4sizeEv
 __ZNK3JSC4Heap8capacityEv
@@ -526,16 +535,15 @@ __ZNK3JSC6JSCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
 __ZNK3JSC6JSCell12toThisObjectEPNS_9ExecStateE
 __ZNK3JSC6JSCell14isGetterSetterEv
 __ZNK3JSC6JSCell8toNumberEPNS_9ExecStateE
-__ZNK3JSC6JSCell8toObjectEPNS_9ExecStateE
+__ZNK3JSC6JSCell8toObjectEPNS_9ExecStateEPNS_14JSGlobalObjectE
 __ZNK3JSC6JSCell8toStringEPNS_9ExecStateE
-__ZNK3JSC6JSCell9classInfoEv
 __ZNK3JSC6JSCell9getStringEPNS_9ExecStateE
 __ZNK3JSC6JSCell9getStringEPNS_9ExecStateERNS_7UStringE
 __ZNK3JSC6JSCell9getUInt32ERj
 __ZNK3JSC6JSCell9toBooleanEPNS_9ExecStateE
 __ZNK3JSC7ArgList8getSliceEiRS0_
 __ZNK3JSC7JSArray12subclassDataEv
-__ZNK3JSC7JSValue16toObjectSlowCaseEPNS_9ExecStateE
+__ZNK3JSC7JSValue16toObjectSlowCaseEPNS_9ExecStateEPNS_14JSGlobalObjectE
 __ZNK3JSC7JSValue19synthesizePrototypeEPNS_9ExecStateE
 __ZNK3JSC7JSValue20toThisObjectSlowCaseEPNS_9ExecStateE
 __ZNK3JSC7JSValue9toIntegerEPNS_9ExecStateE
@@ -548,7 +556,7 @@ __ZNK3JSC8JSObject12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
 __ZNK3JSC8JSObject12toThisObjectEPNS_9ExecStateE
 __ZNK3JSC8JSObject18toStrictThisObjectEPNS_9ExecStateE
 __ZNK3JSC8JSObject8toNumberEPNS_9ExecStateE
-__ZNK3JSC8JSObject8toObjectEPNS_9ExecStateE
+__ZNK3JSC8JSObject8toObjectEPNS_9ExecStateEPNS_14JSGlobalObjectE
 __ZNK3JSC8JSObject8toStringEPNS_9ExecStateE
 __ZNK3JSC8JSObject9classNameEv
 __ZNK3JSC8JSObject9toBooleanEPNS_9ExecStateE
@@ -578,16 +586,18 @@ __ZNK3WTF6String5toIntEPb
 __ZNK3WTF6String5upperEv
 __ZNK3WTF6String6latin1Ev
 __ZNK3WTF6String6toUIntEPb
-__ZNK3WTF6String7toFloatEPb
+__ZNK3WTF6String7toFloatEPbS1_
 __ZNK3WTF6String8foldCaseEv
-__ZNK3WTF6String8toDoubleEPb
+__ZNK3WTF6String8toDoubleEPbS1_
 __ZNK3WTF6String8toIntPtrEPb
 __ZNK3WTF6String8toUInt64EPb
 __ZNK3WTF6String9substringEjj
 __ZNK3WTF8Collator7collateEPKtmS2_m
 __ZTVN3JSC12StringObjectE
 __ZTVN3JSC14JSGlobalObjectE
+__ZTVN3JSC14ScopeChainNodeE
 __ZTVN3JSC15JSWrapperObjectE
+__ZTVN3JSC15WeakHandleOwnerE
 __ZTVN3JSC16InternalFunctionE
 __ZTVN3JSC16JSVariableObjectE
 __ZTVN3JSC8DebuggerE
diff --git a/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp b/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
index 08e590b..27596fc 100644
--- a/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
+++ b/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
@@ -32,7 +32,7 @@
   'includes': [
     # FIXME: Sense whether upstream or downstream build, and
     # include the right features.gypi
-    '../../../Source/WebKit/chromium/features.gypi',
+    '../../WebKit/chromium/features.gypi',
     '../JavaScriptCore.gypi',
   ],
   'variables': {
@@ -40,7 +40,7 @@
     'conditions': [
       ['inside_chromium_build==0', {
         # Webkit is being built outside of the full chromium project.
-        'chromium_src_dir': '../../../Source/WebKit/chromium',
+        'chromium_src_dir': '../../WebKit/chromium',
       },{
         # WebKit is checked out in src/chromium/third_party/WebKit
         'chromium_src_dir': '../../../../..',
@@ -106,6 +106,8 @@
         '../wtf/unicode',
       ],
       'sources': [
+        '<@(javascriptcore_publicheader_files)',
+        '<@(javascriptcore_privateheader_files)',
         '<@(javascriptcore_files)',
       ],
       'sources/': [
@@ -113,10 +115,27 @@
         ['exclude', '../'],
         # ... Then include what we want.
         ['include', '../wtf/'],
+        # FIXME: This is clearly not sustainable. 
+        ['exclude', '../wtf/android'], 
+        ['exclude', '../wtf/brew'], 
+        ['exclude', '../wtf/efl'], 
+        ['exclude', '../wtf/gobject'], 
+        ['exclude', '../wtf/gtk'], 
+        ['exclude', '../wtf/haiku'], 
+        ['exclude', '../wtf/mac'], 
+        ['exclude', '../wtf/qt'], 
+        ['exclude', '../wtf/url'], 
+        ['exclude', '../wtf/wince'], 
+        ['exclude', '../wtf/wx'], 
+        ['exclude', '../wtf/unicode/brew'], 
+        ['exclude', '../wtf/unicode/wince'], 
+        ['exclude', '../wtf/unicode/glib'], 
+        ['exclude', '../wtf/unicode/qt4'], 
         # GLib/GTK, even though its name doesn't really indicate.
         ['exclude', '/(gtk|glib|gobject)/.*\\.(cpp|h)$'],
-        ['exclude', '(Default|Gtk|Mac|None|Qt|Win|Wx)\\.(cpp|mm)$'],
+        ['exclude', '(Default|Gtk|Mac|None|Qt|Win|Wx|Efl|Symbian)\\.(cpp|mm)$'],
         ['exclude', 'wtf/CurrentTime\\.cpp$'],
+        ['exclude', 'wtf/OSRandomSource\\.cpp$'],
         ['exclude', 'wtf/MainThread.cpp$'],
         ['exclude', 'wtf/TC.*\\.(cpp|h)$'],
       ],
@@ -187,10 +206,13 @@
           'inputs': [
             '../create_regex_tables',
           ],
+          'arguments': [
+            '--no-tables',
+          ],
           'outputs': [
             '<(INTERMEDIATE_DIR)/RegExpJitTables.h',
           ],
-          'action': ['python', '<@(_inputs)', '<@(_outputs)'],
+          'action': ['python', '<@(_inputs)', '<@(_arguments)', '<@(_outputs)'],
         },
       ],
       'include_dirs': [
diff --git a/Source/JavaScriptCore/JavaScriptCore.gypi b/Source/JavaScriptCore/JavaScriptCore.gypi
index 754fd2b..352ec97 100644
--- a/Source/JavaScriptCore/JavaScriptCore.gypi
+++ b/Source/JavaScriptCore/JavaScriptCore.gypi
@@ -1,12 +1,242 @@
 {
     'variables': {
-        'javascriptcore_files': [
-            'API/APICast.h',
+        'project_dir': ['.'],
+        # These headers are part of JavaScriptCore's public API in the Apple Mac build.
+        'javascriptcore_publicheader_files': [
+            'API/JSBase.h',
+            'API/JSContextRef.h',
+            'API/JSObjectRef.h',
+            'API/JSStringRef.h',
+            'API/JSStringRefCF.h',
+            'API/JSValueRef.h',
             'API/JavaScript.h',
             'API/JavaScriptCore.h',
-            'API/JSBase.cpp',
-            'API/JSBase.h',
+            'API/WebKitAvailability.h',
+        ],
+        # These headers are part of JavaScriptCore's private API in the Apple Mac build.
+        'javascriptcore_privateheader_files': [
+            'API/APICast.h',
+            'API/APIShims.h',
             'API/JSBasePrivate.h',
+            'API/JSContextRefPrivate.h',
+            'API/JSObjectRefPrivate.h',
+            'API/JSProfilerPrivate.h',
+            'API/JSRetainPtr.h',
+            'API/JSWeakObjectMapRefInternal.h',
+            'API/JSWeakObjectMapRefPrivate.h',
+            'API/OpaqueJSString.h',
+            'assembler/MacroAssemblerCodeRef.h',
+            'bytecode/Opcode.h',
+            'heap/ConservativeRoots.h',
+            'heap/Handle.h',
+            'heap/HandleHeap.h',
+            'heap/HandleStack.h',
+            'heap/Heap.h',
+            'heap/Local.h',
+            'heap/LocalScope.h',
+            'heap/Strong.h',
+            'heap/Weak.h',
+            'config.h',
+            'debugger/Debugger.h',
+            'debugger/DebuggerActivation.h',
+            'debugger/DebuggerCallFrame.h',
+            'interpreter/CallFrame.h',
+            'interpreter/Interpreter.h',
+            'interpreter/Register.h',
+            'interpreter/RegisterFile.h',
+            'jit/ExecutableAllocator.h',
+            'jit/JITCode.h',
+            'jit/JITStubs.h',
+            'jit/ThunkGenerators.h',
+            'parser/ResultType.h',
+            'parser/SourceCode.h',
+            'parser/SourceProvider.h',
+            'parser/SourceProviderCache.h',
+            'profiler/CallIdentifier.h',
+            'profiler/Profile.h',
+            'profiler/ProfileNode.h',
+            'profiler/Profiler.h',
+            'runtime/ArgList.h',
+            'runtime/ArrayPrototype.h',
+            'runtime/BooleanObject.h',
+            'runtime/CachedTranscendentalFunction.h',
+            'runtime/CallData.h',
+            'runtime/ClassInfo.h',
+            'runtime/CommonIdentifiers.h',
+            'runtime/Completion.h',
+            'runtime/ConstructData.h',
+            'runtime/DateInstance.h',
+            'runtime/DateInstanceCache.h',
+            'runtime/Error.h',
+            'runtime/ExceptionHelpers.h',
+            'runtime/FunctionConstructor.h',
+            'runtime/FunctionPrototype.h',
+            'runtime/GCActivityCallback.h',
+            'runtime/Identifier.h',
+            'runtime/InitializeThreading.h',
+            'runtime/InternalFunction.h',
+            'runtime/JSAPIValueWrapper.h',
+            'runtime/JSArray.h',
+            'runtime/JSByteArray.h',
+            'runtime/JSCell.h',
+            'runtime/JSFunction.h',
+            'runtime/JSGlobalData.h',
+            'runtime/JSGlobalObject.h',
+            'runtime/JSLock.h',
+            'runtime/JSNumberCell.h',
+            'runtime/JSObject.h',
+            'runtime/JSObjectWithGlobalObject.h',
+            'runtime/JSString.h',
+            'runtime/JSType.h',
+            'runtime/JSTypeInfo.h',
+            'runtime/JSValue.h',
+            'runtime/JSValueInlineMethods.h',
+            'runtime/JSVariableObject.h',
+            'runtime/JSWrapperObject.h',
+            'runtime/Lookup.h',
+            'runtime/MathObject.h',
+            'runtime/MemoryStatistics.h',
+            'runtime/NumberObject.h',
+            'runtime/NumberPrototype.h',
+            'runtime/NumericStrings.h',
+            'runtime/ObjectPrototype.h',
+            'runtime/Operations.h',
+            'runtime/PropertyDescriptor.h',
+            'runtime/PropertyMapHashTable.h',
+            'runtime/PropertyNameArray.h',
+            'runtime/PropertySlot.h',
+            'runtime/Protect.h',
+            'runtime/PutPropertySlot.h',
+            'runtime/RegExp.h',
+            'runtime/RegExpKey.h',
+            'runtime/RegExpCache.h',
+            'runtime/RegExpObject.h',
+            'runtime/RopeImpl.h',
+            'runtime/ScopeChain.h',
+            'runtime/SmallStrings.h',
+            'runtime/StringObject.h',
+            'runtime/StringObjectThatMasqueradesAsUndefined.h',
+            'runtime/StringPrototype.h',
+            'runtime/Structure.h',
+            'runtime/StructureChain.h',
+            'runtime/StructureTransitionTable.h',
+            'runtime/SymbolTable.h',
+            'runtime/Terminator.h',
+            'runtime/TimeoutChecker.h',
+            'runtime/UString.h',
+            'runtime/UStringBuilder.h',
+            'runtime/WeakGCMap.h',
+            'runtime/WeakRandom.h',
+            'runtime/WriteBarrier.h',
+            'wtf/ASCIICType.h',
+            'wtf/AVLTree.h',
+            'wtf/Alignment.h',
+            'wtf/AlwaysInline.h',
+            'wtf/Assertions.h',
+            'wtf/Atomics.h',
+            'wtf/Bitmap.h',
+            'wtf/BlockStack.h',
+            'wtf/BloomFilter.h',
+            'wtf/BumpPointerAllocator.h',
+            'wtf/ByteArray.h',
+            'wtf/Complex.h',
+            'wtf/CrossThreadRefCounted.h',
+            'wtf/CryptographicallyRandomNumber.h',
+            'wtf/CurrentTime.h',
+            'wtf/DateMath.h',
+            'wtf/DecimalNumber.h',
+            'wtf/Decoder.h',
+            'wtf/Deque.h',
+            'wtf/DisallowCType.h',
+            'wtf/DoublyLinkedList.h',
+            'wtf/Encoder.h',
+            'wtf/FastAllocBase.h',
+            'wtf/FastMalloc.h',
+            'wtf/FixedArray.h',
+            'wtf/Forward.h',
+            'wtf/GetPtr.h',
+            'wtf/HashCountedSet.h',
+            'wtf/HashFunctions.h',
+            'wtf/HashIterators.h',
+            'wtf/HashMap.h',
+            'wtf/HashSet.h',
+            'wtf/HashTable.h',
+            'wtf/HashTraits.h',
+            'wtf/HexNumber.h',
+            'wtf/ListHashSet.h',
+            'wtf/ListRefPtr.h',
+            'wtf/Locker.h',
+            'wtf/MD5.h',
+            'wtf/MainThread.h',
+            'wtf/MathExtras.h',
+            'wtf/MessageQueue.h',
+            'wtf/NonCopyingSort.h',
+            'wtf/Noncopyable.h',
+            'wtf/NotFound.h',
+            'wtf/NullPtr.h',
+            'wtf/OSAllocator.h',
+            'wtf/OwnArrayPtr.h',
+            'wtf/OwnFastMallocPtr.h',
+            'wtf/OwnPtr.h',
+            'wtf/OwnPtrCommon.h',
+            'wtf/PageAllocation.h',
+            'wtf/PageAllocationAligned.h',
+            'wtf/PageBlock.h',
+            'wtf/PageReservation.h',
+            'wtf/PassOwnArrayPtr.h',
+            'wtf/PassOwnPtr.h',
+            'wtf/PassRefPtr.h',
+            'wtf/Platform.h',
+            'wtf/PossiblyNull.h',
+            'wtf/RandomNumber.h',
+            'wtf/RefCounted.h',
+            'wtf/RefCountedLeakCounter.h',
+            'wtf/RefPtr.h',
+            'wtf/RefPtrHashMap.h',
+            'wtf/RetainPtr.h',
+            'wtf/SentinelLinkedList.h',
+            'wtf/SinglyLinkedList.h',
+            'wtf/StackBounds.h',
+            'wtf/StaticConstructors.h',
+            'wtf/StdLibExtras.h',
+            'wtf/StringExtras.h',
+            'wtf/StringHasher.h',
+            'wtf/ThreadSafeRefCounted.h',
+            'wtf/ThreadSpecific.h',
+            'wtf/Threading.h',
+            'wtf/ThreadingPrimitives.h',
+            'wtf/TypeTraits.h',
+            'wtf/UnusedParam.h',
+            'wtf/VMTags.h',
+            'wtf/ValueCheck.h',
+            'wtf/Vector.h',
+            'wtf/VectorTraits.h',
+            'wtf/WTFThreadData.h',
+            'wtf/dtoa.h',
+            'wtf/text/AtomicString.h',
+            'wtf/text/AtomicStringHash.h',
+            'wtf/text/AtomicStringImpl.h',
+            'wtf/text/CString.h',
+            'wtf/text/StringBuffer.h',
+            'wtf/text/StringBuilder.h',
+            'wtf/text/StringConcatenate.h',
+            'wtf/text/StringHash.h',
+            'wtf/text/StringImpl.h',
+            'wtf/text/StringImplBase.h',
+            'wtf/text/TextPosition.h',
+            'wtf/text/WTFString.h',
+            'wtf/unicode/CharacterNames.h',
+            'wtf/unicode/Collator.h',
+            'wtf/unicode/UTF8.h',
+            'wtf/unicode/Unicode.h',
+            'wtf/unicode/icu/UnicodeIcu.h',
+            'yarr/Yarr.h',
+            'yarr/YarrInterpreter.h',
+            'yarr/YarrPattern.h',
+        ],
+        'javascriptcore_files': [
+            'API/APIShims.h',
+            'API/JSBase.cpp',
             'API/JSCallbackConstructor.cpp',
             'API/JSCallbackConstructor.h',
             'API/JSCallbackFunction.cpp',
@@ -17,38 +247,49 @@
             'API/JSClassRef.cpp',
             'API/JSClassRef.h',
             'API/JSContextRef.cpp',
-            'API/JSContextRef.h',
-            'API/JSContextRefPrivate.h',
             'API/JSObjectRef.cpp',
-            'API/JSObjectRef.h',
             'API/JSProfilerPrivate.cpp',
-            'API/JSProfilerPrivate.h',
-            'API/JSRetainPtr.h',
             'API/JSStringRef.cpp',
-            'API/JSStringRef.h',
             'API/JSStringRefBSTR.cpp',
             'API/JSStringRefBSTR.h',
             'API/JSStringRefCF.cpp',
-            'API/JSStringRefCF.h',
             'API/JSValueRef.cpp',
-            'API/JSValueRef.h',
+            'API/JSWeakObjectMapRefPrivate.cpp',
             'API/OpaqueJSString.cpp',
-            'API/OpaqueJSString.h',
-            'API/tests/JSNode.h',
-            'API/tests/JSNodeList.h',
-            'API/tests/Node.h',
-            'API/tests/NodeList.h',
-            'API/WebKitAvailability.h',
-            'assembler/AbstractMacroAssembler.h',
+            'AllInOneFile.cpp',
+            'ForwardingHeaders/JavaScriptCore/APICast.h',
+            'ForwardingHeaders/JavaScriptCore/APIShims.h',
+            'ForwardingHeaders/JavaScriptCore/JSBase.h',
+            'ForwardingHeaders/JavaScriptCore/JSContextRef.h',
+            'ForwardingHeaders/JavaScriptCore/JSObjectRef.h',
+            'ForwardingHeaders/JavaScriptCore/JSRetainPtr.h',
+            'ForwardingHeaders/JavaScriptCore/JSStringRef.h',
+            'ForwardingHeaders/JavaScriptCore/JSStringRefCF.h',
+            'ForwardingHeaders/JavaScriptCore/JSValueRef.h',
+            'ForwardingHeaders/JavaScriptCore/JavaScript.h',
+            'ForwardingHeaders/JavaScriptCore/JavaScriptCore.h',
+            'ForwardingHeaders/JavaScriptCore/OpaqueJSString.h',
+            'ForwardingHeaders/JavaScriptCore/WebKitAvailability.h',
+            'JavaScriptCorePrefix.h',
+            'assembler/ARMAssembler.cpp',
+            'assembler/ARMAssembler.h',
+            'assembler/ARMv7Assembler.cpp',
             'assembler/ARMv7Assembler.h',
+            'assembler/AbstractMacroAssembler.h',
             'assembler/AssemblerBuffer.h',
+            'assembler/AssemblerBufferWithConstantPool.h',
             'assembler/CodeLocation.h',
+            'assembler/LinkBuffer.h',
+            'assembler/MIPSAssembler.h',
             'assembler/MacroAssembler.h',
+            'assembler/MacroAssemblerARM.cpp',
+            'assembler/MacroAssemblerARM.h',
             'assembler/MacroAssemblerARMv7.h',
-            'assembler/MacroAssemblerCodeRef.h',
+            'assembler/MacroAssemblerMIPS.h',
             'assembler/MacroAssemblerX86.h',
-            'assembler/MacroAssemblerX86_64.h',
             'assembler/MacroAssemblerX86Common.h',
+            'assembler/MacroAssemblerX86_64.h',
+            'assembler/RepatchBuffer.h',
             'assembler/X86Assembler.h',
             'bytecode/CodeBlock.cpp',
             'bytecode/CodeBlock.h',
@@ -57,24 +298,53 @@
             'bytecode/JumpTable.cpp',
             'bytecode/JumpTable.h',
             'bytecode/Opcode.cpp',
-            'bytecode/Opcode.h',
             'bytecode/SamplingTool.cpp',
             'bytecode/SamplingTool.h',
             'bytecode/StructureStubInfo.cpp',
             'bytecode/StructureStubInfo.h',
             'bytecompiler/BytecodeGenerator.cpp',
             'bytecompiler/BytecodeGenerator.h',
-            'bytecompiler/NodesCodegen.cpp',
             'bytecompiler/Label.h',
             'bytecompiler/LabelScope.h',
+            'bytecompiler/NodesCodegen.cpp',
             'bytecompiler/RegisterID.h',
-            'config.h',
+            'heap/ConservativeRoots.cpp',
+            'heap/HandleHeap.cpp',
+            'heap/HandleStack.cpp',
+            'heap/Heap.cpp',
+            'heap/MachineStackMarker.cpp',
+            'heap/MachineStackMarker.h',
+            'heap/MarkStack.cpp',
+            'heap/MarkStack.h',
+            'heap/MarkStackPosix.cpp',
+            'heap/MarkStackSymbian.cpp',
+            'heap/MarkStackWin.cpp',
+            'heap/MarkedBlock.cpp',
+            'heap/MarkedBlock.h',
+            'heap/MarkedSpace.cpp',
+            'heap/MarkedSpace.h',
             'debugger/Debugger.cpp',
-            'debugger/Debugger.h',
             'debugger/DebuggerActivation.cpp',
-            'debugger/DebuggerActivation.h',
             'debugger/DebuggerCallFrame.cpp',
-            'debugger/DebuggerCallFrame.h',
+            'dfg/DFGAliasTracker.h',
+            'dfg/DFGByteCodeParser.cpp',
+            'dfg/DFGByteCodeParser.h',
+            'dfg/DFGGenerationInfo.h',
+            'dfg/DFGGraph.cpp',
+            'dfg/DFGGraph.h',
+            'dfg/DFGJITCodeGenerator.cpp',
+            'dfg/DFGJITCodeGenerator.h',
+            'dfg/DFGJITCompiler.cpp',
+            'dfg/DFGJITCompiler.h',
+            'dfg/DFGNode.h',
+            'dfg/DFGNonSpeculativeJIT.cpp',
+            'dfg/DFGNonSpeculativeJIT.h',
+            'dfg/DFGOperations.cpp',
+            'dfg/DFGOperations.h',
+            'dfg/DFGRegisterBank.h',
+            'dfg/DFGScoreBoard.h',
+            'dfg/DFGSpeculativeJIT.cpp',
+            'dfg/DFGSpeculativeJIT.h',
             'icu/unicode/parseerr.h',
             'icu/unicode/platform.h',
             'icu/unicode/putil.h',
@@ -99,16 +369,10 @@
             'icu/unicode/uversion.h',
             'interpreter/CachedCall.h',
             'interpreter/CallFrame.cpp',
-            'interpreter/CallFrame.h',
             'interpreter/CallFrameClosure.h',
             'interpreter/Interpreter.cpp',
-            'interpreter/Interpreter.h',
-            'interpreter/Register.h',
             'interpreter/RegisterFile.cpp',
-            'interpreter/RegisterFile.h',
-            'JavaScriptCorePrefix.h',
             'jit/ExecutableAllocator.cpp',
-            'jit/ExecutableAllocator.h',
             'jit/ExecutableAllocatorFixedVMPool.cpp',
             'jit/JIT.cpp',
             'jit/JIT.h',
@@ -116,7 +380,6 @@
             'jit/JITArithmetic32_64.cpp',
             'jit/JITCall.cpp',
             'jit/JITCall32_64.cpp',
-            'jit/JITCode.h',
             'jit/JITInlineMethods.h',
             'jit/JITOpcodes.cpp',
             'jit/JITOpcodes32_64.cpp',
@@ -124,8 +387,11 @@
             'jit/JITPropertyAccess32_64.cpp',
             'jit/JITStubCall.h',
             'jit/JITStubs.cpp',
-            'jit/JITStubs.h',
-            'jsc.cpp',
+            'jit/JSInterfaceJIT.h',
+            'jit/SpecializedThunkJIT.h',
+            'jit/ThunkGenerators.cpp',
+            'os-win32/WinMain.cpp',
+            'os-win32/inttypes.h',
             'os-win32/stdbool.h',
             'os-win32/stdint.h',
             'parser/ASTBuilder.h',
@@ -141,64 +407,75 @@
             'parser/Parser.h',
             'parser/ParserArena.cpp',
             'parser/ParserArena.h',
-            'parser/ResultType.h',
-            'parser/SourceCode.h',
-            'parser/SourceProvider.h',
             'parser/SourceProviderCache.cpp',
-            'parser/SourceProviderCache.h',
             'parser/SourceProviderCacheItem.h',
             'parser/SyntaxChecker.h',
-            'profiler/CallIdentifier.h',
             'profiler/Profile.cpp',
-            'profiler/Profile.h',
             'profiler/ProfileGenerator.cpp',
             'profiler/ProfileGenerator.h',
             'profiler/ProfileNode.cpp',
-            'profiler/ProfileNode.h',
             'profiler/Profiler.cpp',
-            'profiler/Profiler.h',
             'profiler/ProfilerServer.h',
+            'profiler/ProfilerServer.mm',
+            'qt/api/qscriptconverter_p.h',
+            'qt/api/qscriptengine.cpp',
+            'qt/api/qscriptengine.h',
+            'qt/api/qscriptengine_p.cpp',
+            'qt/api/qscriptengine_p.h',
+            'qt/api/qscriptfunction.cpp',
+            'qt/api/qscriptfunction_p.h',
+            'qt/api/qscriptoriginalglobalobject_p.h',
+            'qt/api/qscriptprogram.cpp',
+            'qt/api/qscriptprogram.h',
+            'qt/api/qscriptprogram_p.h',
+            'qt/api/qscriptstring.cpp',
+            'qt/api/qscriptstring.h',
+            'qt/api/qscriptstring_p.h',
+            'qt/api/qscriptsyntaxcheckresult.cpp',
+            'qt/api/qscriptsyntaxcheckresult.h',
+            'qt/api/qscriptsyntaxcheckresult_p.h',
+            'qt/api/qscriptvalue.cpp',
+            'qt/api/qscriptvalue.h',
+            'qt/api/qscriptvalue_p.h',
+            'qt/api/qscriptvalueiterator.cpp',
+            'qt/api/qscriptvalueiterator.h',
+            'qt/api/qscriptvalueiterator_p.h',
+            'qt/api/qtscriptglobal.h',
+            'qt/benchmarks/qscriptengine/tst_qscriptengine.cpp',
+            'qt/benchmarks/qscriptvalue/tst_qscriptvalue.cpp',
+            'qt/tests/qscriptengine/tst_qscriptengine.cpp',
+            'qt/tests/qscriptstring/tst_qscriptstring.cpp',
+            'qt/tests/qscriptvalue/tst_qscriptvalue.cpp',
+            'qt/tests/qscriptvalue/tst_qscriptvalue.h',
+            'qt/tests/qscriptvalue/tst_qscriptvalue_generated_comparison.cpp',
+            'qt/tests/qscriptvalue/tst_qscriptvalue_generated_init.cpp',
+            'qt/tests/qscriptvalue/tst_qscriptvalue_generated_istype.cpp',
+            'qt/tests/qscriptvalue/tst_qscriptvalue_generated_totype.cpp',
+            'qt/tests/qscriptvalueiterator/tst_qscriptvalueiterator.cpp',
             'runtime/ArgList.cpp',
-            'runtime/ArgList.h',
             'runtime/Arguments.cpp',
             'runtime/Arguments.h',
             'runtime/ArrayConstructor.cpp',
             'runtime/ArrayConstructor.h',
             'runtime/ArrayPrototype.cpp',
-            'runtime/ArrayPrototype.h',
             'runtime/BatchedTransitionOptimizer.h',
             'runtime/BooleanConstructor.cpp',
             'runtime/BooleanConstructor.h',
             'runtime/BooleanObject.cpp',
-            'runtime/BooleanObject.h',
             'runtime/BooleanPrototype.cpp',
             'runtime/BooleanPrototype.h',
             'runtime/CallData.cpp',
-            'runtime/CallData.h',
-            'runtime/ClassInfo.h',
-            'runtime/MarkedBlock.cpp',
-            'runtime/MarkedBlock.h',
-            'runtime/MarkedSpace.cpp',
-            'runtime/MarkedSpace.h',
-            'runtime/Heap.cpp',
-            'runtime/Heap.h',
             'runtime/CommonIdentifiers.cpp',
-            'runtime/CommonIdentifiers.h',
             'runtime/Completion.cpp',
-            'runtime/Completion.h',
             'runtime/ConstructData.cpp',
-            'runtime/ConstructData.h',
             'runtime/DateConstructor.cpp',
             'runtime/DateConstructor.h',
             'runtime/DateConversion.cpp',
             'runtime/DateConversion.h',
             'runtime/DateInstance.cpp',
-            'runtime/DateInstance.h',
-            'runtime/DateInstanceCache.h',
             'runtime/DatePrototype.cpp',
             'runtime/DatePrototype.h',
             'runtime/Error.cpp',
-            'runtime/Error.h',
             'runtime/ErrorConstructor.cpp',
             'runtime/ErrorConstructor.h',
             'runtime/ErrorInstance.cpp',
@@ -206,244 +483,126 @@
             'runtime/ErrorPrototype.cpp',
             'runtime/ErrorPrototype.h',
             'runtime/ExceptionHelpers.cpp',
-            'runtime/ExceptionHelpers.h',
+            'runtime/Executable.cpp',
+            'runtime/Executable.h',
             'runtime/FunctionConstructor.cpp',
-            'runtime/FunctionConstructor.h',
             'runtime/FunctionPrototype.cpp',
-            'runtime/FunctionPrototype.h',
             'runtime/GCActivityCallback.cpp',
-            'runtime/GCActivityCallback.h',
-            'runtime/GCHandle.cpp',
-            'runtime/GCHandle.h',
+            'runtime/GCActivityCallbackCF.cpp',
             'runtime/GetterSetter.cpp',
             'runtime/GetterSetter.h',
-            'runtime/GlobalEvalFunction.cpp',
-            'runtime/GlobalEvalFunction.h',
             'runtime/Identifier.cpp',
-            'runtime/Identifier.h',
             'runtime/InitializeThreading.cpp',
-            'runtime/InitializeThreading.h',
             'runtime/InternalFunction.cpp',
-            'runtime/InternalFunction.h',
+            'runtime/JSAPIValueWrapper.cpp',
             'runtime/JSActivation.cpp',
             'runtime/JSActivation.h',
             'runtime/JSArray.cpp',
-            'runtime/JSArray.h',
             'runtime/JSByteArray.cpp',
-            'runtime/JSByteArray.h',
             'runtime/JSCell.cpp',
-            'runtime/JSCell.h',
             'runtime/JSFunction.cpp',
-            'runtime/JSFunction.h',
             'runtime/JSGlobalData.cpp',
-            'runtime/JSGlobalData.h',
             'runtime/JSGlobalObject.cpp',
-            'runtime/JSGlobalObject.h',
             'runtime/JSGlobalObjectFunctions.cpp',
             'runtime/JSGlobalObjectFunctions.h',
-            'runtime/JSImmediate.cpp',
-            'runtime/JSImmediate.h',
             'runtime/JSLock.cpp',
-            'runtime/JSLock.h',
             'runtime/JSNotAnObject.cpp',
             'runtime/JSNotAnObject.h',
             'runtime/JSNumberCell.cpp',
-            'runtime/JSNumberCell.h',
-            'runtime/JSObject.cpp',
-            'runtime/JSObject.h',
-            'runtime/JSObjectWithGlobalObject.cpp',
-            'runtime/JSObjectWithGlobalObject.h',
             'runtime/JSONObject.cpp',
             'runtime/JSONObject.h',
+            'runtime/JSObject.cpp',
+            'runtime/JSObjectWithGlobalObject.cpp',
             'runtime/JSPropertyNameIterator.cpp',
             'runtime/JSPropertyNameIterator.h',
             'runtime/JSStaticScopeObject.cpp',
             'runtime/JSStaticScopeObject.h',
             'runtime/JSString.cpp',
-            'runtime/JSString.h',
-            'runtime/JSType.h',
-            'runtime/JSTypeInfo.h',
+            'runtime/JSStringBuilder.h',
             'runtime/JSValue.cpp',
-            'runtime/JSValue.h',
             'runtime/JSVariableObject.cpp',
-            'runtime/JSVariableObject.h',
             'runtime/JSWrapperObject.cpp',
-            'runtime/JSWrapperObject.h',
+            'runtime/JSZombie.cpp',
+            'runtime/JSZombie.h',
             'runtime/LiteralParser.cpp',
             'runtime/LiteralParser.h',
             'runtime/Lookup.cpp',
-            'runtime/Lookup.h',
-            'runtime/MachineStackMarker.cpp',
-            'runtime/MachineStackMarker.h',
-            'runtime/ConservativeSet.cpp',
-            'runtime/ConservativeSet.h',
-            'runtime/MarkStack.cpp',
-            'runtime/MarkStack.h',
-            'runtime/MarkStackWin.cpp',
             'runtime/MathObject.cpp',
-            'runtime/MathObject.h',
+            'runtime/MemoryStatistics.cpp',
             'runtime/NativeErrorConstructor.cpp',
             'runtime/NativeErrorConstructor.h',
             'runtime/NativeErrorPrototype.cpp',
             'runtime/NativeErrorPrototype.h',
-            'runtime/NativeFunctionWrapper.h',
             'runtime/NumberConstructor.cpp',
             'runtime/NumberConstructor.h',
             'runtime/NumberObject.cpp',
-            'runtime/NumberObject.h',
             'runtime/NumberPrototype.cpp',
-            'runtime/NumberPrototype.h',
             'runtime/ObjectConstructor.cpp',
             'runtime/ObjectConstructor.h',
             'runtime/ObjectPrototype.cpp',
-            'runtime/ObjectPrototype.h',
             'runtime/Operations.cpp',
-            'runtime/Operations.h',
             'runtime/PropertyDescriptor.cpp',
-            'runtime/PropertyDescriptor.h',
-            'runtime/PropertyMapHashTable.h',
             'runtime/PropertyNameArray.cpp',
-            'runtime/PropertyNameArray.h',
             'runtime/PropertySlot.cpp',
-            'runtime/PropertySlot.h',
-            'runtime/Protect.h',
-            'runtime/PrototypeFunction.cpp',
-            'runtime/PrototypeFunction.h',
-            'runtime/PutPropertySlot.h',
             'runtime/RegExp.cpp',
-            'runtime/RegExp.h',
             'runtime/RegExpCache.cpp',
-            'runtime/RegExpCache.h',
             'runtime/RegExpConstructor.cpp',
             'runtime/RegExpConstructor.h',
-            'runtime/RegExpKey.h',
             'runtime/RegExpMatchesArray.h',
             'runtime/RegExpObject.cpp',
-            'runtime/RegExpObject.h',
             'runtime/RegExpPrototype.cpp',
             'runtime/RegExpPrototype.h',
+            'runtime/RopeImpl.cpp',
             'runtime/ScopeChain.cpp',
-            'runtime/ScopeChain.h',
             'runtime/ScopeChainMark.h',
             'runtime/SmallStrings.cpp',
-            'runtime/SmallStrings.h',
+            'runtime/StrictEvalActivation.cpp',
+            'runtime/StrictEvalActivation.h',
             'runtime/StringConstructor.cpp',
             'runtime/StringConstructor.h',
             'runtime/StringObject.cpp',
-            'runtime/StringObject.h',
-            'runtime/StringObjectThatMasqueradesAsUndefined.h',
             'runtime/StringPrototype.cpp',
-            'runtime/StringPrototype.h',
             'runtime/StringRecursionChecker.cpp',
             'runtime/StringRecursionChecker.h',
             'runtime/Structure.cpp',
-            'runtime/Structure.h',
             'runtime/StructureChain.cpp',
-            'runtime/StructureChain.h',
-            'runtime/StructureTransitionTable.h',
-            'runtime/SymbolTable.h',
-            'runtime/Terminator.h',
             'runtime/TimeoutChecker.cpp',
-            'runtime/TimeoutChecker.h',
+            'runtime/Tracing.d',
             'runtime/Tracing.h',
             'runtime/UString.cpp',
-            'runtime/UString.h',
-            'runtime/UStringBuilder.h',
             'runtime/UStringConcatenate.h',
-            'runtime/WeakRandom.h',
-            'wtf/AlwaysInline.h',
-            'wtf/ASCIICType.h',
             'wtf/Assertions.cpp',
-            'wtf/Assertions.h',
-            'wtf/Atomics.h',
-            'wtf/AVLTree.h',
-            'wtf/Bitmap.h',
-            'wtf/BloomFilter.h',
             'wtf/ByteArray.cpp',
-            'wtf/ByteArray.h',
-            'wtf/chromium/ChromiumThreading.h',
-            'wtf/chromium/MainThreadChromium.cpp',
-            'wtf/CrossThreadRefCounted.h',
             'wtf/CryptographicallyRandomNumber.cpp',
-            'wtf/CryptographicallyRandomNumber.h',
             'wtf/CurrentTime.cpp',
-            'wtf/CurrentTime.h',
             'wtf/DateMath.cpp',
-            'wtf/DateMath.h',
             'wtf/DecimalNumber.cpp',
-            'wtf/Deque.h',
-            'wtf/DisallowCType.h',
-            'wtf/dtoa.cpp',
-            'wtf/dtoa.h',
-            'wtf/FastAllocBase.h',
+            'wtf/DynamicAnnotations.cpp',
+            'wtf/DynamicAnnotations.h',
             'wtf/FastMalloc.cpp',
-            'wtf/FastMalloc.h',
-            'wtf/Forward.h',
-            'wtf/GetPtr.h',
-            'wtf/gobject/GOwnPtr.cpp',
-            'wtf/gobject/GOwnPtr.h',
-            'wtf/gtk/MainThreadGtk.cpp',
-            'wtf/gtk/ThreadingGtk.cpp',
-            'wtf/HashCountedSet.h',
-            'wtf/HashFunctions.h',
-            'wtf/HashIterators.h',
-            'wtf/HashMap.h',
-            'wtf/HashSet.h',
             'wtf/HashTable.cpp',
-            'wtf/HashTable.h',
-            'wtf/HashTraits.h',
-            'wtf/ListHashSet.h',
-            'wtf/ListRefPtr.h',
-            'wtf/Locker.h',
             'wtf/MD5.cpp',
-            'wtf/MD5.h',
             'wtf/MainThread.cpp',
-            'wtf/MainThread.h',
             'wtf/MallocZoneSupport.h',
-            'wtf/MathExtras.h',
-            'wtf/MessageQueue.h',
-            'wtf/NonCopyingSort.h',
-            'wtf/Noncopyable.h',
-            'wtf/NotFound.h',
+            'wtf/NullPtr.cpp',
             'wtf/OSAllocatorPosix.cpp',
+            'wtf/OSAllocatorSymbian.cpp',
             'wtf/OSAllocatorWin.cpp',
-            'wtf/OSAllocator.h',
             'wtf/OSRandomSource.cpp',
             'wtf/OSRandomSource.h',
-            'wtf/OwnArrayPtr.h',
-            'wtf/OwnFastMallocPtr.h',
-            'wtf/OwnPtr.h',
-            'wtf/OwnPtrCommon.h',
-            'wtf/PageBlock.cpp',
-            'wtf/PageAllocation.h',
             'wtf/PageAllocationAligned.cpp',
-            'wtf/PageAllocationAligned.h',
-            'wtf/PageReservation',
-            'wtf/PassOwnPtr.h',
-            'wtf/PassRefPtr.h',
-            'wtf/Platform.h',
-            'wtf/PtrAndFlags.h',
+            'wtf/PageAllocatorSymbian.h',
+            'wtf/PageBlock.cpp',
             'wtf/RandomNumber.cpp',
-            'wtf/RandomNumber.h',
             'wtf/RandomNumberSeed.h',
-            'wtf/RefCounted.h',
             'wtf/RefCountedLeakCounter.cpp',
-            'wtf/RefCountedLeakCounter.h',
-            'wtf/RefPtr.h',
-            'wtf/RefPtrHashMap.h',
-            'wtf/RetainPtr.h',
+            'wtf/SHA1.cpp',
+            'wtf/SHA1.h',
             'wtf/SegmentedVector.h',
             'wtf/SizeLimits.cpp',
             'wtf/StackBounds.cpp',
-            'wtf/StackBounds.h',
-            'wtf/StaticConstructors.h',
-            'wtf/StdLibExtras.h',
-            'wtf/StringExtras.h',
-            'wtf/StringHasher.h',
+            'wtf/StringExtras.cpp',
             'wtf/TCPackedCache.h',
-            'wtf/qt/MainThreadQt.cpp',
-            'wtf/qt/StringQt.cpp',
-            'wtf/qt/ThreadingQt.cpp',
             'wtf/TCPageMap.h',
             'wtf/TCSpinLock.h',
             'wtf/TCSystemAlloc.cpp',
@@ -451,67 +610,121 @@
             'wtf/ThreadFunctionInvocation.h',
             'wtf/ThreadIdentifierDataPthreads.cpp',
             'wtf/ThreadIdentifierDataPthreads.h',
+            'wtf/ThreadSpecificWin.cpp',
             'wtf/Threading.cpp',
-            'wtf/Threading.h',
             'wtf/ThreadingNone.cpp',
-            'wtf/ThreadingPrimitives.h',
             'wtf/ThreadingPthreads.cpp',
             'wtf/ThreadingWin.cpp',
-            'wtf/ThreadSafeShared.h',
-            'wtf/ThreadSpecific.h',
-            'wtf/ThreadSpecificWin.cpp',
             'wtf/TypeTraits.cpp',
-            'wtf/TypeTraits.h',
+            'wtf/WTFThreadData.cpp',
+            'wtf/android/AndroidThreading.h',
+            'wtf/android/MainThreadAndroid.cpp',
+            'wtf/brew/MainThreadBrew.cpp',
+            'wtf/brew/OwnPtrBrew.cpp',
+            'wtf/brew/RefPtrBrew.h',
+            'wtf/brew/ShellBrew.h',
+            'wtf/brew/StringBrew.cpp',
+            'wtf/brew/SystemMallocBrew.h',
+            'wtf/chromium/ChromiumThreading.h',
+            'wtf/chromium/MainThreadChromium.cpp',
+            'wtf/dtoa.cpp',
+            'wtf/efl/MainThreadEfl.cpp',
+            'wtf/gobject/GOwnPtr.cpp',
+            'wtf/gobject/GOwnPtr.h',
+            'wtf/gobject/GRefPtr.cpp',
+            'wtf/gobject/GRefPtr.h',
+            'wtf/gobject/GTypedefs.h',
+            'wtf/gtk/MainThreadGtk.cpp',
+            'wtf/gtk/ThreadingGtk.cpp',
+            'wtf/haiku/MainThreadHaiku.cpp',
+            'wtf/haiku/StringHaiku.cpp',
+            'wtf/mac/MainThreadMac.mm',
+            'wtf/qt/MainThreadQt.cpp',
+            'wtf/qt/StringQt.cpp',
+            'wtf/qt/ThreadingQt.cpp',
             'wtf/text/AtomicString.cpp',
-            'wtf/text/AtomicString.h',
-            'wtf/text/AtomicStringHash.h',
-            'wtf/text/AtomicStringImpl.h',
             'wtf/text/CString.cpp',
-            'wtf/text/CString.h',
-            'wtf/text/StringBuffer.h',
             'wtf/text/StringBuilder.cpp',
-            'wtf/text/StringBuilder.h',
-            'wtf/text/StringConcatenate.h',
-            'wtf/text/StringHash.h',
             'wtf/text/StringImpl.cpp',
-            'wtf/text/StringImpl.h',
             'wtf/text/StringStatics.cpp',
-            'wtf/text/TextPosition.h',
             'wtf/text/WTFString.cpp',
-            'wtf/text/WTFString.h',
-            'wtf/unicode/CharacterNames.h',
-            'wtf/unicode/Collator.h',
             'wtf/unicode/CollatorDefault.cpp',
+            'wtf/unicode/UTF8.cpp',
+            'wtf/unicode/UnicodeMacrosFromICU.h',
+            'wtf/unicode/brew/UnicodeBrew.cpp',
+            'wtf/unicode/brew/UnicodeBrew.h',
             'wtf/unicode/glib/UnicodeGLib.cpp',
             'wtf/unicode/glib/UnicodeGLib.h',
-            'wtf/unicode/glib/UnicodeMacrosFromICU.h',
             'wtf/unicode/icu/CollatorICU.cpp',
-            'wtf/unicode/icu/UnicodeIcu.h',
             'wtf/unicode/qt4/UnicodeQt4.h',
-            'wtf/unicode/Unicode.h',
-            'wtf/unicode/UTF8.cpp',
-            'wtf/unicode/UTF8.h',
-            'wtf/UnusedParam.h',
-            'wtf/ValueCheck.h',
-            'wtf/Vector.h',
-            'wtf/VectorTraits.h',
-            'wtf/VMTags.h',
-            'wtf/WTFThreadData.cpp',
-            'wtf/WTFThreadData.h',
+            'wtf/unicode/wince/UnicodeWinCE.cpp',
+            'wtf/unicode/wince/UnicodeWinCE.h',
+            'wtf/url/api/ParsedURL.cpp',
+            'wtf/url/api/ParsedURL.h',
+            'wtf/url/api/URLString.h',
+            'wtf/url/src/RawURLBuffer.h',
+            'wtf/url/src/URLBuffer.h',
+            'wtf/url/src/URLCharacterTypes.cpp',
+            'wtf/url/src/URLCharacterTypes.h',
+            'wtf/url/src/URLComponent.h',
+            'wtf/url/src/URLEscape.cpp',
+            'wtf/url/src/URLEscape.h',
+            'wtf/url/src/URLParser.h',
+            'wtf/url/src/URLQueryCanonicalizer.h',
+            'wtf/url/src/URLSegments.cpp',
+            'wtf/url/src/URLSegments.h',
             'wtf/win/MainThreadWin.cpp',
             'wtf/win/OwnPtrWin.cpp',
+            'wtf/wince/FastMallocWinCE.h',
+            'wtf/wince/MemoryManager.cpp',
+            'wtf/wince/MemoryManager.h',
             'wtf/wx/MainThreadWx.cpp',
-            'yarr/Yarr.h',
+            'wtf/wx/StringWx.cpp',
             'yarr/YarrInterpreter.cpp',
-            'yarr/YarrInterpreter.h',
             'yarr/YarrJIT.cpp',
             'yarr/YarrJIT.h',
             'yarr/YarrParser.h',
             'yarr/YarrPattern.cpp',
-            'yarr/YarrPattern.h',
             'yarr/YarrSyntaxChecker.cpp',
             'yarr/YarrSyntaxChecker.h',
-        ]
+        ],
+        'javascriptcore_derived_source_files': [
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/ArrayPrototype.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/DatePrototype.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/HeaderDetection.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/JSONObject.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/Lexer.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/MathObject.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/NumberConstructor.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/RegExpConstructor.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/RegExpJitTables.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/RegExpObject.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/StringPrototype.lut.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/TracingDtrace.h',
+            '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore/ObjectConstructor.lut.h',
+        ],
+        'minidom_files': [
+            'API/tests/JSNode.c',
+            'API/tests/JSNode.h',
+            'API/tests/JSNodeList.c',
+            'API/tests/JSNodeList.h',
+            'API/tests/Node.c',
+            'API/tests/Node.h',
+            'API/tests/NodeList.c',
+            'API/tests/NodeList.h',
+            'API/tests/minidom.c',
+        ],
+        'minidom_support_files': [
+            'API/tests/minidom.js',
+        ],
+        'testapi_files': [
+            'API/tests/testapi.c',
+        ],
+        'testapi_support_files': [
+            'API/tests/testapi.js',
+        ],
+        'jsc_files': [
+            'jsc.cpp',
+        ],
     }
 }
-
diff --git a/Source/JavaScriptCore/JavaScriptCore.order b/Source/JavaScriptCore/JavaScriptCore.order
index 9e4004f..b82958e 100644
--- a/Source/JavaScriptCore/JavaScriptCore.order
+++ b/Source/JavaScriptCore/JavaScriptCore.order
@@ -1425,7 +1425,7 @@ __ZN7WebCore10StringImpl11reverseFindEti
 __ZN3WTF23waitForThreadCompletionEjPPv
 __ZN3WTF14FastMallocZone10statisticsEP14_malloc_zone_tP19malloc_statistics_t
 __ZNK7WebCore6String18simplifyWhiteSpaceEv
-__ZN7WebCore10StringImpl23defaultWritingDirectionEv
+__ZN3WTF10StringImpl23defaultWritingDirectionEPb
 __ZN3JSCL20dateProtoFuncSetTimeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZN3JSCL21dateProtoFuncGetMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
 __ZNK3JSC12DateInstance26calculateGregorianDateTimeEPNS_9ExecStateE
diff --git a/Source/JavaScriptCore/JavaScriptCore.pri b/Source/JavaScriptCore/JavaScriptCore.pri
index c1de599..c342936 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pri
+++ b/Source/JavaScriptCore/JavaScriptCore.pri
@@ -18,8 +18,6 @@ CONFIG(standalone_package) {
     isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = generated
 }
 
-CONFIG(standalone_package): DEFINES *= NDEBUG
-
 JAVASCRIPTCORE_INCLUDEPATH = \
     $$PWD \
     $$PWD/.. \
@@ -27,6 +25,8 @@ JAVASCRIPTCORE_INCLUDEPATH = \
     $$PWD/assembler \
     $$PWD/bytecode \
     $$PWD/bytecompiler \
+    $$PWD/heap \
+    $$PWD/dfg \
     $$PWD/debugger \
     $$PWD/interpreter \
     $$PWD/jit \
@@ -48,9 +48,8 @@ symbian {
     INCLUDEPATH = $$JAVASCRIPTCORE_INCLUDEPATH $$INCLUDEPATH
 }
 
-symbian: {
+symbian {
     LIBS += -lhal
-    # For hal.h
     INCLUDEPATH *= $$MW_LAYER_SYSTEMINCLUDE
 }
 
@@ -70,16 +69,16 @@ wince* {
 }
 
 
-defineTest(addJavaScriptCoreLib) {
+defineTest(prependJavaScriptCoreLib) {
     # Argument is the relative path to JavaScriptCore.pro's qmake output
     pathToJavaScriptCoreOutput = $$ARGS/$$JAVASCRIPTCORE_DESTDIR
 
     win32-msvc*|wince* {
-        LIBS += -L$$pathToJavaScriptCoreOutput
-        LIBS += -l$$JAVASCRIPTCORE_TARGET
+        LIBS = -l$$JAVASCRIPTCORE_TARGET $$LIBS
+        LIBS = -L$$pathToJavaScriptCoreOutput $$LIBS
         POST_TARGETDEPS += $${pathToJavaScriptCoreOutput}$${QMAKE_DIR_SEP}$${JAVASCRIPTCORE_TARGET}.lib
     } else:symbian {
-        LIBS += -l$${JAVASCRIPTCORE_TARGET}.lib
+        LIBS = -l$${JAVASCRIPTCORE_TARGET}.lib $$LIBS
         # The default symbian build system does not use library paths at all. However when building with
         # qmake's symbian makespec that uses Makefiles
         QMAKE_LIBDIR += $$pathToJavaScriptCoreOutput
@@ -88,13 +87,7 @@ defineTest(addJavaScriptCoreLib) {
         # Make sure jscore will be early in the list of libraries to workaround a bug in MinGW
         # that can't resolve symbols from QtCore if libjscore comes after.
         QMAKE_LIBDIR = $$pathToJavaScriptCoreOutput $$QMAKE_LIBDIR
-        webkit2 {
-            # FIXME Workaround for undefined reference linking issues until the build system gets redesigned
-            mac: LIBS += -Wl,-all_load -l$$JAVASCRIPTCORE_TARGET -WL,-noall_load 
-            else: LIBS += -Wl,-whole-archive -l$$JAVASCRIPTCORE_TARGET -Wl,-no-whole-archive
-        } else {
-            LIBS += -l$$JAVASCRIPTCORE_TARGET
-        }
+        LIBS = -l$$JAVASCRIPTCORE_TARGET $$LIBS
         POST_TARGETDEPS += $${pathToJavaScriptCoreOutput}$${QMAKE_DIR_SEP}lib$${JAVASCRIPTCORE_TARGET}.a
     }
 
diff --git a/Source/JavaScriptCore/JavaScriptCore.pro b/Source/JavaScriptCore/JavaScriptCore.pro
index 1b5e28a..7a3653b 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pro
+++ b/Source/JavaScriptCore/JavaScriptCore.pro
@@ -16,20 +16,6 @@ CONFIG += depend_includepath
 
 contains(QT_CONFIG, embedded):CONFIG += embedded
 
-CONFIG(QTDIR_build) {
-    # Make sure we compile both debug and release on mac when inside Qt.
-    # This line was extracted from qbase.pri instead of including the whole file
-    win32|mac:!macx-xcode:CONFIG += debug_and_release
-} else {
-    !CONFIG(release, debug|release) {
-        OBJECTS_DIR = obj/debug
-    } else { # Release
-        OBJECTS_DIR = obj/release
-    }
-    # Make sure that build_all follows the build_all config in WebCore
-    mac:contains(QT_CONFIG, qt_framework):!CONFIG(webkit_no_framework):!build_pass:CONFIG += build_all
-}
-
 # WebCore adds these config only when in a standalone build.
 # qbase.pri takes care of that when in a QTDIR_build
 # Here we add the config for both cases since we don't include qbase.pri
@@ -42,14 +28,6 @@ CONFIG(QTDIR_build) {
     CONFIG += no_debug_info
 }
 
-# Pick up 3rdparty libraries from INCLUDE/LIB just like with MSVC
-win32-g++* {
-    TMPPATH            = $$quote($$(INCLUDE))
-    QMAKE_INCDIR_POST += $$split(TMPPATH,";")
-    TMPPATH            = $$quote($$(LIB))
-    QMAKE_LIBDIR_POST += $$split(TMPPATH,";")
-}
-
 *-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
 *-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
 
@@ -84,6 +62,9 @@ SOURCES += \
     assembler/ARMAssembler.cpp \
     assembler/ARMv7Assembler.cpp \
     assembler/MacroAssemblerARM.cpp \
+    assembler/MacroAssemblerSH4.h \
+    assembler/MacroAssemblerSH4.cpp \
+    assembler/SH4Assembler.h \
     bytecode/CodeBlock.cpp \
     bytecode/JumpTable.cpp \
     bytecode/Opcode.cpp \
@@ -91,9 +72,27 @@ SOURCES += \
     bytecode/StructureStubInfo.cpp \
     bytecompiler/BytecodeGenerator.cpp \
     bytecompiler/NodesCodegen.cpp \
+    heap/ConservativeRoots.cpp \
+    heap/HandleHeap.cpp \
+    heap/HandleStack.cpp \
+    heap/Heap.cpp \
+    heap/MachineStackMarker.cpp \
+    heap/MarkStack.cpp \
+    heap/MarkStackPosix.cpp \
+    heap/MarkStackSymbian.cpp \
+    heap/MarkStackWin.cpp \
+    heap/MarkedBlock.cpp \
+    heap/MarkedSpace.cpp \
     debugger/DebuggerActivation.cpp \
     debugger/DebuggerCallFrame.cpp \
     debugger/Debugger.cpp \
+    dfg/DFGByteCodeParser.cpp \
+    dfg/DFGGraph.cpp \
+    dfg/DFGJITCodeGenerator.cpp \
+    dfg/DFGJITCompiler.cpp \
+    dfg/DFGNonSpeculativeJIT.cpp \
+    dfg/DFGOperations.cpp \
+    dfg/DFGSpeculativeJIT.cpp \
     interpreter/CallFrame.cpp \
     interpreter/Interpreter.cpp \
     interpreter/RegisterFile.cpp \
@@ -128,9 +127,6 @@ SOURCES += \
     runtime/BooleanObject.cpp \
     runtime/BooleanPrototype.cpp \
     runtime/CallData.cpp \
-    runtime/MarkedBlock.cpp \
-    runtime/MarkedSpace.cpp \
-    runtime/Heap.cpp \
     runtime/CommonIdentifiers.cpp \
     runtime/Completion.cpp \
     runtime/ConstructData.cpp \
@@ -147,9 +143,7 @@ SOURCES += \
     runtime/FunctionConstructor.cpp \
     runtime/FunctionPrototype.cpp \
     runtime/GCActivityCallback.cpp \
-    runtime/GCHandle.cpp \
     runtime/GetterSetter.cpp \
-    runtime/GlobalEvalFunction.cpp \
     runtime/Identifier.cpp \
     runtime/InitializeThreading.cpp \
     runtime/InternalFunction.cpp \
@@ -162,10 +156,8 @@ SOURCES += \
     runtime/JSGlobalData.cpp \
     runtime/JSGlobalObject.cpp \
     runtime/JSGlobalObjectFunctions.cpp \
-    runtime/JSImmediate.cpp \
     runtime/JSLock.cpp \
     runtime/JSNotAnObject.cpp \
-    runtime/JSNumberCell.cpp \
     runtime/JSObject.cpp \
     runtime/JSObjectWithGlobalObject.cpp \
     runtime/JSONObject.cpp \
@@ -177,12 +169,6 @@ SOURCES += \
     runtime/JSWrapperObject.cpp \
     runtime/LiteralParser.cpp \
     runtime/Lookup.cpp \
-    runtime/MachineStackMarker.cpp \
-    runtime/MarkStackPosix.cpp \
-    runtime/MarkStackSymbian.cpp \
-    runtime/MarkStackWin.cpp \
-    runtime/ConservativeSet.cpp \
-    runtime/MarkStack.cpp \
     runtime/MathObject.cpp \
     runtime/NativeErrorConstructor.cpp \
     runtime/NativeErrorPrototype.cpp \
@@ -195,7 +181,6 @@ SOURCES += \
     runtime/PropertyDescriptor.cpp \
     runtime/PropertyNameArray.cpp \
     runtime/PropertySlot.cpp \
-    runtime/PrototypeFunction.cpp \
     runtime/RegExpConstructor.cpp \
     runtime/RegExp.cpp \
     runtime/RegExpObject.cpp \
@@ -215,6 +200,11 @@ SOURCES += \
     runtime/UString.cpp \
     yarr/YarrJIT.cpp \
 
+*sh4* {
+    QMAKE_CXXFLAGS += -mieee -w
+    QMAKE_CFLAGS   += -mieee -w
+}
+
 # Generated files, simply list them for JavaScriptCore
 
 symbian: {
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
index 68075f9..bd47530 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
@@ -5,7 +5,7 @@ BUILDSTYLE=Release_PGO
 !ENDIF
 
 install:
-    set PRODUCTION=1
+    set OFFICIAL_BUILD=1
     set WebKitLibrariesDir=$(SRCROOT)\AppleInternal
     set WebKitOutputDir=$(OBJROOT)
 	set ConfigurationBuildDir=$(OBJROOT)\$(BUILDSTYLE)
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
index a4832ed..f2846cc 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
@@ -3,18 +3,23 @@ Microsoft Visual Studio Solution File, Format Version 9.00
 # Visual Studio 2005
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCore", "JavaScriptCore\JavaScriptCore.vcproj", "{011D10F1-B656-4A1B-A0C3-3842F02122C5}"
 	ProjectSection(ProjectDependencies) = postProject
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}
 	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "jsc", "jsc\jsc.vcproj", "{C59E5129-B453-49B7-A52B-1E104715F76E}"
 	ProjectSection(ProjectDependencies) = postProject
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5} = {011D10F1-B656-4A1B-A0C3-3842F02122C5}
 	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTF", "WTF\WTF.vcproj", "{AA8A5A85-592B-4357-BC60-E0E91E026AF6}"
+	ProjectSection(ProjectDependencies) = postProject
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}
+	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "FindSafari", "..\..\..\Tools\FindSafari\FindSafari.vcproj", "{DA31DA52-6675-48D4-89E0-333A7144397C}"
+	ProjectSection(ProjectDependencies) = postProject
+		{C59E5129-B453-49B7-A52B-1E104715F76E} = {C59E5129-B453-49B7-A52B-1E104715F76E}
+	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCoreGenerated", "JavaScriptCore\JavaScriptCoreGenerated.vcproj", "{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"
 EndProject
@@ -22,7 +27,7 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
 		Debug|Win32 = Debug|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release_PGO_Optimize|Win32 = Release_PGO_Optimize|Win32
 		Release_PGO|Win32 = Release_PGO|Win32
 		Release|Win32 = Release|Win32
@@ -32,8 +37,8 @@ Global
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.Build.0 = Debug|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.ActiveCfg = Production|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.Build.0 = Production|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO_Optimize|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO_Optimize|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -44,8 +49,8 @@ Global
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.Build.0 = Debug|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.ActiveCfg = Production|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.Build.0 = Production|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -56,8 +61,8 @@ Global
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.ActiveCfg = Debug|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.Build.0 = Debug|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.ActiveCfg = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.Build.0 = Production|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -68,8 +73,8 @@ Global
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.ActiveCfg = Debug|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.Build.0 = Debug|Win32
-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Production|Win32.ActiveCfg = Production|Win32
+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Production|Win32.Build.0 = Production|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -80,8 +85,8 @@ Global
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Debug|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Debug|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.ActiveCfg = Production|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.Build.0 = Production|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index 010db39..0fa73f1 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -3,24 +3,25 @@ EXPORTS
     ??0CString@WTF@@QAE@PBD@Z
     ??0CString@WTF@@QAE@PBDI@Z
     ??0Collator@WTF@@QAE@PBD@Z
-    ??0DateInstance@JSC@@QAE@PAVExecState@1@N@Z
-    ??0DateInstance@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@N@Z
+    ??0DateInstance@JSC@@QAE@PAVExecState@1@PAVStructure@1@N@Z
     ??0DefaultGCActivityCallback@JSC@@QAE@PAVHeap@1@@Z
     ??0DropAllLocks@JSLock@JSC@@QAE@W4JSLockBehavior@2@@Z
-    ??0DynamicGlobalObjectScope@JSC@@QAE@PAVExecState@1@PAVJSGlobalObject@1@@Z
-    ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVIdentifier@1@@Z
-    ??0JSArray@JSC@@QAE@AAVJSGlobalData@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVArgList@1@@Z  
-    ??0JSArray@JSC@@QAE@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@@Z
-    ??0JSByteArray@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@PAVByteArray@4@PBUClassInfo@1@@Z
-    ??0JSFunction@JSC@@QAE@PAVExecState@1@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I_J0@Z@Z
-    ??0JSObjectWithGlobalObject@JSC@@IAE@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@@Z
+    ??0DynamicGlobalObjectScope@JSC@@QAE@AAVJSGlobalData@1@PAVJSGlobalObject@1@@Z  
+    ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@PAVJSGlobalObject@1@PAVStructure@1@ABVIdentifier@1@@Z
+    ??0JSArray@JSC@@QAE@AAVJSGlobalData@1@PAVStructure@1@@Z
+    ??0JSArray@JSC@@QAE@AAVJSGlobalData@1@PAVStructure@1@ABVArgList@1@@Z
+    ??0JSByteArray@JSC@@QAE@PAVExecState@1@PAVStructure@1@PAVByteArray@WTF@@@Z
+    ??0JSFunction@JSC@@QAE@PAVExecState@1@PAVJSGlobalObject@1@PAVStructure@1@HABVIdentifier@1@P6I_J0@Z@Z
+    ??0JSLock@JSC@@QAE@PAVExecState@1@@Z
+    ??0JSObjectWithGlobalObject@JSC@@IAE@AAVJSGlobalData@1@PAVJSGlobalObject@1@PAVStructure@1@@Z
+    ??0JSObjectWithGlobalObject@JSC@@IAE@PAVJSGlobalObject@1@PAVStructure@1@@Z
     ??0MD5@WTF@@QAE@XZ
     ??0Mutex@WTF@@QAE@XZ
-    ??0PrototypeFunction@JSC@@QAE@PAVExecState@1@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I_J0@Z@Z
     ??0RefCountedLeakCounter@WTF@@QAE@PBD@Z
-    ??0RegExpObject@JSC@@QAE@PAVJSGlobalObject@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@V?$NonNullPassRefPtr@VRegExp@JSC@@@4@@Z
-    ??0StringObject@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVUString@1@@Z
-    ??0Structure@JSC@@AAE@VJSValue@1@ABVTypeInfo@1@I@Z
+    ??0RegExpObject@JSC@@QAE@PAVJSGlobalObject@1@PAVStructure@1@V?$NonNullPassRefPtr@VRegExp@JSC@@@WTF@@@Z
+    ??0SHA1@WTF@@QAE@XZ
+    ??0StringObject@JSC@@QAE@PAVExecState@1@PAVStructure@1@ABVUString@1@@Z
+    ??0Structure@JSC@@AAE@AAVJSGlobalData@1@VJSValue@1@ABVTypeInfo@1@IPBUClassInfo@1@@Z
     ??0ThreadCondition@WTF@@QAE@XZ
     ??0UString@JSC@@QAE@PBD@Z
     ??0UString@JSC@@QAE@PBDI@Z
@@ -37,24 +38,28 @@ EXPORTS
     ??1RefCountedLeakCounter@WTF@@QAE@XZ
     ??1RegExp@JSC@@QAE@XZ
     ??1SourceProviderCache@JSC@@QAE@XZ
-    ??1Structure@JSC@@QAE@XZ
     ??1ThreadCondition@WTF@@QAE@XZ
     ??1WTFThreadData@WTF@@QAE@XZ
+    ??1WeakHandleOwner@JSC@@UAE@XZ
     ??2JSGlobalObject@JSC@@SAPAXIPAVJSGlobalData@1@@Z
     ??8JSC@@YA_NABVUString@0@0@Z
     ??8WTF@@YA_NABVCString@0@0@Z
     ?NaN@JSC@@3NB
     ?absoluteTimeToWaitTimeoutInterval@WTF@@YAKN@Z
+    ?activityCallback@Heap@JSC@@QAEPAVGCActivityCallback@2@XZ
     ?add@Identifier@JSC@@SA?AV?$PassRefPtr@VStringImpl@WTF@@@WTF@@PAVExecState@2@PBD@Z
     ?add@PropertyNameArray@JSC@@QAEXPAVStringImpl@WTF@@@Z
     ?addBytes@MD5@WTF@@QAEXPBEI@Z
-    ?addPropertyTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
-    ?addPropertyTransitionToExistingStructure@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
-    ?addPropertyWithoutTransition@Structure@JSC@@QAEIABVIdentifier@2@IPAVJSCell@2@@Z
+    ?addBytes@SHA1@WTF@@QAEXPBEI@Z
+    ?addCurrentThread@MachineThreads@JSC@@QAEXXZ
+    ?addPropertyTransition@Structure@JSC@@SAPAV12@AAVJSGlobalData@2@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
+    ?addPropertyTransitionToExistingStructure@Structure@JSC@@SAPAV12@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
+    ?addPropertyWithoutTransition@Structure@JSC@@QAEIAAVJSGlobalData@2@ABVIdentifier@2@IPAVJSCell@2@@Z
     ?addSlowCase@Identifier@JSC@@CA?AV?$PassRefPtr@VStringImpl@WTF@@@WTF@@PAVExecState@2@PAVStringImpl@4@@Z
-    ?addWeakGCHandle@Heap@JSC@@QAEPAVWeakGCHandle@2@PAVJSCell@2@@Z
     ?allocate@Heap@JSC@@QAEPAXI@Z
+    ?allocateFromSizeClass@MarkedSpace@JSC@@AAEPAXAAUSizeClass@12@@Z
     ?allocatePropertyStorage@JSObject@JSC@@QAEXII@Z
+    ?allocateSlowCase@Heap@JSC@@AAEPAXI@Z
     ?allocateStack@MarkStack@JSC@@CAPAXI@Z
     ?append@StringBuilder@WTF@@QAEXPBDI@Z
     ?append@StringBuilder@WTF@@QAEXPB_WI@Z
@@ -65,8 +70,7 @@ EXPORTS
     ?byteCompile@Yarr@JSC@@YA?AV?$PassOwnPtr@UBytecodePattern@Yarr@JSC@@@WTF@@AAUYarrPattern@12@PAVBumpPointerAllocator@4@@Z
     ?byteSize@SourceProviderCache@JSC@@QBEIXZ
     ?calculateDSTOffset@WTF@@YANNN@Z
-    ?calculateStringHashAndLengthFromUTF8@Unicode@WTF@@YAIPBDAAI1@Z
-    ?calculateStringHashFromUTF8@Unicode@WTF@@YAIPBD0AAI@Z
+    ?calculateStringHashAndLengthFromUTF8@Unicode@WTF@@YAIPBD0AAI1@Z
     ?calculateUTCOffset@WTF@@YAHXZ
     ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVUString@2@XZ
     ?call@JSC@@YA?AVJSValue@1@PAVExecState@1@V21@W4CallType@1@ABTCallData@1@1ABVArgList@1@@Z
@@ -74,46 +78,47 @@ EXPORTS
     ?callOnMainThreadAndWait@WTF@@YAXP6AXPAX@Z0@Z
     ?cancelCallOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
     ?capacity@Heap@JSC@@QBEIXZ
-    ?changePrototypeTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@VJSValue@2@@Z
+    ?changePrototypeTransition@Structure@JSC@@SAPAV12@AAVJSGlobalData@2@PAV12@VJSValue@2@@Z
     ?checkCurrentIdentifierTable@Identifier@JSC@@CAXPAVExecState@2@@Z
     ?checkCurrentIdentifierTable@Identifier@JSC@@CAXPAVJSGlobalData@2@@Z
     ?checkSyntax@JSC@@YA?AVCompletion@1@PAVExecState@1@ABVSourceCode@1@@Z
     ?checksum@MD5@WTF@@QAEXAAV?$Vector@E$0BA@@2@@Z
-    ?classInfo@InternalFunction@JSC@@UBEPBUClassInfo@2@XZ
-    ?classInfo@JSCell@JSC@@UBEPBUClassInfo@2@XZ
     ?className@JSObject@JSC@@UBE?AVUString@2@XZ
     ?clear@SourceProviderCache@JSC@@QAEXXZ
+    ?clearBuiltinStructures@JSGlobalData@JSC@@QAEXXZ
     ?collate@Collator@WTF@@QBE?AW4Result@12@PB_WI0I@Z
     ?collectAllGarbage@Heap@JSC@@QAEXXZ
+    ?computeHash@SHA1@WTF@@QAEXAAV?$Vector@E$0BE@@2@@Z
     ?configurable@PropertyDescriptor@JSC@@QBE_NXZ
     ?construct@JSC@@YAPAVJSObject@1@PAVExecState@1@VJSValue@1@W4ConstructType@1@ABTConstructData@1@ABVArgList@1@@Z
     ?constructArray@JSC@@YAPAVJSArray@1@PAVExecState@1@ABVArgList@1@@Z
     ?constructEmptyArray@JSC@@YAPAVJSArray@1@PAVExecState@1@@Z
     ?constructEmptyObject@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
-    ?constructFunction@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVArgList@1@ABVIdentifier@1@ABVUString@1@H@Z
+    ?constructFunction@JSC@@YAPAVJSObject@1@PAVExecState@1@PAVJSGlobalObject@1@ABVArgList@1@ABVIdentifier@1@ABVUString@1@H@Z
     ?convertUTF16ToUTF8@Unicode@WTF@@YA?AW4ConversionResult@12@PAPB_WPB_WPAPADPAD_N@Z
     ?convertUTF8ToUTF16@Unicode@WTF@@YA?AW4ConversionResult@12@PAPBDPBDPAPA_WPA_W_N@Z
     ?create@ByteArray@WTF@@SA?AV?$PassRefPtr@VByteArray@WTF@@@2@I@Z
     ?create@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@W4ThreadStackType@2@@Z
     ?create@OpaqueJSString@@SA?AV?$PassRefPtr@UOpaqueJSString@@@WTF@@ABVUString@JSC@@@Z
-    ?create@RegExp@JSC@@SA?AV?$PassRefPtr@VRegExp@JSC@@@WTF@@PAVJSGlobalData@2@ABVUString@2@1@Z
+    ?create@RegExp@JSC@@SA?AV?$PassRefPtr@VRegExp@JSC@@@WTF@@PAVJSGlobalData@2@ABVUString@2@W4RegExpFlags@2@@Z
     ?createEmptyString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@@Z
     ?createError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
-    ?createInheritorID@JSObject@JSC@@AAEPAVStructure@2@XZ
     ?createInterruptedExecutionException@JSC@@YAPAVJSObject@1@PAVJSGlobalData@1@@Z
     ?createLeaked@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@W4ThreadStackType@2@@Z
     ?createRangeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
     ?createReferenceError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
     ?createSingleCharacterString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@E@Z
     ?createStackOverflowError@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
-    ?createStructure@JSByteArray@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@VJSValue@2@@Z
+    ?createStructure@JSByteArray@JSC@@SAPAVStructure@2@AAVJSGlobalData@2@VJSValue@2@PBUClassInfo@2@@Z
     ?createSyntaxError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
     ?createTable@HashTable@JSC@@ABEXPAVJSGlobalData@2@@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
     ?createTypeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
+    ?cryptographicallyRandomNumber@WTF@@YAIXZ
     ?cryptographicallyRandomValues@WTF@@YAXPAXI@Z
     ?currentThread@WTF@@YAIXZ
+    ?currentThreadIsHoldingLock@JSLock@JSC@@SA_NXZ
     ?currentTime@WTF@@YANXZ
     ?data@CString@WTF@@QBEPBDXZ
     ?dateToDaysFrom1970@WTF@@YANHHH@Z
@@ -139,10 +144,9 @@ EXPORTS
     ?deleteProperty@JSVariableObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
     ?deleteProperty@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
     ?deleteTable@HashTable@JSC@@QBEXXZ
-    ?despecifyDictionaryFunction@Structure@JSC@@QAEXABVIdentifier@2@@Z
-    ?despecifyFunctionTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@@Z
+    ?despecifyDictionaryFunction@Structure@JSC@@QAEXAAVJSGlobalData@2@ABVIdentifier@2@@Z
+    ?despecifyFunctionTransition@Structure@JSC@@SAPAV12@AAVJSGlobalData@2@PAV12@ABVIdentifier@2@@Z
     ?destroy@Heap@JSC@@QAEXXZ
-    ?destroyJSGlobalObjectData@JSGlobalObject@JSC@@CAXPAX@Z
     ?detach@Debugger@JSC@@UAEXPAVJSGlobalObject@2@@Z
     ?detachThread@WTF@@YAXI@Z
     ?didTimeOut@TimeoutChecker@JSC@@QAE_NPAVExecState@2@@Z
@@ -153,7 +157,7 @@ EXPORTS
     ?equal@Identifier@JSC@@SA_NPBVStringImpl@WTF@@PBD@Z
     ?equalUTF16WithUTF8@Unicode@WTF@@YA_NPB_W0PBD1@Z
     ?evaluate@DebuggerCallFrame@JSC@@QBE?AVJSValue@2@ABVUString@2@AAV32@@Z
-    ?evaluate@JSC@@YA?AVCompletion@1@PAVExecState@1@AAVScopeChain@1@ABVSourceCode@1@VJSValue@1@@Z
+    ?evaluate@JSC@@YA?AVCompletion@1@PAVExecState@1@PAVScopeChainNode@1@ABVSourceCode@1@VJSValue@1@@Z
     ?exclude@Profile@JSC@@QAEXPBVProfileNode@2@@Z
     ?fastCalloc@WTF@@YAPAXII@Z
     ?fastFree@WTF@@YAXPAX@Z
@@ -163,13 +167,14 @@ EXPORTS
     ?fastStrDup@WTF@@YAPADPBD@Z
     ?fastZeroedMalloc@WTF@@YAPAXI@Z
     ?fillGetterPropertySlot@JSObject@JSC@@QAEXAAVPropertySlot@2@PAV?$WriteBarrierBase@W4Unknown@JSC@@@2@@Z
+    ?finalize@WeakHandleOwner@JSC@@UAEXV?$Handle@W4Unknown@JSC@@@2@PAX@Z
     ?focus@Profile@JSC@@QAEXPBVProfileNode@2@@Z
-    ?free@WeakGCHandlePool@JSC@@QAEXPAVWeakGCHandle@2@@Z
     ?from@Identifier@JSC@@SA?AV12@PAVExecState@2@H@Z
     ?from@Identifier@JSC@@SA?AV12@PAVExecState@2@I@Z
     ?functionGetter@PropertySlot@JSC@@ABE?AVJSValue@2@PAVExecState@2@@Z
     ?functionName@DebuggerCallFrame@JSC@@QBEPBVUString@2@XZ
-    ?get@Structure@JSC@@QAEIPBVStringImpl@WTF@@AAIAAPAVJSCell@2@@Z
+    ?get@Structure@JSC@@QAEIAAVJSGlobalData@2@ABVIdentifier@2@AAIAAPAVJSCell@2@@Z
+    ?get@Structure@JSC@@QAEIAAVJSGlobalData@2@PAVStringImpl@WTF@@AAIAAPAVJSCell@2@@Z
     ?getCallData@JSCell@JSC@@UAE?AW4CallType@2@AATCallData@2@@Z
     ?getConstructData@JSCell@JSC@@UAE?AW4ConstructType@2@AATConstructData@2@@Z
     ?getJSNumber@JSCell@JSC@@UAE?AVJSValue@2@XZ
@@ -201,10 +206,10 @@ EXPORTS
     ?globalExec@JSGlobalObject@JSC@@UAEPAVExecState@2@XZ
     ?globalObject@JSObjectWithGlobalObject@JSC@@QBEPAVJSGlobalObject@2@XZ
     ?globalObjectCount@Heap@JSC@@QAEIXZ
+    ?grow@HandleHeap@JSC@@AAEXXZ
     ?hasInstance@JSObject@JSC@@UAE_NPAVExecState@2@VJSValue@2@1@Z
     ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@ABVIdentifier@2@@Z
     ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@I@Z
-    ?hasTransition@Structure@JSC@@QAE_NPAVStringImpl@WTF@@I@Z
     ?heap@Heap@JSC@@SAPAV12@VJSValue@2@@Z
     ?increment@RefCountedLeakCounter@WTF@@QAEXXZ
     ?init@AtomicString@WTF@@SAXXZ
@@ -220,21 +225,23 @@ EXPORTS
     ?isGetterSetter@JSCell@JSC@@UBE_NXZ
     ?isHostFunctionNonInline@JSFunction@JSC@@ABE_NXZ
     ?isMainThread@WTF@@YA_NXZ
+    ?isReachableFromOpaqueRoots@WeakHandleOwner@JSC@@UAE_NV?$Handle@W4Unknown@JSC@@@2@PAXAAVMarkStack@2@@Z
     ?isValidCallee@JSValue@JSC@@QAE_NXZ
     ?isVariableObject@JSVariableObject@JSC@@UBE_NXZ
-    ?jsNumberCell@JSC@@YA?AVJSValue@1@PAVExecState@1@N@Z
     ?jsOwnedString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
     ?jsString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
     ?length@CString@WTF@@QBEIXZ
     ?lock@JSLock@JSC@@SAXW4JSLockBehavior@2@@Z
     ?lock@Mutex@WTF@@QAEXXZ
     ?lockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
+    ?lockCount@JSLock@JSC@@SAHXZ
     ?lookupGetter@JSObject@JSC@@UAE?AVJSValue@2@PAVExecState@2@ABVIdentifier@2@@Z
     ?lookupSetter@JSObject@JSC@@UAE?AVJSValue@2@PAVExecState@2@ABVIdentifier@2@@Z
     ?markChildren@JSGlobalObject@JSC@@UAEXAAVMarkStack@2@@Z
     ?markChildren@JSObject@JSC@@UAEXAAVMarkStack@2@@Z
     ?markChildren@JSWrapperObject@JSC@@EAEXAAVMarkStack@2@@Z
-    ?materializePropertyMap@Structure@JSC@@AAEXXZ
+    ?markChildren@ScopeChainNode@JSC@@UAEXAAVMarkStack@2@@Z
+    ?materializePropertyMap@Structure@JSC@@AAEXAAVJSGlobalData@2@@Z
     ?monthFromDayInYear@WTF@@YAHH_N@Z
     ?msToYear@WTF@@YAHN@Z
     ?name@InternalFunction@JSC@@QAEABVUString@2@PAVExecState@2@@Z
@@ -249,7 +256,6 @@ EXPORTS
     ?objectCount@Heap@JSC@@QBEIXZ
     ?objectProtoFuncToString@JSC@@YI_JPAVExecState@1@@Z
     ?parseDateFromNullTerminatedCharacters@WTF@@YANPBD@Z
-    ?pool@WeakGCHandle@JSC@@QAEPAVWeakGCHandlePool@2@XZ
     ?profiler@Profiler@JSC@@SAPAV12@XZ
     ?protect@Heap@JSC@@QAEXVJSValue@2@@Z
     ?protectedGlobalObjectCount@Heap@JSC@@QAEIXZ
@@ -263,6 +269,7 @@ EXPORTS
     ?put@StringObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
     ?putDirectFunction@JSObject@JSC@@QAEXPAVExecState@2@PAVInternalFunction@2@I@Z
     ?putDirectFunction@JSObject@JSC@@QAEXPAVExecState@2@PAVJSFunction@2@I@Z
+    ?putDirectInternal@JSObject@JSC@@AAE_NAAVJSGlobalData@2@ABVIdentifier@2@VJSValue@2@I_NAAVPutPropertySlot@2@PAVJSCell@2@@Z
     ?putWithAttributes@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I@Z
     ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I@Z
     ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I_NAAVPutPropertySlot@2@@Z
@@ -272,11 +279,13 @@ EXPORTS
     ?putWithAttributes@JSObject@JSC@@UAEXPAVJSGlobalData@2@IVJSValue@2@I@Z
     ?randomNumber@WTF@@YANXZ
     ?recompileAllJSFunctions@Debugger@JSC@@QAEXPAVJSGlobalData@2@@Z
+    ?regExpFlags@JSC@@YA?AW4RegExpFlags@1@ABVUString@1@@Z
     ?reifyString@StringBuilder@WTF@@AAEXXZ
     ?releaseDecommitted@OSAllocator@WTF@@SAXPAXI@Z
     ?releaseStack@MarkStack@JSC@@CAXPAXI@Z
     ?reportExtraMemoryCostSlowCase@Heap@JSC@@AAEXI@Z
     ?reserveAndCommit@OSAllocator@WTF@@SAPAXIW4Usage@12@_N1@Z
+    ?reserveCapacity@StringBuilder@WTF@@QAEXI@Z
     ?reset@ParserArena@JSC@@QAEXXZ
     ?reset@TimeoutChecker@JSC@@QAEXXZ
     ?resetDateCache@JSGlobalData@JSC@@QAEXXZ
@@ -295,6 +304,7 @@ EXPORTS
     ?setLoc@StatementNode@JSC@@QAEXHH@Z
     ?setMainThreadCallbacksPaused@WTF@@YAX_N@Z
     ?setOrderLowerFirst@Collator@WTF@@QAEX_N@Z
+    ?setPrototype@JSObject@JSC@@QAEXAAVJSGlobalData@2@VJSValue@2@@Z
     ?setSetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z
     ?setUndefined@PropertyDescriptor@JSC@@QAEXXZ
     ?setUpStaticFunctionSlot@JSC@@YAXPAVExecState@1@PBVHashEntry@1@PAVJSObject@1@ABVIdentifier@1@AAVPropertySlot@1@@Z
@@ -304,10 +314,8 @@ EXPORTS
     ?signal@ThreadCondition@WTF@@QAEXXZ
     ?size@Heap@JSC@@QBEIXZ
     ?slowAppend@MarkedArgumentBuffer@JSC@@AAEXVJSValue@2@@Z
-    ?startIgnoringLeaks@Structure@JSC@@SAXXZ
     ?startProfiling@Profiler@JSC@@QAEXPAVExecState@2@ABVUString@2@@Z
     ?startSampling@JSGlobalData@JSC@@QAEXXZ
-    ?stopIgnoringLeaks@Structure@JSC@@SAXXZ
     ?stopProfiling@Profiler@JSC@@QAE?AV?$PassRefPtr@VProfile@JSC@@@WTF@@PAVExecState@2@ABVUString@2@@Z
     ?stopSampling@JSGlobalData@JSC@@QAEXXZ
     ?strtod@WTF@@YANPBDPAPAD@Z
@@ -330,10 +338,9 @@ EXPORTS
     ?toNumber@JSCell@JSC@@UBENPAVExecState@2@@Z
     ?toNumber@JSObject@JSC@@UBENPAVExecState@2@@Z
     ?toNumber@JSString@JSC@@EBENPAVExecState@2@@Z
-    ?toObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
-    ?toObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
-    ?toObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
-    ?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
+    ?toObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@PAVJSGlobalObject@2@@Z
+    ?toObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@PAVJSGlobalObject@2@@Z
+    ?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@PAVJSGlobalObject@2@@Z
     ?toPrimitive@JSCell@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
     ?toPrimitive@JSString@JSC@@EBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
     ?toStrictThisObject@JSObject@JSC@@UBE?AVJSValue@2@PAVExecState@2@@Z
@@ -357,9 +364,11 @@ EXPORTS
     ?unprotect@Heap@JSC@@QAE_NVJSValue@2@@Z
     ?unwrappedObject@JSObject@JSC@@UAEPAV12@XZ
     ?utf8@UString@JSC@@QBE?AVCString@WTF@@_N@Z
+    ?vtableAnchor@InternalFunction@JSC@@EAEXXZ
     ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z
     ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z
     ?writable@PropertyDescriptor@JSC@@QBE_NXZ
+    ?writeBarrier@HandleHeap@JSC@@QAEXPAVJSValue@2@ABV32@@Z
     ?yield@WTF@@YAXXZ
     WTFLog
     WTFLogVerbose
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc
deleted file mode 100644
index e09e26e..0000000
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc
+++ /dev/null
@@ -1,47 +0,0 @@
-// Microsoft Visual C++ generated resource script.
-//
-#include "autoversion.h"
-#include "winresrc.h"
-
-#ifdef _WIN32
-LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
-#pragma code_page(1252)
-#endif //_WIN32
-
-/////////////////////////////////////////////////////////////////////////////
-//
-// Version
-//
-
-VS_VERSION_INFO VERSIONINFO
- FILEVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,__VERSION_BUILD__
- PRODUCTVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,__VERSION_BUILD__
- FILEFLAGSMASK 0x17L
-#ifdef _DEBUG
- FILEFLAGS 0x1L
-#else
- FILEFLAGS 0x0L
-#endif
- FILEOS 0x4L
- FILETYPE 0x2L
- FILESUBTYPE 0x0L
-BEGIN
-    BLOCK "StringFileInfo"
-    BEGIN
-        BLOCK "040904b0"
-        BEGIN
-            VALUE "FileDescription", "JavaScriptCore Dynamic Link Library"
-            VALUE "FileVersion", __VERSION_TEXT__
-            VALUE "CompanyName", "Apple Inc."
-            VALUE "InternalName", "JavaScriptCore"
-            VALUE "LegalCopyright", "Copyright Apple Inc. 2003-" __COPYRIGHT_YEAR_END_TEXT__
-            VALUE "OriginalFilename", "JavaScriptCore.dll"
-            VALUE "ProductName", " JavaScriptCore"
-            VALUE "ProductVersion", __VERSION_TEXT__
-        END
-    END
-    BLOCK "VarFileInfo"
-    BEGIN
-        VALUE "Translation", 0x409, 1200
-    END
-END
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index 260779e..4d5da54 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,11 +140,11 @@
 		<Configuration
 			Name="Release_PGO|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreReleasePGO.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="2"
 			>
-      <Tool
+			<Tool
 				Name="VCPreBuildEventTool"
 			/>
 			<Tool
@@ -202,7 +202,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCFLite.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -263,7 +263,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCFLite.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -324,7 +324,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -383,9 +383,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -447,11 +447,11 @@
 		<Configuration
 			Name="Release_PGO_Optimize|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops;.\JavaScriptCorePGOOptimize.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreReleasePGOOptimize.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="4"
 			>
-      <Tool
+			<Tool
 				Name="VCPreBuildEventTool"
 			/>
 			<Tool
@@ -586,30 +586,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\Heap.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Heap.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkedBlock.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkedBlock.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkedSpace.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkedSpace.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\CommonIdentifiers.cpp"
 				>
 			</File>
@@ -750,14 +726,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\GCHandle.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\GCHandle.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\GetterSetter.cpp"
 				>
 			</File>
@@ -766,14 +734,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\GlobalEvalFunction.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\GlobalEvalFunction.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\Identifier.cpp"
 				>
 			</File>
@@ -862,14 +822,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\JSImmediate.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSImmediate.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\JSLock.cpp"
 				>
 			</File>
@@ -886,14 +838,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\JSNumberCell.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSNumberCell.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\JSObject.cpp"
 				>
 			</File>
@@ -958,6 +902,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\runtime\JSValueInlineMethods.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\runtime\JSVariableObject.cpp"
 				>
 			</File>
@@ -998,34 +946,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\MachineStackMarker.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MachineStackMarker.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ConservativeSet.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ConservativeSet.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkStack.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkStack.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MarkStackWin.cpp"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\MathObject.cpp"
 				>
 			</File>
@@ -1050,10 +970,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\NativeFunctionWrapper.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\NumberConstructor.cpp"
 				>
 			</File>
@@ -1138,14 +1054,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\PrototypeFunction.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\PrototypeFunction.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\RegExp.cpp"
 				>
 			</File>
@@ -1326,10 +1234,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\runtime\WeakGCPtr.h"
-				>
-			</File>
-			<File
 				RelativePath="..\..\runtime\WeakRandom.h"
 				>
 			</File>
@@ -1779,14 +1683,6 @@
 			</File>
 		</Filter>
 		<Filter
-			Name="Resources"
-			>
-			<File
-				RelativePath=".\JavaScriptCore.rc"
-				>
-			</File>
-		</Filter>
-		<Filter
 			Name="interpreter"
 			>
 			<File
@@ -1974,6 +1870,98 @@
 				>
 			</File>
 		</Filter>
+		<Filter
+			Name="heap"
+			>
+                            <File
+                                    RelativePath="..\..\heap\ConservativeRoots.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\ConservativeRoots.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MachineStackMarker.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MachineStackMarker.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkedBlock.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkedBlock.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkedSpace.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkedSpace.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkStack.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkStack.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\MarkStackWin.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\Heap.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\Heap.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\Strong.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\Handle.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\HandleHeap.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\HandleHeap.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\HandleStack.cpp"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\HandleStack.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\Local.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\LocalScope.h"
+                                    >
+                            </File>
+                            <File
+                                    RelativePath="..\..\heap\Weak.h"
+                                    >
+                            </File>
+		</Filter>
 		<File
 			RelativePath="..\..\config.h"
 			>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
index 4a7f4d3..204ec63 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
@@ -6,7 +6,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../heap/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
 		PreprocessorDefinitions="__STD_C"
 		ForcedIncludeFiles="ICUVersion.h"
 	/>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops
new file mode 100644
index 0000000..0afe222
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops
new file mode 100644
index 0000000..8cd1130
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCF.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..ea0806d
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
index 314a794..9a59841 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
@@ -1,60 +1,15 @@
 all:
     touch "%ConfigurationBuildDir%\buildfailed"
     bash build-generated-files.sh "%ConfigurationBuildDir%" "$(WEBKITLIBRARIESDIR)"
-!IF "$(PRODUCTION)"!="1"
+!IF "$(OFFICIAL_BUILD)"!="1"
     bash -c "python react-to-vsprops-changes.py"
 !ENDIF
-    -mkdir 2>NUL "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\APICast.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JavaScript.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSBase.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSContextRef.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSContextRefPrivate.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSObjectRef.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSObjectRefPrivate.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSStringRef.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSStringRefCF.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSStringRefBSTR.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSValueRef.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JavaScriptCore.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSRetainPtr.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSWeakObjectMapRefInternal.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSWeakObjectMapRefPrivate.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\JSRetainPtr.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\OpaqueJSString.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    xcopy /y /d "..\..\API\WebKitAvailability.h" "%ConfigurationBuildDir%\include\JavaScriptCore"
-    
-    -mkdir 2>NUL "%ConfigurationBuildDir%\include\private\JavaScriptCore"
+    copy-files.cmd
 
-    xcopy /y /d "..\..\wtf\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\unicode\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\unicode\icu\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\parser\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\runtime\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\bytecode\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\interpreter\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\assembler\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\jit\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\debugger\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\profiler\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\create_hash_table" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\AtomicString.cpp" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\StringBuilder.cpp" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\StringImpl.cpp" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\wtf\text\WTFString.cpp" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    xcopy /y /d "..\..\yarr\*.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-
-
-    -mkdir 2>NUL "%ConfigurationBuildDir%\bin\JavaScriptCore.resources"
-    xcopy /y /d "..\JavaScriptCore.resources\*" "%ConfigurationBuildDir%\bin\JavaScriptCore.resources"
-    
     -del "%ConfigurationBuildDir%\include\private\JavaScriptCore\stdbool.h" "%ConfigurationBuildDir%\include\private\JavaScriptCore\stdint.h"
     -del "%ConfigurationBuildDir%\buildfailed"
 
 clean:
     -del "%ConfigurationBuildDir%\buildfailed"
-    -del /s /q "%ConfigurationBuildDir%\include\JavaScriptCore\JavaScriptCore"
+    copy-files.cmd clean
     -del /s /q "%ConfigurationBuildDir%\obj\JavaScriptCore\DerivedSources"
-    -del /s /q "%ConfigurationBuildDir%\include\private\JavaScriptCore"
-    -del /s /q "%ConfigurationBuildDir%\bin\JavaScriptCore.resources"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
index 2437071..59d1183 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedDebug.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -27,7 +27,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedDebugAll.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -36,16 +36,16 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedRelease.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedProduction.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -54,7 +54,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -63,7 +63,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedDebugCairoCFLite.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -72,7 +72,7 @@
 		<Configuration
 			Name="Release_PGO|Win32"
 			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedCommon.vsprops"
+			InheritedPropertySheets=".\JavaScriptCoreGeneratedReleasePGO.vsprops"
 			>
 			<Tool
 				Name="VCNMakeTool"
@@ -87,6 +87,10 @@
 			>
 		</File>
 		<File
+			RelativePath=".\copy-files.cmd"
+			>
+		</File>
+		<File
 			RelativePath="..\..\DerivedSources.make"
 			>
 		</File>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops
index 248eb59..1b718df 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops
@@ -4,12 +4,11 @@
 	Version="8.00"
 	Name="JavaScriptCoreGeneratedCommon"
 	OutputDirectory="$(ConfigurationBuildDir)\lib"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops"
 	>
 	<Tool
 		Name="VCNMakeTool"
-		BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make"
-		ReBuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean&#x0D;&#x0A;nmake -f JavaScriptCoreGenerated.make"
-		CleanCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean"
+		BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make"
+		ReBuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean&#x0D;&#x0A;nmake -f JavaScriptCoreGenerated.make"
+		CleanCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean"
 	/>
 </VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops
new file mode 100644
index 0000000..d8e1748
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops
new file mode 100644
index 0000000..3347b74
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..9620384
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops
new file mode 100644
index 0000000..a02f833
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops
new file mode 100644
index 0000000..833b674
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..3fdc37a
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops
new file mode 100644
index 0000000..096e42e
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreGeneratedReleasePGO"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\JavaScriptCoreGeneratedCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd
index 26707ca..233c45c 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd
@@ -1 +1,2 @@
+if exist "%WEBKITLIBRARIESDIR%\tools\VersionStamper\VersionStamper.exe" "%WEBKITLIBRARIESDIR%\tools\VersionStamper\VersionStamper.exe" --verbose "%TARGETPATH%"
 if exist "%CONFIGURATIONBUILDDIR%\buildfailed" del "%CONFIGURATIONBUILDDIR%\buildfailed"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd
index 42fbb71..a770776 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd
@@ -4,5 +4,3 @@ cmd /c
 if exist "%CONFIGURATIONBUILDDIR%\buildfailed" grep XX%PROJECTNAME%XX "%CONFIGURATIONBUILDDIR%\buildfailed"
 if errorlevel 1 exit 1
 echo XX%PROJECTNAME%XX > "%CONFIGURATIONBUILDDIR%\buildfailed"
-
-bash "%WEBKITLIBRARIESDIR%\tools\scripts\auto-version.sh" "%INTDIR%"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops
new file mode 100644
index 0000000..77781cc
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops
new file mode 100644
index 0000000..5f31896
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..1fc6aab
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops
new file mode 100644
index 0000000..2fd658a
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreReleasePGO"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops
new file mode 100644
index 0000000..907c9e5
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="JavaScriptCoreReleasePGOOptimize"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\JavaScriptCoreCommon.vsprops;
+      .\JavaScriptCoreCF.vsprops;
+      .\JavaScriptCorePGOOptimize.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd
new file mode 100755
index 0000000..e4075a4
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd
@@ -0,0 +1,79 @@
+@echo off
+
+set PublicHeadersDirectory=%CONFIGURATIONBUILDDIR%\include\JavaScriptCore
+set PrivateHeadersDirectory=%CONFIGURATIONBUILDDIR%\include\private\JavaScriptCore
+set ResourcesDirectory=%CONFIGURATIONBUILDDIR%\bin\JavaScriptCore.resources
+
+if "%1" EQU "clean" goto :clean
+if "%1" EQU "rebuild" call :clean
+
+echo Copying public headers...
+mkdir "%PublicHeadersDirectory%" 2>NUL
+for %%f in (
+    APICast.h
+    APIShims.h
+    JSBase.h
+    JSContextRef.h
+    JSContextRefPrivate.h
+    JSObjectRef.h
+    JSObjectRefPrivate.h
+    JSRetainPtr.h
+    JSRetainPtr.h
+    JSStringRef.h
+    JSStringRefBSTR.h
+    JSStringRefCF.h
+    JSValueRef.h
+    JSWeakObjectMapRefInternal.h
+    JSWeakObjectMapRefPrivate.h
+    JavaScript.h
+    JavaScriptCore.h
+    OpaqueJSString.h
+    WebKitAvailability.h
+) do (
+    xcopy /y /d ..\..\API\%%f "%PublicHeadersDirectory%" >NUL
+)
+
+echo Copying private headers...
+mkdir "%PrivateHeadersDirectory%" 2>NUL
+for %%d in (
+    assembler
+    bytecode
+    heap
+    debugger
+    interpreter
+    jit
+    parser
+    profiler
+    runtime
+    wtf
+    wtf\text
+    wtf\unicode
+    wtf\unicode\icu
+    yarr
+) do (
+    xcopy /y /d ..\..\%%d\*.h "%PrivateHeadersDirectory%" >NUL
+)
+
+echo Copying resources...
+mkdir "%ResourcesDirectory%" 2>NUL
+xcopy /y /d ..\JavaScriptCore.resources\* "%ResourcesDirectory%" >NUL
+
+echo Copying other files...
+for %%f in (
+    create_hash_table
+    wtf\text\AtomicString.cpp
+    wtf\text\StringBuilder.cpp
+    wtf\text\StringImpl.cpp
+    wtf\text\WTFString.cpp
+) do (
+    xcopy /y /d ..\..\%%f "%PrivateHeadersDirectory%" >NUL
+)
+
+goto :EOF
+
+:clean
+
+echo Deleting copied files...
+if exist "%PublicHeadersDirectory%" rmdir /s /q "%PublicHeadersDirectory%" >NUL
+if exist "%PrivateHeadersDirectory%" rmdir /s /q "%PrivateHeadersDirectory%" >NUL
+if exist "%ResourcesDirectory%" rmdir /s /q "%ResourcesDirectory%" >NUL
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py
index e12840f..4552321 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py
@@ -16,17 +16,14 @@ def main():
     assert len(vsprops_files), "Couldn't find any .vsprops files in %s" % vsprops_directory
     newest_vsprops_time = max(map(os.path.getmtime, vsprops_files))
 
-    # Delete any manifest-related files because Visual Studio isn't smart
-    # enough to figure out that it might need to rebuild them.
     obj_directory = os.path.join(os.environ['CONFIGURATIONBUILDDIR'], 'obj')
-    for manifest_file in glob.iglob(os.path.join(obj_directory, '*', '*.manifest*')):
-        delete_if_older_than(manifest_file, newest_vsprops_time)
-
-    # Delete any precompiled headers because Visual Studio isn't smart enough
-    # to figure out that it might need to rebuild them, even if we touch
-    # wtf/Platform.h below.
-    for precompiled_header in glob.iglob(os.path.join(obj_directory, '*', '*.pch')):
-        delete_if_older_than(precompiled_header, newest_vsprops_time)
+
+    # Visual Studio isn't smart enough to figure out it needs to rebuild these file types when
+    # .vsprops files change (even if we touch wtf/Platform.h below), so we delete them to force them
+    # to be rebuilt.
+    for extension in ('dep', 'manifest', 'pch', 'res'):
+        for filepath in glob.iglob(os.path.join(obj_directory, '*', '*.%s' % extension)):
+            delete_if_older_than(filepath, newest_vsprops_time)
 
     # Touch wtf/Platform.h so all files will be recompiled. This is necessary
     # to pick up changes to preprocessor macros (e.g., ENABLE_*).
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
index 1109c33..1e24f28 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
@@ -22,7 +22,7 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
 		Debug|Win32 = Debug|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release_PGO_Optimize|Win32 = Release_PGO_Optimize|Win32
 		Release_PGO|Win32 = Release_PGO|Win32
 		Release|Win32 = Release|Win32
@@ -32,8 +32,8 @@ Global
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.Build.0 = Debug|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.ActiveCfg = Production|Win32
+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.Build.0 = Production|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO_Optimize|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO_Optimize|Win32
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -44,8 +44,8 @@ Global
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.ActiveCfg = Debug|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.Build.0 = Debug|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.ActiveCfg = Production|Win32
+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.Build.0 = Production|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -56,8 +56,8 @@ Global
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Debug|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Debug|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.ActiveCfg = Production|Win32
+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.Build.0 = Production|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
@@ -68,8 +68,8 @@ Global
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.Build.0 = Debug|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.ActiveCfg = Production|Win32
+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.Build.0 = Production|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
index 55371f3..7c83339 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WTFCommon.vsprops"
+			InheritedPropertySheets=".\WTFDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -70,7 +70,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WTFCommon.vsprops"
+			InheritedPropertySheets=".\WTFRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -122,7 +122,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WTFCommon.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+			InheritedPropertySheets=".\WTFDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -172,9 +172,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WTFCommon.vsprops"
+			InheritedPropertySheets=".\WTFProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -227,7 +227,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\WTFCommon.vsprops"
+			InheritedPropertySheets=".\WTFReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -279,7 +279,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\WTFCommon.vsprops"
+			InheritedPropertySheets=".\WTFDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -331,7 +331,7 @@
 		<Configuration
 			Name="Release_PGO|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WTFCommon.vsprops"
+			InheritedPropertySheets=".\WTFReleasePGO.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -509,6 +509,10 @@
 			</File>
 		</Filter>
 		<File
+			RelativePath="..\..\wtf\Alignment.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\wtf\AlwaysInline.h"
 			>
 		</File>
@@ -537,6 +541,10 @@
 			>
 		</File>
 		<File
+			RelativePath="..\..\wtf\BlockStack.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\wtf\BloomFilter.h"
 			>
 		</File>
@@ -597,6 +605,18 @@
 			>
 		</File>
 		<File
+			RelativePath="..\..\wtf\DoublyLinkedList.h"
+			>
+		</File>
+		<File
+			RelativePath="..\..\wtf\DynamicAnnotations.cpp"
+			>
+		</File>
+		<File
+			RelativePath="..\..\wtf\DynamicAnnotations.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\wtf\dtoa.cpp"
 			>
 		</File>
@@ -624,7 +644,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				>
 				<Tool
 					Name="VCCLCompilerTool"
@@ -697,6 +717,10 @@
 			>
 		</File>
 		<File
+			RelativePath="..\..\wtf\HexNumber.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\wtf\ListHashSet.h"
 			>
 		</File>
@@ -869,6 +893,22 @@
 			>
 		</File>
 		<File
+			RelativePath="..\..\wtf\SentinelLinkedList.h"
+			>
+		</File>
+		<File
+			RelativePath="..\..\wtf\SHA1.cpp"
+			>
+		</File>
+		<File
+			RelativePath="..\..\wtf\SHA1.h"
+			>
+		</File>
+		<File
+			RelativePath="..\..\wtf\SinglyLinkedList.h"
+			>
+		</File>
+		<File
 			RelativePath="..\..\wtf\SizeLimits.cpp"
 			>
 		</File>
@@ -941,7 +981,7 @@
 			>
 		</File>
 		<File
-			RelativePath="..\..\wtf\ThreadSafeShared.h"
+			RelativePath="..\..\wtf\ThreadSafeRefCounted.h"
 			>
 		</File>
 		<File
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebug.vsprops
new file mode 100644
index 0000000..132b5c7
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WTFCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebugAll.vsprops
new file mode 100644
index 0000000..061f2ed
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WTFCommon.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..7965652
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\WTFCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFProduction.vsprops
new file mode 100644
index 0000000..842f6ea
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WTFCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFRelease.vsprops
new file mode 100644
index 0000000..2050eec
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFRelease.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\WTFCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..fc795a3
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\WTFCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops
new file mode 100644
index 0000000..bc2aba9
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WTFReleasePGO"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WTFCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
index ebcfd8e..a650cd2 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\jscCommon.vsprops"
+			InheritedPropertySheets=".\jscDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\jscCommon.vsprops"
+			InheritedPropertySheets=".\jscRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\jscCommon.vsprops"
+			InheritedPropertySheets=".\jscDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -201,7 +201,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\jscCommon.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+			InheritedPropertySheets=".\jscDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -260,9 +260,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\jscCommon.vsprops"
+			InheritedPropertySheets=".\jscProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -324,7 +324,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\jscCommon.vsprops"
+			InheritedPropertySheets=".\jscReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -385,7 +385,7 @@
 		<Configuration
 			Name="Release_PGO|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\jscCommon.vsprops"
+			InheritedPropertySheets=".\jscReleasePGO.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
index 3e329c3..ac8a8fa 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
@@ -6,7 +6,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../assembler/;../../API/;../../parser/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;../../jit/;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include&quot;"
+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../assembler/;../../API/;../../parser/;../../heap/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;../../jit/;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include&quot;"
 		PreprocessorDefinitions="__STD_C"
 		ForcedIncludeFiles="ICUVersion.h"
 		ForcedUsingFiles=""
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebug.vsprops
new file mode 100644
index 0000000..fa6dc68
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebug.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\jscCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops
new file mode 100644
index 0000000..6090c60
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\jscCommon.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..c1868a8
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\jscCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops
new file mode 100644
index 0000000..26e9623
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\jscCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops
new file mode 100644
index 0000000..493dd58
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\jscCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..e4dd761
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\jscCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops
new file mode 100644
index 0000000..c610302
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="jscReleasePGO"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\jscCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
index 5b18032..1dfdd1e 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\testapiDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\testapiRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"
+			InheritedPropertySheets=".\testapiDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -201,7 +201,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"
+			InheritedPropertySheets=".\testapiReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -262,7 +262,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+			InheritedPropertySheets=".\testapiDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -321,9 +321,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="1"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"
+			InheritedPropertySheets=".\testapiProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -430,7 +430,7 @@
 				/>
 			</FileConfiguration>
 			<FileConfiguration
-				Name="Release_LTCG|Win32"
+				Name="Production|Win32"
 				>
 				<Tool
 					Name="VCCLCompilerTool"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops
index 83c9007..1d2060f 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops
@@ -7,6 +7,7 @@
 	<Tool
 		Name="VCCLCompilerTool"
 		AdditionalIncludeDirectories="&quot;$(ProjectDir)\..\..\API&quot;;&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;"
+		PreprocessorDefinitions="NOMINMAX"
 		WarningLevel="4"
 		Detect64BitPortabilityProblems="true"
 		ForcedIncludeFiles="ICUVersion.h"
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebug.vsprops
new file mode 100644
index 0000000..ba5e31d
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="testapiDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\testapiCommon.vsprops;
+      ..\JavaScriptCore\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops
new file mode 100644
index 0000000..cc139f8
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="testapiDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\testapiCommon.vsprops;
+      ..\JavaScriptCore\JavaScriptCoreCF.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..4e1e11f
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="testapiDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\testapiCommon.vsprops;
+      ..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops
new file mode 100644
index 0000000..c79ee0c
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="testapiProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\testapiCommon.vsprops;
+      ..\JavaScriptCore\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops
new file mode 100644
index 0000000..42b1232
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="testapiRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\testapiCommon.vsprops;
+      ..\JavaScriptCore\JavaScriptCoreCF.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..3036bf8
--- /dev/null
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="testapiReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\testapiCommon.vsprops;
+      ..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 74e3b43..98c90e8 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -3,7 +3,7 @@
 	archiveVersion = 1;
 	classes = {
 	};
-	objectVersion = 42;
+	objectVersion = 45;
 	objects = {
 
 /* Begin PBXAggregateTarget section */
@@ -50,15 +50,10 @@
 		0F29479C126E698C00B3ABF5 /* DecimalNumber.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F29479B126E698C00B3ABF5 /* DecimalNumber.cpp */; };
 		1400067712A6F7830064D123 /* OSAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 1400067612A6F7830064D123 /* OSAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1400069312A6F9E10064D123 /* OSAllocatorPosix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1400069212A6F9E10064D123 /* OSAllocatorPosix.cpp */; };
-		14035DB110DBFB2A00FFFFE7 /* WeakGCPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 14035DB010DBFB2A00FFFFE7 /* WeakGCPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		140566C4107EC255005DBC8D /* JSAPIValueWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC0894D50FAFBA2D00001865 /* JSAPIValueWrapper.cpp */; };
 		140566D1107EC267005DBC8D /* JSStaticScopeObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E42C190E3938830065A544 /* JSStaticScopeObject.cpp */; };
 		140566D6107EC271005DBC8D /* JSFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A85E0255597D01FF60F7 /* JSFunction.cpp */; };
 		140B7D1D0DC69AF7009C42B8 /* JSActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14DA818F0D99FD2000B0A4FB /* JSActivation.cpp */; };
-		140CDC7C12DC09BF0013CFC5 /* MarkedSpace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 140CDC7612DBEA330013CFC5 /* MarkedSpace.cpp */; };
-		140CDE7012DE97A00013CFC5 /* Heap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 140CDE6C12DE977E0013CFC5 /* Heap.cpp */; };
-		140CDE7112DE97B10013CFC5 /* Heap.h in Headers */ = {isa = PBXBuildFile; fileRef = 140CDE6D12DE977E0013CFC5 /* Heap.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		140CDF0C12DECE5C0013CFC5 /* MarkedSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = 140CDC7712DBEA330013CFC5 /* MarkedSpace.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		141211310A48794D00480255 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
 		141211340A48795800480255 /* minidom.c in Sources */ = {isa = PBXBuildFile; fileRef = 141211020A48780900480255 /* minidom.c */; };
@@ -74,7 +69,6 @@
 		14280844107EC0930013E7B2 /* RegExpPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD202BF0E1706A7002C7E82 /* RegExpPrototype.cpp */; };
 		14280850107EC0D70013E7B2 /* Operations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8770255597D01FF60F7 /* Operations.cpp */; };
 		14280855107EC0E70013E7B2 /* GetterSetter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9B80E184545000F9297 /* GetterSetter.cpp */; };
-		1428085D107EC0F80013E7B2 /* JSNumberCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9B90E184580000F9297 /* JSNumberCell.cpp */; };
 		14280863107EC11A0013E7B2 /* BooleanConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952320E15EB5600A898AB /* BooleanConstructor.cpp */; };
 		14280864107EC11A0013E7B2 /* BooleanObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8500255597D01FF60F7 /* BooleanObject.cpp */; };
 		14280865107EC11A0013E7B2 /* BooleanPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */; };
@@ -90,6 +84,22 @@
 		1429D92F0ED22D7000B89619 /* JIT.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429D92D0ED22D7000B89619 /* JIT.cpp */; };
 		1429D9300ED22D7000B89619 /* JIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 1429D92E0ED22D7000B89619 /* JIT.h */; };
 		142D3939103E4560007DCB52 /* NumericStrings.h in Headers */ = {isa = PBXBuildFile; fileRef = 142D3938103E4560007DCB52 /* NumericStrings.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142D6F0813539A2800B02E86 /* MarkedBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142D6F0613539A2800B02E86 /* MarkedBlock.cpp */; };
+		142D6F0913539A2800B02E86 /* MarkedBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 142D6F0713539A2800B02E86 /* MarkedBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142D6F0C13539A2F00B02E86 /* MarkedSpace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142D6F0A13539A2F00B02E86 /* MarkedSpace.cpp */; };
+		142D6F0D13539A2F00B02E86 /* MarkedSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = 142D6F0B13539A2F00B02E86 /* MarkedSpace.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142D6F1113539A4100B02E86 /* MarkStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142D6F0E13539A4100B02E86 /* MarkStack.cpp */; };
+		142D6F1213539A4100B02E86 /* MarkStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 142D6F0F13539A4100B02E86 /* MarkStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142D6F1313539A4100B02E86 /* MarkStackPosix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142D6F1013539A4100B02E86 /* MarkStackPosix.cpp */; };
+		142E3134134FF0A600AFADB5 /* Handle.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E312B134FF0A600AFADB5 /* Handle.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E3135134FF0A600AFADB5 /* HandleHeap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142E312C134FF0A600AFADB5 /* HandleHeap.cpp */; };
+		142E3136134FF0A600AFADB5 /* HandleHeap.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E312D134FF0A600AFADB5 /* HandleHeap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E3137134FF0A600AFADB5 /* HandleStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142E312E134FF0A600AFADB5 /* HandleStack.cpp */; };
+		142E3138134FF0A600AFADB5 /* HandleStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E312F134FF0A600AFADB5 /* HandleStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E3139134FF0A600AFADB5 /* Local.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E3130134FF0A600AFADB5 /* Local.h */; };
+		142E313A134FF0A600AFADB5 /* LocalScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E3131134FF0A600AFADB5 /* LocalScope.h */; };
+		142E313B134FF0A600AFADB5 /* Strong.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E3132134FF0A600AFADB5 /* Strong.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E313C134FF0A600AFADB5 /* Weak.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E3133134FF0A600AFADB5 /* Weak.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		143A97E60A4A06E200456B66 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */; };
 		1440057F0A5335640005F061 /* JSNode.c in Sources */ = {isa = PBXBuildFile; fileRef = 1440F6420A4F8B6A0005F061 /* JSNode.c */; };
 		144005CB0A5338D10005F061 /* JSNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 1440F6410A4F8B6A0005F061 /* JSNode.h */; };
@@ -103,6 +113,7 @@
 		1440F8920A508B100005F061 /* JSCallbackFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440F8900A508B100005F061 /* JSCallbackFunction.cpp */; };
 		1440F8AF0A508D200005F061 /* JSCallbackConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440F8AD0A508D200005F061 /* JSCallbackConstructor.cpp */; };
 		1440FCE40A51E46B0005F061 /* JSClassRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440FCE20A51E46B0005F061 /* JSClassRef.cpp */; };
+		14456A321314657800212CA3 /* DoublyLinkedList.h in Headers */ = {isa = PBXBuildFile; fileRef = 14456A311314657800212CA3 /* DoublyLinkedList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14469DD7107EC79E00650446 /* dtoa.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 651F6412039D5B5F0078395C /* dtoa.cpp */; };
 		14469DDE107EC7E700650446 /* Lookup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8680255597D01FF60F7 /* Lookup.cpp */; };
 		14469DDF107EC7E700650446 /* MathObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A86A0255597D01FF60F7 /* MathObject.cpp */; };
@@ -115,14 +126,14 @@
 		14469DE6107EC7E700650446 /* ObjectPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C80E16D4E900A06E92 /* ObjectPrototype.cpp */; };
 		14469DE7107EC7E700650446 /* PropertyNameArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65400C0F0A69BAF200509887 /* PropertyNameArray.cpp */; };
 		14469DE8107EC7E700650446 /* PropertySlot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65621E6B089E859700760F35 /* PropertySlot.cpp */; };
-		14469DE9107EC7E700650446 /* PrototypeFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC257DF10E1F53740016B6C9 /* PrototypeFunction.cpp */; };
 		14469DEA107EC7E700650446 /* ScopeChain.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9374D3A8038D9D74008635CE /* ScopeChain.cpp */; };
 		14469DEB107EC7E700650446 /* StringConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C00E16EE3300B34460 /* StringConstructor.cpp */; };
 		14469DEC107EC7E700650446 /* StringObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C20E16EE3300B34460 /* StringObject.cpp */; };
 		14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C50E16EE3300B34460 /* StringPrototype.cpp */; };
 		14469DEE107EC7E700650446 /* UString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8850255597D01FF60F7 /* UString.cpp */; };
+		144836E7132DA7BE005BE785 /* ConservativeRoots.h in Headers */ = {isa = PBXBuildFile; fileRef = 149DAAF212EB559D0083B12B /* ConservativeRoots.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		146AAB380B66A94400E55F16 /* JSStringRefCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146AAB370B66A94400E55F16 /* JSStringRefCF.cpp */; };
-		146B16D812EB5B59001BEC1B /* ConservativeSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146B14DB12EB5B12001BEC1B /* ConservativeSet.cpp */; };
+		146B16D812EB5B59001BEC1B /* ConservativeRoots.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146B14DB12EB5B12001BEC1B /* ConservativeRoots.cpp */; };
 		146FE51211A710430087AE66 /* JITCall32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146FE51111A710430087AE66 /* JITCall32_64.cpp */; };
 		147B83AC0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 147B83AA0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h */; };
 		147B84630E6DE6B1004775A4 /* PutPropertySlot.h in Headers */ = {isa = PBXBuildFile; fileRef = 147B84620E6DE6B1004775A4 /* PutPropertySlot.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -142,13 +153,11 @@
 		147F39CA107EC37600427A48 /* ErrorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9060E1839DB000F9297 /* ErrorPrototype.cpp */; };
 		147F39CB107EC37600427A48 /* FunctionConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C00E16D4E900A06E92 /* FunctionConstructor.cpp */; };
 		147F39CC107EC37600427A48 /* FunctionPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A85C0255597D01FF60F7 /* FunctionPrototype.cpp */; };
-		147F39CD107EC37600427A48 /* GlobalEvalFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC257DED0E1F52ED0016B6C9 /* GlobalEvalFunction.cpp */; };
 		147F39CE107EC37600427A48 /* Identifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 933A349D038AE80F008635CE /* Identifier.cpp */; };
 		147F39CF107EC37600427A48 /* InternalFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC9BB95B0E19680600DF8855 /* InternalFunction.cpp */; };
 		147F39D0107EC37600427A48 /* JSArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93ADFCE60CCBD7AC00D30B08 /* JSArray.cpp */; };
 		147F39D1107EC37600427A48 /* JSCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7F8FBA0E19D1EF008632C0 /* JSCell.cpp */; };
 		147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14DE0D680D02431400AACCA2 /* JSGlobalObject.cpp */; };
-		147F39D3107EC37600427A48 /* JSImmediate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14760863099C633800437128 /* JSImmediate.cpp */; };
 		147F39D4107EC37600427A48 /* JSObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC22A3980E16E14800AF21C8 /* JSObject.cpp */; };
 		147F39D5107EC37600427A48 /* JSString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9B60E1842FA000F9297 /* JSString.cpp */; };
 		147F39D6107EC37600427A48 /* JSValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8870255597D01FF60F7 /* JSValue.cpp */; };
@@ -176,11 +185,11 @@
 		14BD5A320A3E91F600BAF59C /* JSValueRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14BD5A2B0A3E91F600BAF59C /* JSValueRef.cpp */; };
 		14BFCE6910CDB1FC00364CCE /* WeakGCMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14C5242B0F5355E900BA3D04 /* JITStubs.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A6581A0F4E36F4000150FD /* JITStubs.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		14C824AB12F7C77E008F35E0 /* MarkedBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14C824AA12F7C77E008F35E0 /* MarkedBlock.cpp */; };
-		14C824AD12F7C785008F35E0 /* MarkedBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14C824AC12F7C785008F35E0 /* MarkedBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14E9D17B107EC469004DDA21 /* JSGlobalObjectFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */; };
 		14F8BA3E107EC886009892DC /* FastMalloc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65E217B908E7EECC0023E5F6 /* FastMalloc.cpp */; };
 		14F8BA43107EC88C009892DC /* TCSystemAlloc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6541BD7008E80A17002CBEE7 /* TCSystemAlloc.cpp */; };
+		14FB986D135225410085A5DB /* Heap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14FB986B135225410085A5DB /* Heap.cpp */; };
+		14FB986E135225410085A5DB /* Heap.h in Headers */ = {isa = PBXBuildFile; fileRef = 14FB986C135225410085A5DB /* Heap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14FFF98C12BFFF7500795BB8 /* PageAllocationAligned.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14FFF98A12BFFF7500795BB8 /* PageAllocationAligned.cpp */; };
 		14FFF98D12BFFF7500795BB8 /* PageAllocationAligned.h in Headers */ = {isa = PBXBuildFile; fileRef = 14FFF98B12BFFF7500795BB8 /* PageAllocationAligned.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		180B9B080F16D94F009BDBC5 /* CurrentTime.h in Headers */ = {isa = PBXBuildFile; fileRef = 180B9AF00F16C569009BDBC5 /* CurrentTime.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -201,16 +210,20 @@
 		5135FAF212D26ACE003C083B /* Decoder.h in Headers */ = {isa = PBXBuildFile; fileRef = 5135FAD512D26856003C083B /* Decoder.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5135FAF312D26AD1003C083B /* Encoder.h in Headers */ = {isa = PBXBuildFile; fileRef = 5135FAD612D26856003C083B /* Encoder.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5D53726F0E1C54880021E549 /* Tracing.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D53726E0E1C54880021E549 /* Tracing.h */; };
-		5D5D8AB60E0D0A7200F9C692 /* jsc in Copy Into Framework */ = {isa = PBXBuildFile; fileRef = 932F5BE10822A1C700736975 /* jsc */; };
 		5D5D8AD10E0D0EBE00F9C692 /* libedit.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */; };
 		5D63E9AD10F2BD6E00FC8AE9 /* StringHasher.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D63E9AC10F2BD6E00FC8AE9 /* StringHasher.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5D6A566B0F05995500266145 /* Threading.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D6A566A0F05995500266145 /* Threading.cpp */; };
+		5DBB151B131D0B310056AD36 /* testapi.js in Copy Support Script */ = {isa = PBXBuildFile; fileRef = 14D857740A4696C80032146C /* testapi.js */; };
+		5DBB1525131D0BD70056AD36 /* minidom.js in Copy Support Script */ = {isa = PBXBuildFile; fileRef = 1412110D0A48788700480255 /* minidom.js */; };
 		5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */ = {isa = PBXBuildFile; fileRef = F692A8540255597D01FF60F7 /* create_hash_table */; settings = {ATTRIBUTES = (); }; };
 		6507D29E0E871E5E00D7D896 /* JSTypeInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 6507D2970E871E4A00D7D896 /* JSTypeInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		655EB29B10CE2581001A990E /* NodesCodegen.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 655EB29A10CE2581001A990E /* NodesCodegen.cpp */; };
 		65DFC93308EA173A00F7300B /* HashTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65DFC92D08EA173A00F7300B /* HashTable.cpp */; };
 		65E1A3DF122B894500B26097 /* NonCopyingSort.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E1A2F4122B880D00B26097 /* NonCopyingSort.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		65FDE49C0BDD1D4A00E80111 /* Assertions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65E217B808E7EECC0023E5F6 /* Assertions.cpp */; settings = {COMPILER_FLAGS = "-Wno-missing-format-attribute"; }; };
+		65FDE49C0BDD1D4A00E80111 /* Assertions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65E217B808E7EECC0023E5F6 /* Assertions.cpp */; };
+		7186A6EC13100BA5004479E1 /* HexNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = 7186A6E813100B57004479E1 /* HexNumber.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		76FB9F0F12E851860051A2EB /* SHA1.h in Headers */ = {isa = PBXBuildFile; fileRef = 76FB9F0E12E851860051A2EB /* SHA1.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		76FB9F1112E851960051A2EB /* SHA1.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 76FB9F1012E851960051A2EB /* SHA1.cpp */; };
 		7E4EE7090EBB7963005934AA /* StructureChain.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E4EE7080EBB7963005934AA /* StructureChain.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7E4EE70F0EBB7A5B005934AA /* StructureChain.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E4EE70E0EBB7A5B005934AA /* StructureChain.cpp */; };
 		7EFF00640EC05A9A00AA7C93 /* NodeInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EFF00630EC05A9A00AA7C93 /* NodeInfo.h */; };
@@ -226,7 +239,8 @@
 		86438FC41265503E00E0DFCA /* StringBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86438FC31265503E00E0DFCA /* StringBuilder.cpp */; };
 		86565742115BE3DA00291F40 /* CString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86565740115BE3DA00291F40 /* CString.cpp */; };
 		86565743115BE3DA00291F40 /* CString.h in Headers */ = {isa = PBXBuildFile; fileRef = 86565741115BE3DA00291F40 /* CString.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		865F408810E7D56300947361 /* APIShims.h in Headers */ = {isa = PBXBuildFile; fileRef = 865F408710E7D56300947361 /* APIShims.h */; };
+		865A30F1135007E100CDB49E /* JSValueInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = 865A30F0135007E100CDB49E /* JSValueInlineMethods.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		865F408810E7D56300947361 /* APIShims.h in Headers */ = {isa = PBXBuildFile; fileRef = 865F408710E7D56300947361 /* APIShims.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86676D5211FED9BC004B6863 /* BumpPointerAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 86676D4D11FED55D004B6863 /* BumpPointerAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86704B4212DB8A8100A9FE7B /* YarrSyntaxChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86704B4012DB8A8100A9FE7B /* YarrSyntaxChecker.cpp */; };
 		86704B4312DB8A8100A9FE7B /* YarrSyntaxChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B4112DB8A8100A9FE7B /* YarrSyntaxChecker.h */; };
@@ -279,6 +293,25 @@
 		86DB64640F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86DB64630F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp */; };
 		86E116B10FE75AC800B512BC /* CodeLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E116B00FE75AC800B512BC /* CodeLocation.h */; };
 		86E85539111B9968001AF51E /* JSStringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E85538111B9968001AF51E /* JSStringBuilder.h */; };
+		86EC9DC41328DF82002B2AD7 /* DFGByteCodeParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DB41328DF82002B2AD7 /* DFGByteCodeParser.cpp */; };
+		86EC9DC51328DF82002B2AD7 /* DFGByteCodeParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DB51328DF82002B2AD7 /* DFGByteCodeParser.h */; };
+		86EC9DC61328DF82002B2AD7 /* DFGGenerationInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */; };
+		86EC9DC71328DF82002B2AD7 /* DFGGraph.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */; };
+		86EC9DC81328DF82002B2AD7 /* DFGGraph.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DB81328DF82002B2AD7 /* DFGGraph.h */; };
+		86EC9DC91328DF82002B2AD7 /* DFGJITCodeGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DB91328DF82002B2AD7 /* DFGJITCodeGenerator.cpp */; };
+		86EC9DCA1328DF82002B2AD7 /* DFGJITCodeGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DBA1328DF82002B2AD7 /* DFGJITCodeGenerator.h */; };
+		86EC9DCB1328DF82002B2AD7 /* DFGJITCompiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DBB1328DF82002B2AD7 /* DFGJITCompiler.cpp */; };
+		86EC9DCC1328DF82002B2AD7 /* DFGJITCompiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DBC1328DF82002B2AD7 /* DFGJITCompiler.h */; };
+		86EC9DCD1328DF82002B2AD7 /* DFGNonSpeculativeJIT.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DBD1328DF82002B2AD7 /* DFGNonSpeculativeJIT.cpp */; };
+		86EC9DCE1328DF82002B2AD7 /* DFGNonSpeculativeJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DBE1328DF82002B2AD7 /* DFGNonSpeculativeJIT.h */; };
+		86EC9DCF1328DF82002B2AD7 /* DFGOperations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DBF1328DF82002B2AD7 /* DFGOperations.cpp */; };
+		86EC9DD01328DF82002B2AD7 /* DFGOperations.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DC01328DF82002B2AD7 /* DFGOperations.h */; };
+		86EC9DD11328DF82002B2AD7 /* DFGRegisterBank.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */; };
+		86EC9DD21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DC21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp */; };
+		86EC9DD31328DF82002B2AD7 /* DFGSpeculativeJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DC31328DF82002B2AD7 /* DFGSpeculativeJIT.h */; };
+		86ECA3EA132DEF1C002B2AD7 /* DFGNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */; };
+		86ECA3FA132DF25A002B2AD7 /* DFGScoreBoard.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ECA3F9132DF25A002B2AD7 /* DFGScoreBoard.h */; };
+		86ECA4F1132EAA6D002B2AD7 /* DFGAliasTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ECA4F0132EAA6D002B2AD7 /* DFGAliasTracker.h */; };
 		86F38859121130CA007A7CE3 /* AtomicStringHash.h in Headers */ = {isa = PBXBuildFile; fileRef = 86F38858121130CA007A7CE3 /* AtomicStringHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		90213E3D123A40C200D422F3 /* MemoryStatistics.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */; };
 		90213E3E123A40C200D422F3 /* MemoryStatistics.h in Headers */ = {isa = PBXBuildFile; fileRef = 90213E3C123A40C200D422F3 /* MemoryStatistics.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -287,7 +320,6 @@
 		93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93052C320FB792190048FDC3 /* ParserArena.cpp */; };
 		93052C350FB792190048FDC3 /* ParserArena.h in Headers */ = {isa = PBXBuildFile; fileRef = 93052C330FB792190048FDC3 /* ParserArena.h */; settings = {ATTRIBUTES = (); }; };
 		932F5BD30822A1C700736975 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */; };
-		932F5BD50822A1C700736975 /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EB6105C86C6B00E6DF1B /* Foundation.framework */; };
 		932F5BD60822A1C700736975 /* libobjc.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EC0705C86C9A00E6DF1B /* libobjc.dylib */; };
 		932F5BD70822A1C700736975 /* libicucore.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 9322A00306C341D3009067BB /* libicucore.dylib */; };
 		932F5BDD0822A1C700736975 /* jsc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 45E12D8806A49B0F00E9DF84 /* jsc.cpp */; };
@@ -330,8 +362,6 @@
 		9714AF5F122F32070092D9F5 /* ParsedURL.h in Headers */ = {isa = PBXBuildFile; fileRef = 9714AF58122F31F50092D9F5 /* ParsedURL.h */; };
 		9714AF60122F32070092D9F5 /* URLString.h in Headers */ = {isa = PBXBuildFile; fileRef = 9714AF59122F31F50092D9F5 /* URLString.h */; };
 		971EDEA61169E0D3005E4262 /* Terminator.h in Headers */ = {isa = PBXBuildFile; fileRef = 97F6903A1169DF7F00A6BB46 /* Terminator.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		972A485F12661E0800F4514F /* URLCharacterTypes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 972A485D12661E0800F4514F /* URLCharacterTypes.cpp */; };
-		972A48771266256F00F4514F /* URLEscape.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 972A48741266256F00F4514F /* URLEscape.cpp */; };
 		97941A5713029AAB004A3447 /* OSRandomSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97941A3F130299DB004A3447 /* OSRandomSource.cpp */; };
 		97941A5A13029ACC004A3447 /* OSRandomSource.h in Headers */ = {isa = PBXBuildFile; fileRef = 97941A40130299DB004A3447 /* OSRandomSource.h */; };
 		97941A7E1302A098004A3447 /* CryptographicallyRandomNumber.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97941A7C1302A098004A3447 /* CryptographicallyRandomNumber.cpp */; };
@@ -339,6 +369,7 @@
 		A1712B3B11C7B212007A5315 /* RegExpCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1712B3A11C7B212007A5315 /* RegExpCache.cpp */; };
 		A1712B3F11C7B228007A5315 /* RegExpCache.h in Headers */ = {isa = PBXBuildFile; fileRef = A1712B3E11C7B228007A5315 /* RegExpCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A1712B4111C7B235007A5315 /* RegExpKey.h in Headers */ = {isa = PBXBuildFile; fileRef = A1712B4011C7B235007A5315 /* RegExpKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A1D764521354448B00C5C7C0 /* Alignment.h in Headers */ = {isa = PBXBuildFile; fileRef = A1D764511354448B00C5C7C0 /* Alignment.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A71236E51195F33C00BD2174 /* JITOpcodes32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A71236E41195F33C00BD2174 /* JITOpcodes32_64.cpp */; };
 		A72700900DAC6BBC00E548D7 /* JSNotAnObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A72700780DAC605600E548D7 /* JSNotAnObject.cpp */; };
 		A72701B90DADE94900E548D7 /* ExceptionHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = A72701B30DADE94900E548D7 /* ExceptionHelpers.h */; };
@@ -346,19 +377,17 @@
 		A7280A2811557E3000D56957 /* JSObjectRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A79EDB0811531CD60019E912 /* JSObjectRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A730B6121250068F009D25B1 /* StrictEvalActivation.h in Headers */ = {isa = PBXBuildFile; fileRef = A730B6101250068F009D25B1 /* StrictEvalActivation.h */; };
 		A730B6131250068F009D25B1 /* StrictEvalActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A730B6111250068F009D25B1 /* StrictEvalActivation.cpp */; };
+		A731B25A130093880040A7FA /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EB6105C86C6B00E6DF1B /* Foundation.framework */; };
 		A7386554118697B400540279 /* SpecializedThunkJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = A7386551118697B400540279 /* SpecializedThunkJIT.h */; };
 		A7386555118697B400540279 /* ThunkGenerators.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7386552118697B400540279 /* ThunkGenerators.cpp */; };
 		A7386556118697B400540279 /* ThunkGenerators.h in Headers */ = {isa = PBXBuildFile; fileRef = A7386553118697B400540279 /* ThunkGenerators.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7482B9311671147003B0712 /* JSWeakObjectMapRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A7482B791166CDEA003B0712 /* JSWeakObjectMapRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7482B9411671147003B0712 /* JSWeakObjectMapRefPrivate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7482B7A1166CDEA003B0712 /* JSWeakObjectMapRefPrivate.cpp */; };
 		A7482E93116A7CAD003B0712 /* JSWeakObjectMapRefInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = A7482E37116A697B003B0712 /* JSWeakObjectMapRefInternal.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A74B3499102A5F8E0032AB98 /* MarkStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A74B3498102A5F8E0032AB98 /* MarkStack.cpp */; };
 		A74DE1D0120B875600D40D5B /* ARMv7Assembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A74DE1CB120B86D600D40D5B /* ARMv7Assembler.cpp */; };
 		A75706DE118A2BCF0057F88F /* JITArithmetic32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A75706DD118A2BCF0057F88F /* JITArithmetic32_64.cpp */; };
 		A766B44F0EE8DCD1009518CA /* ExecutableAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A76C51761182748D00715B05 /* JSInterfaceJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = A76C51741182748D00715B05 /* JSInterfaceJIT.h */; };
-		A76EE6590FAE59D5003F069A /* NativeFunctionWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = A76EE6580FAE59D5003F069A /* NativeFunctionWrapper.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A7795590101A74D500114E55 /* MarkStack.h in Headers */ = {isa = PBXBuildFile; fileRef = A779558F101A74D500114E55 /* MarkStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A783A0D111A36DCA00563D20 /* JSObjectWithGlobalObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A783A0D011A36DCA00563D20 /* JSObjectWithGlobalObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A783A2AB11A5BE8400563D20 /* JSObjectWithGlobalObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A783A2AA11A5BE8400563D20 /* JSObjectWithGlobalObject.cpp */; };
 		A784A26111D16622005776AC /* ASTBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A7EE7411B98B8D0065A14F /* ASTBuilder.h */; };
@@ -371,7 +400,9 @@
 		A7A1F7AD0F252B3C00E184E2 /* ByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A1F7AB0F252B3C00E184E2 /* ByteArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */; };
 		A7C1E8E4112E72EF00A37F98 /* JITPropertyAccess32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C1E8C8112E701C00A37F98 /* JITPropertyAccess32_64.cpp */; };
-		A7C530E4102A3813005BC741 /* MarkStackPosix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */; };
+		A7C40C0A130B057D00D002A1 /* BlockStack.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C40C07130B057D00D002A1 /* BlockStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7C40C0B130B057D00D002A1 /* SentinelLinkedList.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C40C08130B057D00D002A1 /* SentinelLinkedList.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7C40C0C130B057D00D002A1 /* SinglyLinkedList.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C40C09130B057D00D002A1 /* SinglyLinkedList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7D649AA1015224E009B2E1B /* PossiblyNull.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D649A91015224E009B2E1B /* PossiblyNull.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = A7DCB77912E3D90500911940 /* WriteBarrier.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E2EA690FB460CF00601F06 /* LiteralParser.h */; };
@@ -440,7 +471,6 @@
 		BC18C41F0E16F5CD00B34460 /* JSFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A85F0255597D01FF60F7 /* JSFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4200E16F5CD00B34460 /* JSGlobalData.h in Headers */ = {isa = PBXBuildFile; fileRef = E18E3A560DF9278C00D90B34 /* JSGlobalData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4210E16F5CD00B34460 /* JSGlobalObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A8E894330CD0603F00367179 /* JSGlobalObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4220E16F5CD00B34460 /* JSImmediate.h in Headers */ = {isa = PBXBuildFile; fileRef = 1483B589099BC1950016E4F0 /* JSImmediate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4230E16F5CD00B34460 /* JSLock.h in Headers */ = {isa = PBXBuildFile; fileRef = 65EA4C9A092AF9E20093D800 /* JSLock.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4240E16F5CD00B34460 /* JSObject.h in Headers */ = {isa = PBXBuildFile; fileRef = BC22A3990E16E14800AF21C8 /* JSObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4250E16F5CD00B34460 /* JSObjectRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 1482B7E10A43076000517CFC /* JSObjectRef.h */; settings = {ATTRIBUTES = (Public, ); }; };
@@ -520,17 +550,14 @@
 		BC18C52C0E16FCD200B34460 /* RegExpObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52B0E16FCD200B34460 /* RegExpObject.lut.h */; };
 		BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52D0E16FCE100B34460 /* Lexer.lut.h */; };
 		BC257DE80E1F51C50016B6C9 /* Arguments.h in Headers */ = {isa = PBXBuildFile; fileRef = BC257DE60E1F51C50016B6C9 /* Arguments.h */; };
-		BC257DF00E1F52ED0016B6C9 /* GlobalEvalFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = BC257DEE0E1F52ED0016B6C9 /* GlobalEvalFunction.h */; };
-		BC257DF40E1F53740016B6C9 /* PrototypeFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = BC257DF20E1F53740016B6C9 /* PrototypeFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC3046070E1F497F003232CF /* Error.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3046060E1F497F003232CF /* Error.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC3135640F302FA3003DFD3A /* DebuggerActivation.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3135620F302FA3003DFD3A /* DebuggerActivation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */; };
 		BC5F7BBE11823B590052C02C /* Atomics.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5F7BBB11823B590052C02C /* Atomics.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC5F7BBF11823B590052C02C /* ThreadingPrimitives.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5F7BBC11823B590052C02C /* ThreadingPrimitives.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC5F7BC011823B590052C02C /* ThreadSafeShared.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5F7BBD11823B590052C02C /* ThreadSafeShared.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC5F7BC011823B590052C02C /* ThreadSafeRefCounted.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5F7BBD11823B590052C02C /* ThreadSafeRefCounted.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */; };
-		BC7F8FB90E19D1C3008632C0 /* JSNumberCell.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7F8FB80E19D1C3008632C0 /* JSNumberCell.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC87CDB810712ACA000614CF /* JSONObject.lut.h */; };
 		BC9041480EB9250900FE26FA /* StructureTransitionTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9041470EB9250900FE26FA /* StructureTransitionTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC95437D0EBA70FD0072B6D3 /* PropertyMapHashTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BC95437C0EBA70FD0072B6D3 /* PropertyMapHashTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -550,14 +577,9 @@
 		BCFD8C920EEB2EE700283848 /* JumpTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCFD8C900EEB2EE700283848 /* JumpTable.cpp */; };
 		BCFD8C930EEB2EE700283848 /* JumpTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFD8C910EEB2EE700283848 /* JumpTable.h */; };
 		C0A272630E50A06300E96E15 /* NotFound.h in Headers */ = {isa = PBXBuildFile; fileRef = C0A2723F0E509F1E00E96E15 /* NotFound.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		D7A46A4F1338FFEA00ED695C /* DynamicAnnotations.h in Headers */ = {isa = PBXBuildFile; fileRef = D75AF59612F8CB9500FC0ADF /* DynamicAnnotations.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DD377CBC12072C18006A2517 /* Bitmap.h in Headers */ = {isa = PBXBuildFile; fileRef = DD377CBB12072C18006A2517 /* Bitmap.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		DDE82AD31209D955005C1756 /* GCHandle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DDE82AD11209D955005C1756 /* GCHandle.cpp */; };
-		DDE82AD41209D955005C1756 /* GCHandle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DDE82AD11209D955005C1756 /* GCHandle.cpp */; };
-		DDE82AD51209D955005C1756 /* GCHandle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DDE82AD11209D955005C1756 /* GCHandle.cpp */; };
-		DDE82AD61209D955005C1756 /* GCHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = DDE82AD21209D955005C1756 /* GCHandle.h */; };
-		DDE82AD71209D955005C1756 /* GCHandle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DDE82AD11209D955005C1756 /* GCHandle.cpp */; };
-		DDE82AD81209D955005C1756 /* GCHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = DDE82AD21209D955005C1756 /* GCHandle.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		DDF7ABD411F60ED200108E36 /* GCActivityCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = DDF7ABD211F60ED200108E36 /* GCActivityCallback.h */; };
+		DDF7ABD411F60ED200108E36 /* GCActivityCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = DDF7ABD211F60ED200108E36 /* GCActivityCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DDF7ABD511F60ED200108E36 /* GCActivityCallbackCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DDF7ABD311F60ED200108E36 /* GCActivityCallbackCF.cpp */; };
 		E124A8F70E555775003091F1 /* OpaqueJSString.h in Headers */ = {isa = PBXBuildFile; fileRef = E124A8F50E555775003091F1 /* OpaqueJSString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E124A8F80E555775003091F1 /* OpaqueJSString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E124A8F60E555775003091F1 /* OpaqueJSString.cpp */; };
@@ -638,15 +660,26 @@
 /* End PBXContainerItemProxy section */
 
 /* Begin PBXCopyFilesBuildPhase section */
-		5D5D8ABA0E0D0A7300F9C692 /* Copy Into Framework */ = {
+		5DBB1511131D0B130056AD36 /* Copy Support Script */ = {
 			isa = PBXCopyFilesBuildPhase;
 			buildActionMask = 2147483647;
-			dstPath = JavaScriptCore.framework/Resources;
+			dstPath = "";
 			dstSubfolderSpec = 16;
 			files = (
-				5D5D8AB60E0D0A7200F9C692 /* jsc in Copy Into Framework */,
+				5DBB151B131D0B310056AD36 /* testapi.js in Copy Support Script */,
 			);
-			name = "Copy Into Framework";
+			name = "Copy Support Script";
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		5DBB1524131D0BA10056AD36 /* Copy Support Script */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 2147483647;
+			dstPath = "";
+			dstSubfolderSpec = 16;
+			files = (
+				5DBB1525131D0BD70056AD36 /* minidom.js in Copy Support Script */,
+			);
+			name = "Copy Support Script";
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 /* End PBXCopyFilesBuildPhase section */
@@ -670,11 +703,6 @@
 		0F29479B126E698C00B3ABF5 /* DecimalNumber.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DecimalNumber.cpp; sourceTree = "<group>"; };
 		1400067612A6F7830064D123 /* OSAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OSAllocator.h; sourceTree = "<group>"; };
 		1400069212A6F9E10064D123 /* OSAllocatorPosix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OSAllocatorPosix.cpp; sourceTree = "<group>"; };
-		14035DB010DBFB2A00FFFFE7 /* WeakGCPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakGCPtr.h; sourceTree = "<group>"; };
-		140CDC7612DBEA330013CFC5 /* MarkedSpace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedSpace.cpp; sourceTree = "<group>"; };
-		140CDC7712DBEA330013CFC5 /* MarkedSpace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedSpace.h; sourceTree = "<group>"; };
-		140CDE6C12DE977E0013CFC5 /* Heap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Heap.cpp; sourceTree = "<group>"; };
-		140CDE6D12DE977E0013CFC5 /* Heap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Heap.h; sourceTree = "<group>"; };
 		140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBasePrivate.h; sourceTree = "<group>"; };
 		141211020A48780900480255 /* minidom.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = minidom.c; path = tests/minidom.c; sourceTree = "<group>"; };
 		1412110D0A48788700480255 /* minidom.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = minidom.js; path = tests/minidom.js; sourceTree = "<group>"; };
@@ -694,6 +722,22 @@
 		1429D92D0ED22D7000B89619 /* JIT.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JIT.cpp; sourceTree = "<group>"; };
 		1429D92E0ED22D7000B89619 /* JIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JIT.h; sourceTree = "<group>"; };
 		142D3938103E4560007DCB52 /* NumericStrings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumericStrings.h; sourceTree = "<group>"; };
+		142D6F0613539A2800B02E86 /* MarkedBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedBlock.cpp; sourceTree = "<group>"; };
+		142D6F0713539A2800B02E86 /* MarkedBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedBlock.h; sourceTree = "<group>"; };
+		142D6F0A13539A2F00B02E86 /* MarkedSpace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedSpace.cpp; sourceTree = "<group>"; };
+		142D6F0B13539A2F00B02E86 /* MarkedSpace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedSpace.h; sourceTree = "<group>"; };
+		142D6F0E13539A4100B02E86 /* MarkStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStack.cpp; sourceTree = "<group>"; };
+		142D6F0F13539A4100B02E86 /* MarkStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkStack.h; sourceTree = "<group>"; };
+		142D6F1013539A4100B02E86 /* MarkStackPosix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStackPosix.cpp; sourceTree = "<group>"; };
+		142E312B134FF0A600AFADB5 /* Handle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Handle.h; sourceTree = "<group>"; };
+		142E312C134FF0A600AFADB5 /* HandleHeap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HandleHeap.cpp; sourceTree = "<group>"; };
+		142E312D134FF0A600AFADB5 /* HandleHeap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HandleHeap.h; sourceTree = "<group>"; };
+		142E312E134FF0A600AFADB5 /* HandleStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HandleStack.cpp; sourceTree = "<group>"; };
+		142E312F134FF0A600AFADB5 /* HandleStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HandleStack.h; sourceTree = "<group>"; };
+		142E3130134FF0A600AFADB5 /* Local.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Local.h; sourceTree = "<group>"; };
+		142E3131134FF0A600AFADB5 /* LocalScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalScope.h; sourceTree = "<group>"; };
+		142E3132134FF0A600AFADB5 /* Strong.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Strong.h; sourceTree = "<group>"; };
+		142E3133134FF0A600AFADB5 /* Weak.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Weak.h; sourceTree = "<group>"; };
 		1440051F0A531D3B0005F061 /* Node.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Node.h; path = tests/Node.h; sourceTree = "<group>"; };
 		144005200A531D3B0005F061 /* Node.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = Node.c; path = tests/Node.c; sourceTree = "<group>"; };
 		144007480A536CC20005F061 /* NodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NodeList.h; path = tests/NodeList.h; sourceTree = "<group>"; };
@@ -708,12 +752,12 @@
 		1440F8AD0A508D200005F061 /* JSCallbackConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCallbackConstructor.cpp; sourceTree = "<group>"; };
 		1440FCE10A51E46B0005F061 /* JSClassRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSClassRef.h; sourceTree = "<group>"; };
 		1440FCE20A51E46B0005F061 /* JSClassRef.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSClassRef.cpp; sourceTree = "<group>"; };
+		14456A311314657800212CA3 /* DoublyLinkedList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DoublyLinkedList.h; sourceTree = "<group>"; };
 		145C507F0D9DF63B0088F6B9 /* CallData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallData.h; sourceTree = "<group>"; };
 		146AAB2A0B66A84900E55F16 /* JSStringRefCF.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSStringRefCF.h; sourceTree = "<group>"; };
 		146AAB370B66A94400E55F16 /* JSStringRefCF.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSStringRefCF.cpp; sourceTree = "<group>"; };
-		146B14DB12EB5B12001BEC1B /* ConservativeSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConservativeSet.cpp; sourceTree = "<group>"; };
+		146B14DB12EB5B12001BEC1B /* ConservativeRoots.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConservativeRoots.cpp; sourceTree = "<group>"; };
 		146FE51111A710430087AE66 /* JITCall32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITCall32_64.cpp; sourceTree = "<group>"; };
-		14760863099C633800437128 /* JSImmediate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSImmediate.cpp; sourceTree = "<group>"; };
 		147B83AA0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BatchedTransitionOptimizer.h; sourceTree = "<group>"; };
 		147B84620E6DE6B1004775A4 /* PutPropertySlot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutPropertySlot.h; sourceTree = "<group>"; };
 		1480DB9B0DDC227F003CFDF2 /* DebuggerCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerCallFrame.h; sourceTree = "<group>"; };
@@ -729,7 +773,7 @@
 		148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSContextRefPrivate.h; sourceTree = "<group>"; };
 		149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerCallFrame.cpp; sourceTree = "<group>"; };
 		149B24FF0D8AF6D1009CB8C7 /* Register.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Register.h; sourceTree = "<group>"; };
-		149DAAF212EB559D0083B12B /* ConservativeSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConservativeSet.h; sourceTree = "<group>"; };
+		149DAAF212EB559D0083B12B /* ConservativeRoots.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConservativeRoots.h; sourceTree = "<group>"; };
 		14A1563010966365006FA260 /* DateInstanceCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateInstanceCache.h; sourceTree = "<group>"; };
 		14A23D6C0F4E19CE0023CDAD /* JITStubs.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITStubs.cpp; sourceTree = "<group>"; };
 		14A396A60CD2933100B5B4FF /* SymbolTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SymbolTable.h; sourceTree = "<group>"; };
@@ -751,14 +795,14 @@
 		14BD5A2B0A3E91F600BAF59C /* JSValueRef.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSValueRef.cpp; sourceTree = "<group>"; };
 		14BD5A2D0A3E91F600BAF59C /* testapi.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = testapi.c; path = API/tests/testapi.c; sourceTree = "<group>"; };
 		14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakGCMap.h; sourceTree = "<group>"; };
-		14C824AA12F7C77E008F35E0 /* MarkedBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedBlock.cpp; sourceTree = "<group>"; };
-		14C824AC12F7C785008F35E0 /* MarkedBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedBlock.h; sourceTree = "<group>"; };
 		14D792640DAA03FB001A9F05 /* RegisterFile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegisterFile.h; sourceTree = "<group>"; };
 		14D857740A4696C80032146C /* testapi.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = testapi.js; path = API/tests/testapi.js; sourceTree = "<group>"; };
 		14DA818E0D99FD2000B0A4FB /* JSActivation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSActivation.h; sourceTree = "<group>"; };
 		14DA818F0D99FD2000B0A4FB /* JSActivation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSActivation.cpp; sourceTree = "<group>"; };
 		14DE0D680D02431400AACCA2 /* JSGlobalObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObject.cpp; sourceTree = "<group>"; };
 		14F252560D08DD8D004ECFFF /* JSVariableObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSVariableObject.h; sourceTree = "<group>"; };
+		14FB986B135225410085A5DB /* Heap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Heap.cpp; sourceTree = "<group>"; };
+		14FB986C135225410085A5DB /* Heap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Heap.h; sourceTree = "<group>"; };
 		14FFF98A12BFFF7500795BB8 /* PageAllocationAligned.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageAllocationAligned.cpp; sourceTree = "<group>"; };
 		14FFF98B12BFFF7500795BB8 /* PageAllocationAligned.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageAllocationAligned.h; sourceTree = "<group>"; };
 		180B9AEF0F16C569009BDBC5 /* CurrentTime.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CurrentTime.cpp; sourceTree = "<group>"; };
@@ -840,6 +884,9 @@
 		65EA73620BAE35D1001BB560 /* CommonIdentifiers.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CommonIdentifiers.cpp; sourceTree = "<group>"; };
 		65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CommonIdentifiers.h; sourceTree = "<group>"; };
 		704FD35305697E6D003DBED9 /* BooleanObject.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = BooleanObject.h; sourceTree = "<group>"; tabWidth = 8; };
+		7186A6E813100B57004479E1 /* HexNumber.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HexNumber.h; sourceTree = "<group>"; };
+		76FB9F0E12E851860051A2EB /* SHA1.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SHA1.h; sourceTree = "<group>"; };
+		76FB9F1012E851960051A2EB /* SHA1.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SHA1.cpp; sourceTree = "<group>"; };
 		7E2C6C980D31C6B6002D44E2 /* ScopeChainMark.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScopeChainMark.h; sourceTree = "<group>"; };
 		7E4EE7080EBB7963005934AA /* StructureChain.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureChain.h; sourceTree = "<group>"; };
 		7E4EE70E0EBB7A5B005934AA /* StructureChain.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureChain.cpp; sourceTree = "<group>"; };
@@ -855,6 +902,7 @@
 		86438FC31265503E00E0DFCA /* StringBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = StringBuilder.cpp; path = text/StringBuilder.cpp; sourceTree = "<group>"; };
 		86565740115BE3DA00291F40 /* CString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CString.cpp; path = text/CString.cpp; sourceTree = "<group>"; };
 		86565741115BE3DA00291F40 /* CString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CString.h; path = text/CString.h; sourceTree = "<group>"; };
+		865A30F0135007E100CDB49E /* JSValueInlineMethods.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSValueInlineMethods.h; sourceTree = "<group>"; };
 		865F408710E7D56300947361 /* APIShims.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = APIShims.h; sourceTree = "<group>"; };
 		86676D4D11FED55D004B6863 /* BumpPointerAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BumpPointerAllocator.h; sourceTree = "<group>"; };
 		86704B4012DB8A8100A9FE7B /* YarrSyntaxChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = YarrSyntaxChecker.cpp; path = yarr/YarrSyntaxChecker.cpp; sourceTree = "<group>"; };
@@ -910,6 +958,25 @@
 		86DB64630F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocatorFixedVMPool.cpp; sourceTree = "<group>"; };
 		86E116B00FE75AC800B512BC /* CodeLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeLocation.h; sourceTree = "<group>"; };
 		86E85538111B9968001AF51E /* JSStringBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStringBuilder.h; sourceTree = "<group>"; };
+		86EC9DB41328DF82002B2AD7 /* DFGByteCodeParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGByteCodeParser.cpp; path = dfg/DFGByteCodeParser.cpp; sourceTree = "<group>"; };
+		86EC9DB51328DF82002B2AD7 /* DFGByteCodeParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGByteCodeParser.h; path = dfg/DFGByteCodeParser.h; sourceTree = "<group>"; };
+		86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGGenerationInfo.h; path = dfg/DFGGenerationInfo.h; sourceTree = "<group>"; };
+		86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGGraph.cpp; path = dfg/DFGGraph.cpp; sourceTree = "<group>"; };
+		86EC9DB81328DF82002B2AD7 /* DFGGraph.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGGraph.h; path = dfg/DFGGraph.h; sourceTree = "<group>"; };
+		86EC9DB91328DF82002B2AD7 /* DFGJITCodeGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGJITCodeGenerator.cpp; path = dfg/DFGJITCodeGenerator.cpp; sourceTree = "<group>"; };
+		86EC9DBA1328DF82002B2AD7 /* DFGJITCodeGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGJITCodeGenerator.h; path = dfg/DFGJITCodeGenerator.h; sourceTree = "<group>"; };
+		86EC9DBB1328DF82002B2AD7 /* DFGJITCompiler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGJITCompiler.cpp; path = dfg/DFGJITCompiler.cpp; sourceTree = "<group>"; };
+		86EC9DBC1328DF82002B2AD7 /* DFGJITCompiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGJITCompiler.h; path = dfg/DFGJITCompiler.h; sourceTree = "<group>"; };
+		86EC9DBD1328DF82002B2AD7 /* DFGNonSpeculativeJIT.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGNonSpeculativeJIT.cpp; path = dfg/DFGNonSpeculativeJIT.cpp; sourceTree = "<group>"; };
+		86EC9DBE1328DF82002B2AD7 /* DFGNonSpeculativeJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNonSpeculativeJIT.h; path = dfg/DFGNonSpeculativeJIT.h; sourceTree = "<group>"; };
+		86EC9DBF1328DF82002B2AD7 /* DFGOperations.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOperations.cpp; path = dfg/DFGOperations.cpp; sourceTree = "<group>"; };
+		86EC9DC01328DF82002B2AD7 /* DFGOperations.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOperations.h; path = dfg/DFGOperations.h; sourceTree = "<group>"; };
+		86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGRegisterBank.h; path = dfg/DFGRegisterBank.h; sourceTree = "<group>"; };
+		86EC9DC21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSpeculativeJIT.cpp; path = dfg/DFGSpeculativeJIT.cpp; sourceTree = "<group>"; };
+		86EC9DC31328DF82002B2AD7 /* DFGSpeculativeJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSpeculativeJIT.h; path = dfg/DFGSpeculativeJIT.h; sourceTree = "<group>"; };
+		86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNode.h; path = dfg/DFGNode.h; sourceTree = "<group>"; };
+		86ECA3F9132DF25A002B2AD7 /* DFGScoreBoard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGScoreBoard.h; path = dfg/DFGScoreBoard.h; sourceTree = "<group>"; };
+		86ECA4F0132EAA6D002B2AD7 /* DFGAliasTracker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAliasTracker.h; path = dfg/DFGAliasTracker.h; sourceTree = "<group>"; };
 		86F38858121130CA007A7CE3 /* AtomicStringHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AtomicStringHash.h; path = text/AtomicStringHash.h; sourceTree = "<group>"; };
 		90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MemoryStatistics.cpp; sourceTree = "<group>"; };
 		90213E3C123A40C200D422F3 /* MemoryStatistics.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryStatistics.h; sourceTree = "<group>"; };
@@ -999,6 +1066,7 @@
 		A1712B3A11C7B212007A5315 /* RegExpCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpCache.cpp; sourceTree = "<group>"; };
 		A1712B3E11C7B228007A5315 /* RegExpCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpCache.h; sourceTree = "<group>"; };
 		A1712B4011C7B235007A5315 /* RegExpKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpKey.h; sourceTree = "<group>"; };
+		A1D764511354448B00C5C7C0 /* Alignment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Alignment.h; sourceTree = "<group>"; };
 		A71236E41195F33C00BD2174 /* JITOpcodes32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITOpcodes32_64.cpp; sourceTree = "<group>"; };
 		A718F61A11754A21002465A7 /* RegExpJitTables.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpJitTables.h; sourceTree = "<group>"; };
 		A718F8211178EB4B002465A7 /* create_regex_tables */ = {isa = PBXFileReference; explicitFileType = text.script.python; fileEncoding = 4; path = create_regex_tables; sourceTree = "<group>"; };
@@ -1015,12 +1083,9 @@
 		A7482B791166CDEA003B0712 /* JSWeakObjectMapRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWeakObjectMapRefPrivate.h; sourceTree = "<group>"; };
 		A7482B7A1166CDEA003B0712 /* JSWeakObjectMapRefPrivate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWeakObjectMapRefPrivate.cpp; sourceTree = "<group>"; };
 		A7482E37116A697B003B0712 /* JSWeakObjectMapRefInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWeakObjectMapRefInternal.h; sourceTree = "<group>"; };
-		A74B3498102A5F8E0032AB98 /* MarkStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStack.cpp; sourceTree = "<group>"; };
 		A74DE1CB120B86D600D40D5B /* ARMv7Assembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ARMv7Assembler.cpp; sourceTree = "<group>"; };
 		A75706DD118A2BCF0057F88F /* JITArithmetic32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITArithmetic32_64.cpp; sourceTree = "<group>"; };
 		A76C51741182748D00715B05 /* JSInterfaceJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInterfaceJIT.h; sourceTree = "<group>"; };
-		A76EE6580FAE59D5003F069A /* NativeFunctionWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NativeFunctionWrapper.h; sourceTree = "<group>"; };
-		A779558F101A74D500114E55 /* MarkStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkStack.h; sourceTree = "<group>"; };
 		A783A0D011A36DCA00563D20 /* JSObjectWithGlobalObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObjectWithGlobalObject.h; sourceTree = "<group>"; };
 		A783A2AA11A5BE8400563D20 /* JSObjectWithGlobalObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSObjectWithGlobalObject.cpp; sourceTree = "<group>"; };
 		A791EF260F11E07900AE1F68 /* JSByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSByteArray.h; sourceTree = "<group>"; };
@@ -1035,7 +1100,9 @@
 		A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutableAllocator.h; sourceTree = "<group>"; };
 		A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocator.cpp; sourceTree = "<group>"; };
 		A7C1E8C8112E701C00A37F98 /* JITPropertyAccess32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITPropertyAccess32_64.cpp; sourceTree = "<group>"; };
-		A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStackPosix.cpp; sourceTree = "<group>"; };
+		A7C40C07130B057D00D002A1 /* BlockStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BlockStack.h; sourceTree = "<group>"; };
+		A7C40C08130B057D00D002A1 /* SentinelLinkedList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SentinelLinkedList.h; sourceTree = "<group>"; };
+		A7C40C09130B057D00D002A1 /* SinglyLinkedList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SinglyLinkedList.h; sourceTree = "<group>"; };
 		A7D649A91015224E009B2E1B /* PossiblyNull.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PossiblyNull.h; sourceTree = "<group>"; };
 		A7DCB77912E3D90500911940 /* WriteBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrier.h; sourceTree = "<group>"; };
 		A7E2EA690FB460CF00601F06 /* LiteralParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LiteralParser.h; sourceTree = "<group>"; };
@@ -1065,7 +1132,6 @@
 		BC02E98B0E183E38000F9297 /* ErrorInstance.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ErrorInstance.h; sourceTree = "<group>"; };
 		BC02E9B60E1842FA000F9297 /* JSString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSString.cpp; sourceTree = "<group>"; };
 		BC02E9B80E184545000F9297 /* GetterSetter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetterSetter.cpp; sourceTree = "<group>"; };
-		BC02E9B90E184580000F9297 /* JSNumberCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNumberCell.cpp; sourceTree = "<group>"; };
 		BC0894D50FAFBA2D00001865 /* JSAPIValueWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSAPIValueWrapper.cpp; path = ../runtime/JSAPIValueWrapper.cpp; sourceTree = "<group>"; };
 		BC0894D60FAFBA2D00001865 /* JSAPIValueWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSAPIValueWrapper.h; path = ../runtime/JSAPIValueWrapper.h; sourceTree = "<group>"; };
 		BC1166000E1997B1008066DD /* DateInstance.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DateInstance.cpp; sourceTree = "<group>"; };
@@ -1089,10 +1155,6 @@
 		BC22A39A0E16E14800AF21C8 /* JSVariableObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSVariableObject.cpp; sourceTree = "<group>"; };
 		BC257DE50E1F51C50016B6C9 /* Arguments.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Arguments.cpp; sourceTree = "<group>"; };
 		BC257DE60E1F51C50016B6C9 /* Arguments.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Arguments.h; sourceTree = "<group>"; };
-		BC257DED0E1F52ED0016B6C9 /* GlobalEvalFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GlobalEvalFunction.cpp; sourceTree = "<group>"; };
-		BC257DEE0E1F52ED0016B6C9 /* GlobalEvalFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GlobalEvalFunction.h; sourceTree = "<group>"; };
-		BC257DF10E1F53740016B6C9 /* PrototypeFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PrototypeFunction.cpp; sourceTree = "<group>"; };
-		BC257DF20E1F53740016B6C9 /* PrototypeFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PrototypeFunction.h; sourceTree = "<group>"; };
 		BC2680C00E16D4E900A06E92 /* FunctionConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionConstructor.cpp; sourceTree = "<group>"; };
 		BC2680C10E16D4E900A06E92 /* FunctionConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FunctionConstructor.h; sourceTree = "<group>"; };
 		BC2680C20E16D4E900A06E92 /* NumberConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NumberConstructor.cpp; sourceTree = "<group>"; };
@@ -1111,7 +1173,7 @@
 		BC337BEA0E1B00CB0076918A /* Error.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Error.cpp; sourceTree = "<group>"; };
 		BC5F7BBB11823B590052C02C /* Atomics.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Atomics.h; sourceTree = "<group>"; };
 		BC5F7BBC11823B590052C02C /* ThreadingPrimitives.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadingPrimitives.h; sourceTree = "<group>"; };
-		BC5F7BBD11823B590052C02C /* ThreadSafeShared.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadSafeShared.h; sourceTree = "<group>"; };
+		BC5F7BBD11823B590052C02C /* ThreadSafeRefCounted.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadSafeRefCounted.h; sourceTree = "<group>"; };
 		BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassInfo.h; sourceTree = "<group>"; };
 		BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectFunctions.cpp; sourceTree = "<group>"; };
 		BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectFunctions.h; sourceTree = "<group>"; };
@@ -1121,7 +1183,6 @@
 		BC7952330E15EB5600A898AB /* BooleanConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BooleanConstructor.h; sourceTree = "<group>"; };
 		BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BooleanPrototype.cpp; sourceTree = "<group>"; };
 		BC7952350E15EB5600A898AB /* BooleanPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BooleanPrototype.h; sourceTree = "<group>"; };
-		BC7F8FB80E19D1C3008632C0 /* JSNumberCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNumberCell.h; sourceTree = "<group>"; };
 		BC7F8FBA0E19D1EF008632C0 /* JSCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCell.cpp; sourceTree = "<group>"; };
 		BC8149AF12F89F53007B2C32 /* HeaderDetection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeaderDetection.h; sourceTree = "<group>"; };
 		BC87CDB810712ACA000614CF /* JSONObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSONObject.lut.h; sourceTree = "<group>"; };
@@ -1155,9 +1216,9 @@
 		C0A2723F0E509F1E00E96E15 /* NotFound.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NotFound.h; sourceTree = "<group>"; };
 		D21202280AD4310C00ED79B6 /* DateConversion.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = DateConversion.cpp; sourceTree = "<group>"; };
 		D21202290AD4310C00ED79B6 /* DateConversion.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DateConversion.h; sourceTree = "<group>"; };
+		D75AF59512F8CB9500FC0ADF /* DynamicAnnotations.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DynamicAnnotations.cpp; sourceTree = "<group>"; };
+		D75AF59612F8CB9500FC0ADF /* DynamicAnnotations.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DynamicAnnotations.h; sourceTree = "<group>"; };
 		DD377CBB12072C18006A2517 /* Bitmap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Bitmap.h; sourceTree = "<group>"; };
-		DDE82AD11209D955005C1756 /* GCHandle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCHandle.cpp; sourceTree = "<group>"; };
-		DDE82AD21209D955005C1756 /* GCHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCHandle.h; sourceTree = "<group>"; };
 		DDF7ABD211F60ED200108E36 /* GCActivityCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCActivityCallback.h; sourceTree = "<group>"; };
 		DDF7ABD311F60ED200108E36 /* GCActivityCallbackCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCActivityCallbackCF.cpp; sourceTree = "<group>"; };
 		E11D51750B2E798D0056C188 /* StringExtras.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringExtras.h; sourceTree = "<group>"; };
@@ -1248,9 +1309,9 @@
 			buildActionMask = 2147483647;
 			files = (
 				932F5BD30822A1C700736975 /* CoreFoundation.framework in Frameworks */,
-				932F5BD50822A1C700736975 /* Foundation.framework in Frameworks */,
 				932F5BD70822A1C700736975 /* libicucore.dylib in Frameworks */,
 				932F5BD60822A1C700736975 /* libobjc.dylib in Frameworks */,
+				A731B25A130093880040A7FA /* Foundation.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -1304,6 +1365,8 @@
 				969A078F0ED1D3AE00F1F681 /* bytecode */,
 				7E39D81D0EC38EFA003AF11A /* bytecompiler */,
 				1480DB9A0DDC2231003CFDF2 /* debugger */,
+				86EC9DB31328DF44002B2AD7 /* dfg */,
+				142E312A134FF0A600AFADB5 /* heap */,
 				1429D77A0ED20D7300B89619 /* interpreter */,
 				1429D92C0ED22D7000B89619 /* jit */,
 				7E39D8370EC3A388003AF11A /* parser */,
@@ -1392,6 +1455,35 @@
 			path = jit;
 			sourceTree = "<group>";
 		};
+		142E312A134FF0A600AFADB5 /* heap */ = {
+			isa = PBXGroup;
+			children = (
+				146B14DB12EB5B12001BEC1B /* ConservativeRoots.cpp */,
+				149DAAF212EB559D0083B12B /* ConservativeRoots.h */,
+				142E312B134FF0A600AFADB5 /* Handle.h */,
+				142E312C134FF0A600AFADB5 /* HandleHeap.cpp */,
+				142E312D134FF0A600AFADB5 /* HandleHeap.h */,
+				142E312E134FF0A600AFADB5 /* HandleStack.cpp */,
+				142E312F134FF0A600AFADB5 /* HandleStack.h */,
+				14FB986B135225410085A5DB /* Heap.cpp */,
+				14FB986C135225410085A5DB /* Heap.h */,
+				142E3130134FF0A600AFADB5 /* Local.h */,
+				142E3131134FF0A600AFADB5 /* LocalScope.h */,
+				14B7233F12D7D0DA003BD5ED /* MachineStackMarker.cpp */,
+				14B7234012D7D0DA003BD5ED /* MachineStackMarker.h */,
+				142D6F0613539A2800B02E86 /* MarkedBlock.cpp */,
+				142D6F0713539A2800B02E86 /* MarkedBlock.h */,
+				142D6F0A13539A2F00B02E86 /* MarkedSpace.cpp */,
+				142D6F0B13539A2F00B02E86 /* MarkedSpace.h */,
+				142D6F0E13539A4100B02E86 /* MarkStack.cpp */,
+				142D6F0F13539A4100B02E86 /* MarkStack.h */,
+				142D6F1013539A4100B02E86 /* MarkStackPosix.cpp */,
+				142E3132134FF0A600AFADB5 /* Strong.h */,
+				142E3133134FF0A600AFADB5 /* Weak.h */,
+			);
+			path = heap;
+			sourceTree = "<group>";
+		};
 		1432EBD70A34CAD400717B9F /* API */ = {
 			isa = PBXGroup;
 			children = (
@@ -1510,6 +1602,10 @@
 		65162EF108E6A21C007556CD /* wtf */ = {
 			isa = PBXGroup;
 			children = (
+				A1D764511354448B00C5C7C0 /* Alignment.h */,
+				A7C40C07130B057D00D002A1 /* BlockStack.h */,
+				A7C40C08130B057D00D002A1 /* SentinelLinkedList.h */,
+				A7C40C09130B057D00D002A1 /* SinglyLinkedList.h */,
 				5135FAD512D26856003C083B /* Decoder.h */,
 				5135FAD612D26856003C083B /* Encoder.h */,
 				93AA4F770957251F0084B3A7 /* AlwaysInline.h */,
@@ -1534,8 +1630,11 @@
 				862AF4B512239C7B0024E5B8 /* DecimalNumber.h */,
 				5186111D0CC824830081412B /* Deque.h */,
 				938C4F6B0CA06BCE00D9310A /* DisallowCType.h */,
+				14456A311314657800212CA3 /* DoublyLinkedList.h */,
 				651F6412039D5B5F0078395C /* dtoa.cpp */,
 				651F6413039D5B5F0078395C /* dtoa.h */,
+				D75AF59512F8CB9500FC0ADF /* DynamicAnnotations.cpp */,
+				D75AF59612F8CB9500FC0ADF /* DynamicAnnotations.h */,
 				E48E0F2C0F82151700A8CA37 /* FastAllocBase.h */,
 				65E217B908E7EECC0023E5F6 /* FastMalloc.cpp */,
 				65E217BA08E7EECC0023E5F6 /* FastMalloc.h */,
@@ -1550,6 +1649,7 @@
 				65DFC92D08EA173A00F7300B /* HashTable.cpp */,
 				65DFC92E08EA173A00F7300B /* HashTable.h */,
 				65DFC92F08EA173A00F7300B /* HashTraits.h */,
+				7186A6E813100B57004479E1 /* HexNumber.h */,
 				657EB7450B708F540063461B /* ListHashSet.h */,
 				148A1626095D16BB00666D0D /* ListRefPtr.h */,
 				E1EE79270D6C964500FEA3BA /* Locker.h */,
@@ -1596,6 +1696,8 @@
 				148A1ECD0D10C23B0069A47C /* RefPtrHashMap.h */,
 				51F648D60BB4E2CA0033D760 /* RetainPtr.h */,
 				969A07290ED1CE6900F1F681 /* SegmentedVector.h */,
+				76FB9F1012E851960051A2EB /* SHA1.cpp */,
+				76FB9F0E12E851860051A2EB /* SHA1.h */,
 				0BF28A2811A33DC300638F84 /* SizeLimits.cpp */,
 				86D87DA512BC4B14008E73A1 /* StackBounds.cpp */,
 				86D87DA612BC4B14008E73A1 /* StackBounds.h */,
@@ -1615,7 +1717,7 @@
 				E1EE79220D6C95CD00FEA3BA /* Threading.h */,
 				BC5F7BBC11823B590052C02C /* ThreadingPrimitives.h */,
 				E1EE793C0D6C9B9200FEA3BA /* ThreadingPthreads.cpp */,
-				BC5F7BBD11823B590052C02C /* ThreadSafeShared.h */,
+				BC5F7BBD11823B590052C02C /* ThreadSafeRefCounted.h */,
 				E1B7C8BD0DA3A3360074B0DC /* ThreadSpecific.h */,
 				0B330C260F38C62300692DE3 /* TypeTraits.cpp */,
 				0B4D7E620F319AC800AD7E58 /* TypeTraits.h */,
@@ -1701,8 +1803,6 @@
 				65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */,
 				969A09220ED1E09C00F1F681 /* Completion.cpp */,
 				F5BB2BC5030F772101FCFE1D /* Completion.h */,
-				146B14DB12EB5B12001BEC1B /* ConservativeSet.cpp */,
-				149DAAF212EB559D0083B12B /* ConservativeSet.h */,
 				BCA62DFF0E2826310004F30D /* ConstructData.cpp */,
 				BC8F3CCF0DAF17BA00577A80 /* ConstructData.h */,
 				BCD203450E17135E002C7E82 /* DateConstructor.cpp */,
@@ -1732,14 +1832,8 @@
 				F692A85D0255597D01FF60F7 /* FunctionPrototype.h */,
 				DDF7ABD211F60ED200108E36 /* GCActivityCallback.h */,
 				DDF7ABD311F60ED200108E36 /* GCActivityCallbackCF.cpp */,
-				DDE82AD11209D955005C1756 /* GCHandle.cpp */,
-				DDE82AD21209D955005C1756 /* GCHandle.h */,
 				BC02E9B80E184545000F9297 /* GetterSetter.cpp */,
 				BC337BDE0E1AF0B80076918A /* GetterSetter.h */,
-				BC257DED0E1F52ED0016B6C9 /* GlobalEvalFunction.cpp */,
-				BC257DEE0E1F52ED0016B6C9 /* GlobalEvalFunction.h */,
-				140CDE6C12DE977E0013CFC5 /* Heap.cpp */,
-				140CDE6D12DE977E0013CFC5 /* Heap.h */,
 				933A349D038AE80F008635CE /* Identifier.cpp */,
 				933A349A038AE7C6008635CE /* Identifier.h */,
 				E178636C0D9BEEC300D74E75 /* InitializeThreading.cpp */,
@@ -1762,14 +1856,11 @@
 				A8E894330CD0603F00367179 /* JSGlobalObject.h */,
 				BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */,
 				BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */,
-				14760863099C633800437128 /* JSImmediate.cpp */,
 				1483B589099BC1950016E4F0 /* JSImmediate.h */,
 				65EA4C99092AF9E20093D800 /* JSLock.cpp */,
 				65EA4C9A092AF9E20093D800 /* JSLock.h */,
 				A72700780DAC605600E548D7 /* JSNotAnObject.cpp */,
 				A72700770DAC605600E548D7 /* JSNotAnObject.h */,
-				BC02E9B90E184580000F9297 /* JSNumberCell.cpp */,
-				BC7F8FB80E19D1C3008632C0 /* JSNumberCell.h */,
 				BC22A3980E16E14800AF21C8 /* JSObject.cpp */,
 				BC22A3990E16E14800AF21C8 /* JSObject.h */,
 				A783A2AA11A5BE8400563D20 /* JSObjectWithGlobalObject.cpp */,
@@ -1787,6 +1878,7 @@
 				6507D2970E871E4A00D7D896 /* JSTypeInfo.h */,
 				F692A8870255597D01FF60F7 /* JSValue.cpp */,
 				14ABB36E099C076400E2A24F /* JSValue.h */,
+				865A30F0135007E100CDB49E /* JSValueInlineMethods.h */,
 				BC22A39A0E16E14800AF21C8 /* JSVariableObject.cpp */,
 				14F252560D08DD8D004ECFFF /* JSVariableObject.h */,
 				65C7A1710A8EAACB00FA37EA /* JSWrapperObject.cpp */,
@@ -1797,15 +1889,6 @@
 				A7E2EA690FB460CF00601F06 /* LiteralParser.h */,
 				F692A8680255597D01FF60F7 /* Lookup.cpp */,
 				F692A8690255597D01FF60F7 /* Lookup.h */,
-				14B7233F12D7D0DA003BD5ED /* MachineStackMarker.cpp */,
-				14B7234012D7D0DA003BD5ED /* MachineStackMarker.h */,
-				14C824AA12F7C77E008F35E0 /* MarkedBlock.cpp */,
-				14C824AC12F7C785008F35E0 /* MarkedBlock.h */,
-				140CDC7612DBEA330013CFC5 /* MarkedSpace.cpp */,
-				140CDC7712DBEA330013CFC5 /* MarkedSpace.h */,
-				A74B3498102A5F8E0032AB98 /* MarkStack.cpp */,
-				A779558F101A74D500114E55 /* MarkStack.h */,
-				A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */,
 				F692A86A0255597D01FF60F7 /* MathObject.cpp */,
 				F692A86B0255597D01FF60F7 /* MathObject.h */,
 				90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */,
@@ -1814,7 +1897,6 @@
 				BC02E9090E1839DB000F9297 /* NativeErrorConstructor.h */,
 				BC02E90A0E1839DB000F9297 /* NativeErrorPrototype.cpp */,
 				BC02E90B0E1839DB000F9297 /* NativeErrorPrototype.h */,
-				A76EE6580FAE59D5003F069A /* NativeFunctionWrapper.h */,
 				BC2680C20E16D4E900A06E92 /* NumberConstructor.cpp */,
 				BC2680C30E16D4E900A06E92 /* NumberConstructor.h */,
 				F692A8700255597D01FF60F7 /* NumberObject.cpp */,
@@ -1836,8 +1918,6 @@
 				65621E6B089E859700760F35 /* PropertySlot.cpp */,
 				65621E6C089E859700760F35 /* PropertySlot.h */,
 				65C02FBB0637462A003E7EE6 /* Protect.h */,
-				BC257DF10E1F53740016B6C9 /* PrototypeFunction.cpp */,
-				BC257DF20E1F53740016B6C9 /* PrototypeFunction.h */,
 				147B84620E6DE6B1004775A4 /* PutPropertySlot.h */,
 				F692A87D0255597D01FF60F7 /* RegExp.cpp */,
 				F692A87E0255597D01FF60F7 /* RegExp.h */,
@@ -1885,7 +1965,6 @@
 				08DDA5BB12645F1D00751732 /* UStringBuilder.h */,
 				0896C29B1265AAF600B1CDD3 /* UStringConcatenate.h */,
 				14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */,
-				14035DB010DBFB2A00FFFFE7 /* WeakGCPtr.h */,
 				1420BE7A10AA6DDB00F455D2 /* WeakRandom.h */,
 				A7DCB77912E3D90500911940 /* WriteBarrier.h */,
 			);
@@ -1934,6 +2013,32 @@
 			name = yarr;
 			sourceTree = "<group>";
 		};
+		86EC9DB31328DF44002B2AD7 /* dfg */ = {
+			isa = PBXGroup;
+			children = (
+				86ECA4F0132EAA6D002B2AD7 /* DFGAliasTracker.h */,
+				86EC9DB41328DF82002B2AD7 /* DFGByteCodeParser.cpp */,
+				86EC9DB51328DF82002B2AD7 /* DFGByteCodeParser.h */,
+				86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */,
+				86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */,
+				86EC9DB81328DF82002B2AD7 /* DFGGraph.h */,
+				86EC9DB91328DF82002B2AD7 /* DFGJITCodeGenerator.cpp */,
+				86EC9DBA1328DF82002B2AD7 /* DFGJITCodeGenerator.h */,
+				86EC9DBB1328DF82002B2AD7 /* DFGJITCompiler.cpp */,
+				86EC9DBC1328DF82002B2AD7 /* DFGJITCompiler.h */,
+				86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */,
+				86EC9DBD1328DF82002B2AD7 /* DFGNonSpeculativeJIT.cpp */,
+				86EC9DBE1328DF82002B2AD7 /* DFGNonSpeculativeJIT.h */,
+				86EC9DBF1328DF82002B2AD7 /* DFGOperations.cpp */,
+				86EC9DC01328DF82002B2AD7 /* DFGOperations.h */,
+				86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */,
+				86ECA3F9132DF25A002B2AD7 /* DFGScoreBoard.h */,
+				86EC9DC21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp */,
+				86EC9DC31328DF82002B2AD7 /* DFGSpeculativeJIT.h */,
+			);
+			name = dfg;
+			sourceTree = "<group>";
+		};
 		932FC3C20824BB70005B3C75 /* Resources */ = {
 			isa = PBXGroup;
 			children = (
@@ -2082,7 +2187,6 @@
 				144007570A5370D20005F061 /* JSNodeList.h in Headers */,
 				144005CC0A5338F80005F061 /* Node.h in Headers */,
 				1440074A0A536CC20005F061 /* NodeList.h in Headers */,
-				DDE82AD61209D955005C1756 /* GCHandle.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2113,6 +2217,8 @@
 				BC18C3EB0E16F5CD00B34460 /* AVLTree.h in Headers */,
 				147B83AC0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h in Headers */,
 				DD377CBC12072C18006A2517 /* Bitmap.h in Headers */,
+				A7C40C0A130B057D00D002A1 /* BlockStack.h in Headers */,
+				E4D8CEFB12FC439600BC9F5A /* BloomFilter.h in Headers */,
 				BC18C3EC0E16F5CD00B34460 /* BooleanObject.h in Headers */,
 				86676D5211FED9BC004B6863 /* BumpPointerAllocator.h in Headers */,
 				A7A1F7AD0F252B3C00E184E2 /* ByteArray.h in Headers */,
@@ -2130,8 +2236,10 @@
 				BC18C3F40E16F5CD00B34460 /* Completion.h in Headers */,
 				FDA15C1E12B0305C003A583A /* Complex.h in Headers */,
 				BC18C3F50E16F5CD00B34460 /* config.h in Headers */,
+				144836E7132DA7BE005BE785 /* ConservativeRoots.h in Headers */,
 				BC18C3F60E16F5CD00B34460 /* ConstructData.h in Headers */,
 				0BDFFAE00FC6192900D69EF4 /* CrossThreadRefCounted.h in Headers */,
+				97941A7F1302A098004A3447 /* CryptographicallyRandomNumber.h in Headers */,
 				86565743115BE3DA00291F40 /* CString.h in Headers */,
 				180B9B080F16D94F009BDBC5 /* CurrentTime.h in Headers */,
 				BCD2034A0E17135E002C7E82 /* DateConstructor.h in Headers */,
@@ -2147,8 +2255,24 @@
 				862AF4B612239C7B0024E5B8 /* DecimalNumber.h in Headers */,
 				5135FAF212D26ACE003C083B /* Decoder.h in Headers */,
 				BC18C3FC0E16F5CD00B34460 /* Deque.h in Headers */,
+				86ECA4F1132EAA6D002B2AD7 /* DFGAliasTracker.h in Headers */,
+				86EC9DC51328DF82002B2AD7 /* DFGByteCodeParser.h in Headers */,
+				86EC9DC61328DF82002B2AD7 /* DFGGenerationInfo.h in Headers */,
+				86EC9DC81328DF82002B2AD7 /* DFGGraph.h in Headers */,
+				86EC9DCA1328DF82002B2AD7 /* DFGJITCodeGenerator.h in Headers */,
+				86EC9DCC1328DF82002B2AD7 /* DFGJITCompiler.h in Headers */,
+				86ECA3EA132DEF1C002B2AD7 /* DFGNode.h in Headers */,
+				86EC9DCE1328DF82002B2AD7 /* DFGNonSpeculativeJIT.h in Headers */,
+				142E3136134FF0A600AFADB5 /* HandleHeap.h in Headers */,
+				142E3138134FF0A600AFADB5 /* HandleStack.h in Headers */,
+				86EC9DD01328DF82002B2AD7 /* DFGOperations.h in Headers */,
+				86EC9DD11328DF82002B2AD7 /* DFGRegisterBank.h in Headers */,
+				86ECA3FA132DF25A002B2AD7 /* DFGScoreBoard.h in Headers */,
+				86EC9DD31328DF82002B2AD7 /* DFGSpeculativeJIT.h in Headers */,
 				BC18C3FD0E16F5CD00B34460 /* DisallowCType.h in Headers */,
+				14456A321314657800212CA3 /* DoublyLinkedList.h in Headers */,
 				BC18C3FE0E16F5CD00B34460 /* dtoa.h in Headers */,
+				D7A46A4F1338FFEA00ED695C /* DynamicAnnotations.h in Headers */,
 				5135FAF312D26AD1003C083B /* Encoder.h in Headers */,
 				BC3046070E1F497F003232CF /* Error.h in Headers */,
 				BC02E90D0E1839DB000F9297 /* ErrorConstructor.h in Headers */,
@@ -2165,17 +2289,16 @@
 				BC18C4040E16F5CD00B34460 /* FunctionConstructor.h in Headers */,
 				BC18C4050E16F5CD00B34460 /* FunctionPrototype.h in Headers */,
 				DDF7ABD411F60ED200108E36 /* GCActivityCallback.h in Headers */,
-				DDE82AD81209D955005C1756 /* GCHandle.h in Headers */,
 				BC18C4060E16F5CD00B34460 /* GetPtr.h in Headers */,
-				BC257DF00E1F52ED0016B6C9 /* GlobalEvalFunction.h in Headers */,
 				BC18C4080E16F5CD00B34460 /* HashCountedSet.h in Headers */,
 				BC18C4090E16F5CD00B34460 /* HashFunctions.h in Headers */,
 				BC18C40A0E16F5CD00B34460 /* HashIterators.h in Headers */,
 				BC18C40B0E16F5CD00B34460 /* HashMap.h in Headers */,
 				BC18C40C0E16F5CD00B34460 /* HashSet.h in Headers */,
 				BC18C40D0E16F5CD00B34460 /* HashTable.h in Headers */,
+				142E3134134FF0A600AFADB5 /* Handle.h in Headers */,
 				BC18C40E0E16F5CD00B34460 /* HashTraits.h in Headers */,
-				140CDE7112DE97B10013CFC5 /* Heap.h in Headers */,
+				7186A6EC13100BA5004479E1 /* HexNumber.h in Headers */,
 				BC18C40F0E16F5CD00B34460 /* Identifier.h in Headers */,
 				BC18C4100E16F5CD00B34460 /* InitializeThreading.h in Headers */,
 				969A07990ED1D3AE00F1F681 /* Instruction.h in Headers */,
@@ -2207,10 +2330,8 @@
 				BC18C4200E16F5CD00B34460 /* JSGlobalData.h in Headers */,
 				BC18C4210E16F5CD00B34460 /* JSGlobalObject.h in Headers */,
 				BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */,
-				BC18C4220E16F5CD00B34460 /* JSImmediate.h in Headers */,
 				A76C51761182748D00715B05 /* JSInterfaceJIT.h in Headers */,
 				BC18C4230E16F5CD00B34460 /* JSLock.h in Headers */,
-				BC7F8FB90E19D1C3008632C0 /* JSNumberCell.h in Headers */,
 				BC18C4240E16F5CD00B34460 /* JSObject.h in Headers */,
 				BC18C4250E16F5CD00B34460 /* JSObjectRef.h in Headers */,
 				A7280A2811557E3000D56957 /* JSObjectRefPrivate.h in Headers */,
@@ -2242,6 +2363,8 @@
 				BC18C4340E16F5CD00B34460 /* ListHashSet.h in Headers */,
 				BC18C4350E16F5CD00B34460 /* ListRefPtr.h in Headers */,
 				A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */,
+				142E3139134FF0A600AFADB5 /* Local.h in Headers */,
+				142E313A134FF0A600AFADB5 /* LocalScope.h in Headers */,
 				BC18C4360E16F5CD00B34460 /* Locker.h in Headers */,
 				BC18C4370E16F5CD00B34460 /* Lookup.h in Headers */,
 				14B723B812D7DA6F003BD5ED /* MachineStackMarker.h in Headers */,
@@ -2255,8 +2378,6 @@
 				860161E60F3A83C100F84710 /* MacroAssemblerX86Common.h in Headers */,
 				BC18C4390E16F5CD00B34460 /* MainThread.h in Headers */,
 				BC18C43A0E16F5CD00B34460 /* MallocZoneSupport.h in Headers */,
-				140CDF0C12DECE5C0013CFC5 /* MarkedSpace.h in Headers */,
-				A7795590101A74D500114E55 /* MarkStack.h in Headers */,
 				BC18C43B0E16F5CD00B34460 /* MathExtras.h in Headers */,
 				BC18C43C0E16F5CD00B34460 /* MathObject.h in Headers */,
 				BC18C52A0E16FCC200B34460 /* MathObject.lut.h in Headers */,
@@ -2266,7 +2387,6 @@
 				86C568E211A213EE0007F7F0 /* MIPSAssembler.h in Headers */,
 				BC02E9110E1839DB000F9297 /* NativeErrorConstructor.h in Headers */,
 				BC02E9130E1839DB000F9297 /* NativeErrorPrototype.h in Headers */,
-				A76EE6590FAE59D5003F069A /* NativeFunctionWrapper.h in Headers */,
 				7EFF00640EC05A9A00AA7C93 /* NodeInfo.h in Headers */,
 				BC18C43F0E16F5CD00B34460 /* Nodes.h in Headers */,
 				BC18C4400E16F5CD00B34460 /* Noncopyable.h in Headers */,
@@ -2284,6 +2404,7 @@
 				969A079B0ED1D3AE00F1F681 /* Opcode.h in Headers */,
 				BC18C4480E16F5CD00B34460 /* Operations.h in Headers */,
 				1400067712A6F7830064D123 /* OSAllocator.h in Headers */,
+				97941A5A13029ACC004A3447 /* OSRandomSource.h in Headers */,
 				BC18C4490E16F5CD00B34460 /* OwnArrayPtr.h in Headers */,
 				0BDFFAE10FC6193100D69EF4 /* OwnFastMallocPtr.h in Headers */,
 				BC18C44A0E16F5CD00B34460 /* OwnPtr.h in Headers */,
@@ -2310,7 +2431,6 @@
 				BC18C4540E16F5CD00B34460 /* PropertyNameArray.h in Headers */,
 				BC18C4550E16F5CD00B34460 /* PropertySlot.h in Headers */,
 				BC18C4560E16F5CD00B34460 /* Protect.h in Headers */,
-				BC257DF40E1F53740016B6C9 /* PrototypeFunction.h in Headers */,
 				147B84630E6DE6B1004775A4 /* PutPropertySlot.h in Headers */,
 				088FA5BC0EF76D4300578E6F /* RandomNumber.h in Headers */,
 				08E279E90EF83B10007DB523 /* RandomNumberSeed.h in Headers */,
@@ -2337,9 +2457,14 @@
 				1429D8860ED21C3D00B89619 /* SamplingTool.h in Headers */,
 				BC18C4610E16F5CD00B34460 /* ScopeChain.h in Headers */,
 				969A072C0ED1CE6900F1F681 /* SegmentedVector.h in Headers */,
+				A7C40C0B130B057D00D002A1 /* SentinelLinkedList.h in Headers */,
+				76FB9F0F12E851860051A2EB /* SHA1.h in Headers */,
+				A7C40C0C130B057D00D002A1 /* SinglyLinkedList.h in Headers */,
 				933040040E6A749400786E6A /* SmallStrings.h in Headers */,
 				BC18C4640E16F5CD00B34460 /* SourceCode.h in Headers */,
 				BC18C4630E16F5CD00B34460 /* SourceProvider.h in Headers */,
+				E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */,
+				E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */,
 				A7386554118697B400540279 /* SpecializedThunkJIT.h in Headers */,
 				86D87DDB12BCAF94008E73A1 /* StackBounds.h in Headers */,
 				868BFA60117D048200B908B1 /* StaticConstructors.h in Headers */,
@@ -2358,6 +2483,7 @@
 				BC18C4690E16F5CD00B34460 /* StringObjectThatMasqueradesAsUndefined.h in Headers */,
 				BC18C46A0E16F5CD00B34460 /* StringPrototype.h in Headers */,
 				BC18C5260E16FCA700B34460 /* StringPrototype.lut.h in Headers */,
+				142E313B134FF0A600AFADB5 /* Strong.h in Headers */,
 				BCDE3AB80E6C82F5001453A7 /* Structure.h in Headers */,
 				7E4EE7090EBB7963005934AA /* StructureChain.h in Headers */,
 				BCCF0D080EF0AAB900413C8F /* StructureStubInfo.h in Headers */,
@@ -2373,7 +2499,7 @@
 				18BAB55410DAE066000D945B /* ThreadIdentifierDataPthreads.h in Headers */,
 				BC18C4700E16F5CD00B34460 /* Threading.h in Headers */,
 				BC5F7BBF11823B590052C02C /* ThreadingPrimitives.h in Headers */,
-				BC5F7BC011823B590052C02C /* ThreadSafeShared.h in Headers */,
+				BC5F7BC011823B590052C02C /* ThreadSafeRefCounted.h in Headers */,
 				BC18C4710E16F5CD00B34460 /* ThreadSpecific.h in Headers */,
 				A7386556118697B400540279 /* ThunkGenerators.h in Headers */,
 				14A42E400F4F60EE00599099 /* TimeoutChecker.h in Headers */,
@@ -2394,27 +2520,27 @@
 				BC18C4780E16F5CD00B34460 /* Vector.h in Headers */,
 				BC18C4790E16F5CD00B34460 /* VectorTraits.h in Headers */,
 				96DD73790F9DA3100027FBCC /* VMTags.h in Headers */,
+				142E313C134FF0A600AFADB5 /* Weak.h in Headers */,
 				14BFCE6910CDB1FC00364CCE /* WeakGCMap.h in Headers */,
-				14035DB110DBFB2A00FFFFE7 /* WeakGCPtr.h in Headers */,
 				1420BE7B10AA6DDB00F455D2 /* WeakRandom.h in Headers */,
 				BC18C47A0E16F5CD00B34460 /* WebKitAvailability.h in Headers */,
+				A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */,
 				868BFA18117CF19900B908B1 /* WTFString.h in Headers */,
 				86D08D5411793613006E5ED0 /* WTFThreadData.h in Headers */,
 				9688CB160ED12B4E001D649F /* X86Assembler.h in Headers */,
+				451539B912DC994500EF7AC4 /* Yarr.h in Headers */,
 				86704B8512DBA33700A9FE7B /* YarrInterpreter.h in Headers */,
 				86704B8712DBA33700A9FE7B /* YarrJIT.h in Headers */,
 				86704B8812DBA33700A9FE7B /* YarrParser.h in Headers */,
 				86704B8A12DBA33700A9FE7B /* YarrPattern.h in Headers */,
 				86704B4312DB8A8100A9FE7B /* YarrSyntaxChecker.h in Headers */,
 				5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */,
-				451539B912DC994500EF7AC4 /* Yarr.h in Headers */,
-				A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */,
-				E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */,
-				E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */,
-				14C824AD12F7C785008F35E0 /* MarkedBlock.h in Headers */,
-				E4D8CEFB12FC439600BC9F5A /* BloomFilter.h in Headers */,
-				97941A5A13029ACC004A3447 /* OSRandomSource.h in Headers */,
-				97941A7F1302A098004A3447 /* CryptographicallyRandomNumber.h in Headers */,
+				14FB986E135225410085A5DB /* Heap.h in Headers */,
+				865A30F1135007E100CDB49E /* JSValueInlineMethods.h in Headers */,
+				142D6F0913539A2800B02E86 /* MarkedBlock.h in Headers */,
+				142D6F0D13539A2F00B02E86 /* MarkedSpace.h in Headers */,
+				142D6F1213539A4100B02E86 /* MarkStack.h in Headers */,
+				A1D764521354448B00C5C7C0 /* Alignment.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2426,9 +2552,9 @@
 			buildConfigurationList = 141211390A48798400480255 /* Build configuration list for PBXNativeTarget "minidom" */;
 			buildPhases = (
 				1412111D0A48793C00480255 /* Sources */,
-				1440025E0A52563F0005F061 /* ShellScript */,
 				1412111E0A48793C00480255 /* Frameworks */,
 				144005C70A5338C60005F061 /* Headers */,
+				5DBB1524131D0BA10056AD36 /* Copy Support Script */,
 			);
 			buildRules = (
 			);
@@ -2445,8 +2571,8 @@
 			buildConfigurationList = 14BD59D60A3E8FC900BAF59C /* Build configuration list for PBXNativeTarget "testapi" */;
 			buildPhases = (
 				14BD59BC0A3E8F9000BAF59C /* Sources */,
-				14D857B50A469C100032146C /* ShellScript */,
 				14BD59BD0A3E8F9000BAF59C /* Frameworks */,
+				5DBB1511131D0B130056AD36 /* Copy Support Script */,
 			);
 			buildRules = (
 			);
@@ -2487,8 +2613,7 @@
 			buildPhases = (
 				932F5BDC0822A1C700736975 /* Sources */,
 				932F5BDE0822A1C700736975 /* Frameworks */,
-				5D5D8ABA0E0D0A7300F9C692 /* Copy Into Framework */,
-				5D5D8ABF0E0D0B0300F9C692 /* Fix Framework Reference */,
+				5D5D8ABF0E0D0B0300F9C692 /* Copy Into Framework */,
 			);
 			buildRules = (
 			);
@@ -2506,8 +2631,11 @@
 /* Begin PBXProject section */
 		0867D690FE84028FC02AAC07 /* Project object */ = {
 			isa = PBXProject;
+			attributes = {
+				BuildIndependentTargetsInParallel = YES;
+			};
 			buildConfigurationList = 149C277108902AFE008A9EFC /* Build configuration list for PBXProject "JavaScriptCore" */;
-			compatibilityVersion = "Xcode 2.4";
+			compatibilityVersion = "Xcode 3.1";
 			developmentRegion = English;
 			hasScannedForEncodings = 1;
 			knownRegions = (
@@ -2532,32 +2660,6 @@
 /* End PBXProject section */
 
 /* Begin PBXShellScriptBuildPhase section */
-		1440025E0A52563F0005F061 /* ShellScript */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-			);
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "cp \"${SRCROOT}/API/tests/minidom.js\" \"${BUILT_PRODUCTS_DIR}\"";
-		};
-		14D857B50A469C100032146C /* ShellScript */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-			);
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "cp \"${SRCROOT}/API/tests/testapi.js\" \"${BUILT_PRODUCTS_DIR}\"";
-		};
 		5D29D8BE0E9860B400C3D2D0 /* Check For Weak VTables and Externals */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
@@ -2605,7 +2707,7 @@
 			shellPath = /bin/sh;
 			shellScript = "TRACING_D=\"$SRCROOT/runtime/Tracing.d\";\nTRACING_H=\"$BUILT_PRODUCTS_DIR/DerivedSources/JavaScriptCore/TracingDtrace.h\";\n\nif [[ \"$HAVE_DTRACE\" = \"1\" && \"$TRACING_D\" -nt \"$TRACING_H\" ]];\nthen\n\tdtrace -h -o \"$TRACING_H\" -s \"$TRACING_D\";\nfi;\n";
 		};
-		5D5D8ABF0E0D0B0300F9C692 /* Fix Framework Reference */ = {
+		5D5D8ABF0E0D0B0300F9C692 /* Copy Into Framework */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
@@ -2613,12 +2715,12 @@
 			inputPaths = (
 				"$(BUILT_PRODUCTS_DIR)/JavaScriptCore.framework/Resources/jsc",
 			);
-			name = "Fix Framework Reference";
+			name = "Copy Into Framework";
 			outputPaths = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "# Update the copied jsc binary to refer to JavaScriptcore.framework relative to its location\ninstall_name_tool -change \"${BUILT_PRODUCTS_DIR}/JavaScriptCore.framework/Versions/A/JavaScriptCore\" \"@loader_path/../JavaScriptCore\" \"${BUILT_PRODUCTS_DIR}/JavaScriptCore.framework/Resources/jsc\"\n";
+			shellScript = "# Skip for Production builds.\nif [[ ${CONFIGURATION:=Debug} == \"Production\" ]]; then\n    exit\nfi\n\n# Copy and update the jsc binary to refer to JavaScriptcore.framework relative to its location.\nditto \"${BUILT_PRODUCTS_DIR}/jsc\" \"${BUILT_PRODUCTS_DIR}/JavaScriptCore.framework/Resources/jsc\"\ninstall_name_tool -change \"${BUILT_PRODUCTS_DIR}/JavaScriptCore.framework/Versions/A/JavaScriptCore\" \"@loader_path/../JavaScriptCore\" \"${BUILT_PRODUCTS_DIR}/JavaScriptCore.framework/Resources/jsc\"\n";
 		};
 		65FB3F6509D11E9100F49DEB /* Generate Derived Sources */ = {
 			isa = PBXShellScriptBuildPhase;
@@ -2676,7 +2778,6 @@
 				141211340A48795800480255 /* minidom.c in Sources */,
 				1440063F0A53598A0005F061 /* Node.c in Sources */,
 				1440074B0A536CC20005F061 /* NodeList.c in Sources */,
-				DDE82AD51209D955005C1756 /* GCHandle.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2685,7 +2786,6 @@
 			buildActionMask = 2147483647;
 			files = (
 				1440F6100A4F85670005F061 /* testapi.c in Sources */,
-				DDE82AD41209D955005C1756 /* GCHandle.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2713,8 +2813,9 @@
 				E1A862A90D7EBB76001EC6AA /* CollatorICU.cpp in Sources */,
 				147F39C1107EC37600427A48 /* CommonIdentifiers.cpp in Sources */,
 				147F39C2107EC37600427A48 /* Completion.cpp in Sources */,
-				146B16D812EB5B59001BEC1B /* ConservativeSet.cpp in Sources */,
+				146B16D812EB5B59001BEC1B /* ConservativeRoots.cpp in Sources */,
 				1428082E107EC0570013E7B2 /* ConstructData.cpp in Sources */,
+				97941A7E1302A098004A3447 /* CryptographicallyRandomNumber.cpp in Sources */,
 				86565742115BE3DA00291F40 /* CString.cpp in Sources */,
 				180B9BFE0F16E94D009BDBC5 /* CurrentTime.cpp in Sources */,
 				147F39C3107EC37600427A48 /* DateConstructor.cpp in Sources */,
@@ -2726,6 +2827,13 @@
 				BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */,
 				149559EE0DDCDDF700648087 /* DebuggerCallFrame.cpp in Sources */,
 				0F29479C126E698C00B3ABF5 /* DecimalNumber.cpp in Sources */,
+				86EC9DC41328DF82002B2AD7 /* DFGByteCodeParser.cpp in Sources */,
+				86EC9DC71328DF82002B2AD7 /* DFGGraph.cpp in Sources */,
+				86EC9DC91328DF82002B2AD7 /* DFGJITCodeGenerator.cpp in Sources */,
+				86EC9DCB1328DF82002B2AD7 /* DFGJITCompiler.cpp in Sources */,
+				86EC9DCD1328DF82002B2AD7 /* DFGNonSpeculativeJIT.cpp in Sources */,
+				86EC9DCF1328DF82002B2AD7 /* DFGOperations.cpp in Sources */,
+				86EC9DD21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp in Sources */,
 				14469DD7107EC79E00650446 /* dtoa.cpp in Sources */,
 				147F39C7107EC37600427A48 /* Error.cpp in Sources */,
 				147F39C8107EC37600427A48 /* ErrorConstructor.cpp in Sources */,
@@ -2739,11 +2847,10 @@
 				147F39CB107EC37600427A48 /* FunctionConstructor.cpp in Sources */,
 				147F39CC107EC37600427A48 /* FunctionPrototype.cpp in Sources */,
 				DDF7ABD511F60ED200108E36 /* GCActivityCallbackCF.cpp in Sources */,
-				DDE82AD71209D955005C1756 /* GCHandle.cpp in Sources */,
 				14280855107EC0E70013E7B2 /* GetterSetter.cpp in Sources */,
-				147F39CD107EC37600427A48 /* GlobalEvalFunction.cpp in Sources */,
+				142E3135134FF0A600AFADB5 /* HandleHeap.cpp in Sources */,
+				142E3137134FF0A600AFADB5 /* HandleStack.cpp in Sources */,
 				65DFC93308EA173A00F7300B /* HashTable.cpp in Sources */,
-				140CDE7012DE97A00013CFC5 /* Heap.cpp in Sources */,
 				147F39CE107EC37600427A48 /* Identifier.cpp in Sources */,
 				E178636D0D9BEEC300D74E75 /* InitializeThreading.cpp in Sources */,
 				147F39CF107EC37600427A48 /* InternalFunction.cpp in Sources */,
@@ -2773,10 +2880,8 @@
 				E18E3A590DF9278C00D90B34 /* JSGlobalData.cpp in Sources */,
 				147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */,
 				14E9D17B107EC469004DDA21 /* JSGlobalObjectFunctions.cpp in Sources */,
-				147F39D3107EC37600427A48 /* JSImmediate.cpp in Sources */,
 				14280875107EC13E0013E7B2 /* JSLock.cpp in Sources */,
 				A72700900DAC6BBC00E548D7 /* JSNotAnObject.cpp in Sources */,
-				1428085D107EC0F80013E7B2 /* JSNumberCell.cpp in Sources */,
 				147F39D4107EC37600427A48 /* JSObject.cpp in Sources */,
 				1482B7E40A43076000517CFC /* JSObjectRef.cpp in Sources */,
 				A783A2AB11A5BE8400563D20 /* JSObjectWithGlobalObject.cpp in Sources */,
@@ -2802,9 +2907,6 @@
 				86C568E011A213EE0007F7F0 /* MacroAssemblerARM.cpp in Sources */,
 				06D358B30DAADAA4003B174E /* MainThread.cpp in Sources */,
 				06D358B40DAADAAA003B174E /* MainThreadMac.mm in Sources */,
-				140CDC7C12DC09BF0013CFC5 /* MarkedSpace.cpp in Sources */,
-				A74B3499102A5F8E0032AB98 /* MarkStack.cpp in Sources */,
-				A7C530E4102A3813005BC741 /* MarkStackPosix.cpp in Sources */,
 				14469DDF107EC7E700650446 /* MathObject.cpp in Sources */,
 				511FC4C9117EE28700425272 /* MD5.cpp in Sources */,
 				90213E3D123A40C200D422F3 /* MemoryStatistics.cpp in Sources */,
@@ -2822,6 +2924,7 @@
 				969A079A0ED1D3AE00F1F681 /* Opcode.cpp in Sources */,
 				14280850107EC0D70013E7B2 /* Operations.cpp in Sources */,
 				1400069312A6F9E10064D123 /* OSAllocatorPosix.cpp in Sources */,
+				97941A5713029AAB004A3447 /* OSRandomSource.cpp in Sources */,
 				14FFF98C12BFFF7500795BB8 /* PageAllocationAligned.cpp in Sources */,
 				14B3EF0612BC24DD00D29EFF /* PageBlock.cpp in Sources */,
 				9714AF5E122F32070092D9F5 /* ParsedURL.cpp in Sources */,
@@ -2835,7 +2938,6 @@
 				A7FB60A4103F7DC20017A286 /* PropertyDescriptor.cpp in Sources */,
 				14469DE7107EC7E700650446 /* PropertyNameArray.cpp in Sources */,
 				14469DE8107EC7E700650446 /* PropertySlot.cpp in Sources */,
-				14469DE9107EC7E700650446 /* PrototypeFunction.cpp in Sources */,
 				088FA5BB0EF76D4300578E6F /* RandomNumber.cpp in Sources */,
 				905B02AE0E28640F006DF882 /* RefCountedLeakCounter.cpp in Sources */,
 				14280841107EC0930013E7B2 /* RegExp.cpp in Sources */,
@@ -2847,8 +2949,10 @@
 				86B99AB8117E391E00DF5A90 /* RopeImpl.cpp in Sources */,
 				1429D8850ED21C3D00B89619 /* SamplingTool.cpp in Sources */,
 				14469DEA107EC7E700650446 /* ScopeChain.cpp in Sources */,
+				76FB9F1112E851960051A2EB /* SHA1.cpp in Sources */,
 				0BF28A2911A33DC300638F84 /* SizeLimits.cpp in Sources */,
 				9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */,
+				E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */,
 				86D87DAE12BCA7D1008E73A1 /* StackBounds.cpp in Sources */,
 				A730B6131250068F009D25B1 /* StrictEvalActivation.cpp in Sources */,
 				86438FC41265503E00E0DFCA /* StringBuilder.cpp in Sources */,
@@ -2877,10 +2981,11 @@
 				86704B8612DBA33700A9FE7B /* YarrJIT.cpp in Sources */,
 				86704B8912DBA33700A9FE7B /* YarrPattern.cpp in Sources */,
 				86704B4212DB8A8100A9FE7B /* YarrSyntaxChecker.cpp in Sources */,
-				E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */,
-				14C824AB12F7C77E008F35E0 /* MarkedBlock.cpp in Sources */,
-				97941A5713029AAB004A3447 /* OSRandomSource.cpp in Sources */,
-				97941A7E1302A098004A3447 /* CryptographicallyRandomNumber.cpp in Sources */,
+				14FB986D135225410085A5DB /* Heap.cpp in Sources */,
+				142D6F0813539A2800B02E86 /* MarkedBlock.cpp in Sources */,
+				142D6F0C13539A2F00B02E86 /* MarkedSpace.cpp in Sources */,
+				142D6F1113539A4100B02E86 /* MarkStack.cpp in Sources */,
+				142D6F1313539A4100B02E86 /* MarkStackPosix.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2889,9 +2994,6 @@
 			buildActionMask = 2147483647;
 			files = (
 				932F5BDD0822A1C700736975 /* jsc.cpp in Sources */,
-				DDE82AD31209D955005C1756 /* GCHandle.cpp in Sources */,
-				972A485F12661E0800F4514F /* URLCharacterTypes.cpp in Sources */,
-				972A48771266256F00F4514F /* URLEscape.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2945,6 +3047,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = minidom;
+				SKIP_INSTALL = YES;
 			};
 			name = Debug;
 		};
@@ -2952,6 +3055,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = minidom;
+				SKIP_INSTALL = YES;
 			};
 			name = Release;
 		};
@@ -2959,6 +3063,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = minidom;
+				SKIP_INSTALL = YES;
 			};
 			name = Production;
 		};
@@ -3003,6 +3108,7 @@
 		149C276B08902AFE008A9EFC /* Production */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
+				INSTALL_PATH = "$(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/Resources";
 				PRODUCT_NAME = jsc;
 			};
 			name = Production;
@@ -3058,6 +3164,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = testapi;
+				SKIP_INSTALL = YES;
 			};
 			name = Debug;
 		};
@@ -3065,6 +3172,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = testapi;
+				SKIP_INSTALL = YES;
 			};
 			name = Release;
 		};
@@ -3072,6 +3180,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = testapi;
+				SKIP_INSTALL = YES;
 			};
 			name = Production;
 		};
@@ -3130,6 +3239,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = minidom;
+				SKIP_INSTALL = YES;
 			};
 			name = Profiling;
 		};
@@ -3137,6 +3247,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				PRODUCT_NAME = testapi;
+				SKIP_INSTALL = YES;
 			};
 			name = Profiling;
 		};
diff --git a/Source/JavaScriptCore/Makefile b/Source/JavaScriptCore/Makefile
index b9e2a72..cb4c11a 100644
--- a/Source/JavaScriptCore/Makefile
+++ b/Source/JavaScriptCore/Makefile
@@ -1,2 +1 @@
-OTHER_OPTIONS = -target All
 include ../Makefile.shared
diff --git a/Source/JavaScriptCore/assembler/ARMAssembler.h b/Source/JavaScriptCore/assembler/ARMAssembler.h
index 77ec60f..e553492 100644
--- a/Source/JavaScriptCore/assembler/ARMAssembler.h
+++ b/Source/JavaScriptCore/assembler/ARMAssembler.h
@@ -250,7 +250,7 @@ namespace JSC {
                 ASSERT(m_offset == offset);
             }
 
-            int m_offset : 31;
+            signed int m_offset : 31;
             int m_used : 1;
         };
 
@@ -722,6 +722,10 @@ namespace JSC {
 
         void* executableCopy(ExecutablePool* allocator);
 
+#ifndef NDEBUG
+        unsigned debugOffset() { return m_formatter.debugOffset(); }
+#endif
+
         // Patching helpers
 
         static ARMWord* getLdrImmAddress(ARMWord* insn)
@@ -786,17 +790,6 @@ namespace JSC {
             patchPointerInternal(reinterpret_cast<intptr_t>(from), to);
         }
 
-        static void repatchLoadPtrToLEA(void* from)
-        {
-            // On arm, this is a patch from LDR to ADD. It is restricted conversion,
-            // from special case to special case, altough enough for its purpose
-            ARMWord* insn = reinterpret_cast<ARMWord*>(from);
-            ASSERT((*insn & 0x0ff00f00) == 0x05900000);
-
-            *insn = (*insn & 0xf00ff0ff) | 0x02800000;
-            ExecutableAllocator::cacheFlush(insn, sizeof(ARMWord));
-        }
-
         // Linkers
         static intptr_t getAbsoluteJumpAddress(void* base, int offset = 0)
         {
diff --git a/Source/JavaScriptCore/assembler/ARMv7Assembler.h b/Source/JavaScriptCore/assembler/ARMv7Assembler.h
index f584883..d9d4f5d 100644
--- a/Source/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/Source/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -369,40 +369,6 @@ private:
     ThumbImmediateValue m_value;
 };
 
-class VFPImmediate {
-public:
-    VFPImmediate(double d)
-        : m_value(-1)
-    {
-        union {
-            uint64_t i;
-            double d;
-        } u;
-
-        u.d = d;
-
-        int sign = static_cast<int>(u.i >> 63);
-        int exponent = static_cast<int>(u.i >> 52) & 0x7ff;
-        uint64_t mantissa = u.i & 0x000fffffffffffffull;
-
-        if ((exponent >= 0x3fc) && (exponent <= 0x403) && !(mantissa & 0x0000ffffffffffffull))
-            m_value = (sign << 7) | ((exponent & 7) << 4) | (int)(mantissa >> 48);
-    }
-
-    bool isValid()
-    {
-        return m_value != -1;
-    }
-    
-    uint8_t value()
-    {
-        return (uint8_t)m_value;
-    }
-
-private:
-    int m_value;
-};
-
 typedef enum {
     SRType_LSL,
     SRType_LSR,
@@ -412,7 +378,6 @@ typedef enum {
     SRType_RRX = SRType_ROR
 } ARMShiftType;
 
-class ARMv7Assembler;
 class ShiftTypeAndAmount {
     friend class ARMv7Assembler;
 
@@ -563,7 +528,7 @@ public:
             ASSERT(m_offset == offset);
         }
 
-        int m_offset : 31;
+        signed int m_offset : 31;
         int m_used : 1;
     };
 
@@ -1880,22 +1845,6 @@ public:
         setPointer(where, value);
     }
 
-    static void repatchLoadPtrToLEA(void* where)
-    {
-        ASSERT(!(reinterpret_cast<intptr_t>(where) & 1));
-        uint16_t* loadOp = reinterpret_cast<uint16_t*>(where) + 4;
-
-        ASSERT((loadOp[0] & 0xfff0) == OP_LDR_reg_T2);
-        ASSERT((loadOp[1] & 0x0ff0) == 0);
-        int rn = loadOp[0] & 0xf;
-        int rt = loadOp[1] >> 12;
-        int rm = loadOp[1] & 0xf;
-
-        loadOp[0] = OP_ADD_reg_T3 | rn;
-        loadOp[1] = rt << 8 | rm;
-        ExecutableAllocator::cacheFlush(loadOp, sizeof(uint32_t));
-    }
-
 private:
     // VFP operations commonly take one or more 5-bit operands, typically representing a
     // floating point register number.  This will commonly be encoded in the instruction
@@ -2343,6 +2292,10 @@ private:
         void* data() const { return m_buffer.data(); }
         void* executableCopy(ExecutablePool* allocator) { return m_buffer.executableCopy(allocator); }
 
+#ifndef NDEBUG
+        unsigned debugOffset() { return m_formatter.debugOffset(); }
+#endif
+
     private:
         AssemblerBuffer m_buffer;
     } m_formatter;
diff --git a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
index 07bd702..8b6613d 100644
--- a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -145,21 +145,21 @@ public:
     // Describes an memory operand given by a pointer.  For regular load & store
     // operations an unwrapped void* will be used, rather than using this.
     struct AbsoluteAddress {
-        explicit AbsoluteAddress(void* ptr)
+        explicit AbsoluteAddress(const void* ptr)
             : m_ptr(ptr)
         {
         }
 
-        void* m_ptr;
+        const void* m_ptr;
     };
 
-    // ImmPtr:
+    // TrustedImmPtr:
     //
     // A pointer sized immediate operand to an instruction - this is wrapped
     // in a class requiring explicit construction in order to differentiate
     // from pointers used as absolute addresses to memory operations
-    struct ImmPtr {
-        explicit ImmPtr(const void* value)
+    struct TrustedImmPtr {
+        explicit TrustedImmPtr(const void* value)
             : m_value(value)
         {
         }
@@ -172,14 +172,21 @@ public:
         const void* m_value;
     };
 
-    // Imm32:
+    struct ImmPtr : public TrustedImmPtr {
+        explicit ImmPtr(const void* value)
+            : TrustedImmPtr(value)
+        {
+        }
+    };
+
+    // TrustedImm32:
     //
     // A 32bit immediate operand to an instruction - this is wrapped in a
     // class requiring explicit construction in order to prevent RegisterIDs
     // (which are implemented as an enum) from accidentally being passed as
     // immediate values.
-    struct Imm32 {
-        explicit Imm32(int32_t value)
+    struct TrustedImm32 {
+        explicit TrustedImm32(int32_t value)
             : m_value(value)
 #if CPU(ARM) || CPU(MIPS)
             , m_isPointer(false)
@@ -188,7 +195,7 @@ public:
         }
 
 #if !CPU(X86_64)
-        explicit Imm32(ImmPtr ptr)
+        explicit TrustedImm32(TrustedImmPtr ptr)
             : m_value(ptr.asIntptr())
 #if CPU(ARM) || CPU(MIPS)
             , m_isPointer(true)
@@ -211,6 +218,19 @@ public:
     };
 
 
+    struct Imm32 : public TrustedImm32 {
+        explicit Imm32(int32_t value)
+            : TrustedImm32(value)
+        {
+        }
+#if !CPU(X86_64)
+        explicit Imm32(TrustedImmPtr ptr)
+            : TrustedImm32(ptr)
+        {
+        }
+#endif
+    };
+    
     // Section 2: MacroAssembler code buffer handles
     //
     // The following types are used to reference items in the code buffer
@@ -358,16 +378,18 @@ public:
         {
         }
         
-        void link(AbstractMacroAssembler<AssemblerType>* masm)
+        void link(AbstractMacroAssembler<AssemblerType>* masm) const
         {
             masm->m_assembler.linkJump(m_jmp, masm->m_assembler.label());
         }
         
-        void linkTo(Label label, AbstractMacroAssembler<AssemblerType>* masm)
+        void linkTo(Label label, AbstractMacroAssembler<AssemblerType>* masm) const
         {
             masm->m_assembler.linkJump(m_jmp, label.m_label);
         }
 
+        bool isSet() const { return m_jmp.isSet(); }
+
     private:
         JmpSrc m_jmp;
     };
@@ -481,10 +503,19 @@ public:
     {
         return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
     }
-    
+
+    // Temporary interface; likely to be removed, since may be hard to port to all architectures.
+#if CPU(X86) || CPU(X86_64)
+    void rewindToLabel(Label rewindTo) { m_assembler.rewindToLabel(rewindTo.m_label); }
+#endif
+
     void beginUninterruptedSequence() { }
     void endUninterruptedSequence() { }
 
+#ifndef NDEBUG
+    unsigned debugOffset() { return m_assembler.debugOffset(); }
+#endif
+
 protected:
     AssemblerType m_assembler;
 
@@ -535,11 +566,6 @@ protected:
     {
         AssemblerType::repatchPointer(dataLabelPtr.dataLocation(), value);
     }
-
-    static void repatchLoadPtrToLEA(CodeLocationInstruction instruction)
-    {
-        AssemblerType::repatchLoadPtrToLEA(instruction.dataLocation());
-    }
 };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/assembler/AssemblerBuffer.h b/Source/JavaScriptCore/assembler/AssemblerBuffer.h
index 0454a99..802fa7f 100644
--- a/Source/JavaScriptCore/assembler/AssemblerBuffer.h
+++ b/Source/JavaScriptCore/assembler/AssemblerBuffer.h
@@ -114,6 +114,21 @@ namespace JSC {
             putIntUnchecked(value);
         }
 
+        template<typename IntegralType>
+        void putIntegral(IntegralType value)
+        {
+            if (m_size > m_capacity - sizeof(IntegralType))
+                grow();
+            putIntegralUnchecked(value);
+        }
+
+        template<typename IntegralType>
+        void putIntegralUnchecked(IntegralType value)
+        {
+            *reinterpret_cast_ptr<IntegralType*>(&m_buffer[m_size]) = value;
+            m_size += sizeof(IntegralType);
+        }
+
         void* data() const
         {
             return m_buffer;
@@ -139,6 +154,16 @@ namespace JSC {
             return memcpy(result, m_buffer, m_size);
         }
 
+        void rewindToOffset(int offset)
+        {
+            ASSERT(offset >= 0);
+            m_size = offset;
+        }
+
+#ifndef NDEBUG
+        unsigned debugOffset() { return m_size; }
+#endif
+
     protected:
         void append(const char* data, int size)
         {
diff --git a/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h b/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
index 599be14..3cfc67b 100644
--- a/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
+++ b/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
@@ -85,7 +85,14 @@ namespace JSC {
 template <int maxPoolSize, int barrierSize, int maxInstructionSize, class AssemblerType>
 class AssemblerBufferWithConstantPool: public AssemblerBuffer {
     typedef SegmentedVector<uint32_t, 512> LoadOffsets;
+    using AssemblerBuffer::putIntegral;
+    using AssemblerBuffer::putIntegralUnchecked;
 public:
+    typedef struct {
+        short high;
+        short low;
+    } TwoShorts;
+
     enum {
         UniqueConst,
         ReusableConst,
@@ -171,6 +178,19 @@ public:
         correctDeltas(8);
     }
 
+    void putIntegral(TwoShorts value)
+    {
+        if (m_size > m_capacity - sizeof(TwoShorts))
+            grow();
+        putIntegralUnchecked(value);
+    }
+
+    void putIntegralUnchecked(TwoShorts value)
+    {
+        putIntegralUnchecked(value.high);
+        putIntegralUnchecked(value.low);
+    }
+
     int size()
     {
         flushIfNoSpaceFor(maxInstructionSize, sizeof(uint64_t));
@@ -188,29 +208,14 @@ public:
         return AssemblerBuffer::executableCopy(allocator);
     }
 
-    void putIntWithConstantInt(uint32_t insn, uint32_t constant, bool isReusable = false)
+    void putShortWithConstantInt(uint16_t insn, uint32_t constant, bool isReusable = false)
     {
-        if (!m_numConsts)
-            m_maxDistance = maxPoolSize;
-        flushIfNoSpaceFor(4, 4);
-
-        m_loadOffsets.append(AssemblerBuffer::size());
-        if (isReusable)
-            for (int i = 0; i < m_numConsts; ++i) {
-                if (m_mask[i] == ReusableConst && m_pool[i] == constant) {
-                    AssemblerBuffer::putInt(AssemblerType::patchConstantPoolLoad(insn, i));
-                    correctDeltas(4);
-                    return;
-                }
-            }
-
-        m_pool[m_numConsts] = constant;
-        m_mask[m_numConsts] = static_cast<char>(isReusable ? ReusableConst : UniqueConst);
-
-        AssemblerBuffer::putInt(AssemblerType::patchConstantPoolLoad(insn, m_numConsts));
-        ++m_numConsts;
+        putIntegralWithConstantInt(insn, constant, isReusable);
+    }
 
-        correctDeltas(4, 4);
+    void putIntWithConstantInt(uint32_t insn, uint32_t constant, bool isReusable = false)
+    {
+        putIntegralWithConstantInt(insn, constant, isReusable);
     }
 
     // This flushing mechanism can be called after any unconditional jumps.
@@ -248,6 +253,33 @@ private:
         m_lastConstDelta = constSize;
     }
 
+    template<typename IntegralType>
+    void putIntegralWithConstantInt(IntegralType insn, uint32_t constant, bool isReusable)
+    {
+        if (!m_numConsts)
+            m_maxDistance = maxPoolSize;
+        flushIfNoSpaceFor(sizeof(IntegralType), 4);
+
+        m_loadOffsets.append(AssemblerBuffer::size());
+        if (isReusable) {
+            for (int i = 0; i < m_numConsts; ++i) {
+                if (m_mask[i] == ReusableConst && m_pool[i] == constant) {
+                    putIntegral(static_cast<IntegralType>(AssemblerType::patchConstantPoolLoad(insn, i)));
+                    correctDeltas(sizeof(IntegralType));
+                    return;
+                }
+            }
+        }
+
+        m_pool[m_numConsts] = constant;
+        m_mask[m_numConsts] = static_cast<char>(isReusable ? ReusableConst : UniqueConst);
+
+        putIntegral(static_cast<IntegralType>(AssemblerType::patchConstantPoolLoad(insn, m_numConsts)));
+        ++m_numConsts;
+
+        correctDeltas(sizeof(IntegralType), 4);
+    }
+
     void flushConstantPool(bool useBarrier = true)
     {
         if (m_numConsts == 0)
@@ -259,7 +291,7 @@ private:
 
         // Callback to protect the constant pool from execution
         if (useBarrier)
-            AssemblerBuffer::putInt(AssemblerType::placeConstantPoolBarrier(m_numConsts * sizeof(uint32_t) + alignPool));
+            putIntegral(AssemblerType::placeConstantPoolBarrier(m_numConsts * sizeof(uint32_t) + alignPool));
 
         if (alignPool) {
             if (alignPool & 1)
diff --git a/Source/JavaScriptCore/assembler/LinkBuffer.h b/Source/JavaScriptCore/assembler/LinkBuffer.h
index c5a7d5b..7fa6a99 100644
--- a/Source/JavaScriptCore/assembler/LinkBuffer.h
+++ b/Source/JavaScriptCore/assembler/LinkBuffer.h
@@ -183,6 +183,13 @@ public:
         return CodePtr(MacroAssembler::AssemblerType_T::getRelocatedAddress(code(), applyOffset(label.m_label)));
     }
 
+#ifndef NDEBUG
+    void* debugAddress()
+    {
+        return m_code;
+    }
+#endif
+
 private:
     template <typename T> T applyOffset(T src)
     {
diff --git a/Source/JavaScriptCore/assembler/MIPSAssembler.h b/Source/JavaScriptCore/assembler/MIPSAssembler.h
index f7bea6c..4c17e40 100644
--- a/Source/JavaScriptCore/assembler/MIPSAssembler.h
+++ b/Source/JavaScriptCore/assembler/MIPSAssembler.h
@@ -719,6 +719,10 @@ public:
         return result;
     }
 
+#ifndef NDEBUG
+    unsigned debugOffset() { return m_formatter.debugOffset(); }
+#endif
+
     static unsigned getCallReturnOffset(JmpSrc call)
     {
         // The return address is after a call and a delay slot instruction
@@ -811,19 +815,7 @@ public:
         repatchInt32(from, reinterpret_cast<int32_t>(to));
     }
 
-    static void repatchLoadPtrToLEA(void* from)
-    {
-        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
-        insn = insn + 3;
-        ASSERT((*insn & 0xfc000000) == 0x8c000000); // lw
-        /* lw -> addiu */
-        *insn = 0x24000000 | (*insn & 0x03ffffff);
-
-        ExecutableAllocator::cacheFlush(insn, sizeof(MIPSWord));
-    }
-
 private:
-
     /* Update each jump in the buffer of newBase.  */
     void relocateJumps(void* oldBase, void* newBase)
     {
diff --git a/Source/JavaScriptCore/assembler/MacroAssembler.h b/Source/JavaScriptCore/assembler/MacroAssembler.h
index fa165de..cffb41d 100644
--- a/Source/JavaScriptCore/assembler/MacroAssembler.h
+++ b/Source/JavaScriptCore/assembler/MacroAssembler.h
@@ -50,6 +50,12 @@ namespace JSC { typedef MacroAssemblerX86 MacroAssemblerBase; };
 #include "MacroAssemblerX86_64.h"
 namespace JSC { typedef MacroAssemblerX86_64 MacroAssemblerBase; };
 
+#elif CPU(SH4)
+#include "MacroAssemblerSH4.h"
+namespace JSC {
+typedef MacroAssemblerSH4 MacroAssemblerBase;
+};
+
 #else
 #error "The MacroAssembler is not supported on this platform."
 #endif
@@ -74,7 +80,7 @@ public:
     // described in terms of other macro assembly methods.
     void pop()
     {
-        addPtr(Imm32(sizeof(void*)), stackPointerRegister);
+        addPtr(TrustedImm32(sizeof(void*)), stackPointerRegister);
     }
     
     void peek(RegisterID dest, int index = 0)
@@ -87,19 +93,19 @@ public:
         storePtr(src, Address(stackPointerRegister, (index * sizeof(void*))));
     }
 
-    void poke(Imm32 value, int index = 0)
+    void poke(TrustedImm32 value, int index = 0)
     {
         store32(value, Address(stackPointerRegister, (index * sizeof(void*))));
     }
 
-    void poke(ImmPtr imm, int index = 0)
+    void poke(TrustedImmPtr imm, int index = 0)
     {
         storePtr(imm, Address(stackPointerRegister, (index * sizeof(void*))));
     }
 
 
     // Backwards banches, these are currently all implemented using existing forwards branch mechanisms.
-    void branchPtr(Condition cond, RegisterID op1, ImmPtr imm, Label target)
+    void branchPtr(Condition cond, RegisterID op1, TrustedImmPtr imm, Label target)
     {
         branchPtr(cond, op1, imm).linkTo(target, this);
     }
@@ -109,7 +115,7 @@ public:
         branch32(cond, op1, op2).linkTo(target, this);
     }
 
-    void branch32(Condition cond, RegisterID op1, Imm32 imm, Label target)
+    void branch32(Condition cond, RegisterID op1, TrustedImm32 imm, Label target)
     {
         branch32(cond, op1, imm).linkTo(target, this);
     }
@@ -144,17 +150,17 @@ public:
         add32(src, dest);
     }
 
-    void addPtr(Imm32 imm, RegisterID srcDest)
+    void addPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         add32(imm, srcDest);
     }
 
-    void addPtr(ImmPtr imm, RegisterID dest)
+    void addPtr(TrustedImmPtr imm, RegisterID dest)
     {
-        add32(Imm32(imm), dest);
+        add32(TrustedImm32(imm), dest);
     }
 
-    void addPtr(Imm32 imm, RegisterID src, RegisterID dest)
+    void addPtr(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         add32(imm, src, dest);
     }
@@ -164,7 +170,7 @@ public:
         and32(src, dest);
     }
 
-    void andPtr(Imm32 imm, RegisterID srcDest)
+    void andPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         and32(imm, srcDest);
     }
@@ -174,12 +180,12 @@ public:
         or32(src, dest);
     }
 
-    void orPtr(ImmPtr imm, RegisterID dest)
+    void orPtr(TrustedImmPtr imm, RegisterID dest)
     {
-        or32(Imm32(imm), dest);
+        or32(TrustedImm32(imm), dest);
     }
 
-    void orPtr(Imm32 imm, RegisterID dest)
+    void orPtr(TrustedImm32 imm, RegisterID dest)
     {
         or32(imm, dest);
     }
@@ -189,14 +195,14 @@ public:
         sub32(src, dest);
     }
     
-    void subPtr(Imm32 imm, RegisterID dest)
+    void subPtr(TrustedImm32 imm, RegisterID dest)
     {
         sub32(imm, dest);
     }
     
-    void subPtr(ImmPtr imm, RegisterID dest)
+    void subPtr(TrustedImmPtr imm, RegisterID dest)
     {
-        sub32(Imm32(imm), dest);
+        sub32(TrustedImm32(imm), dest);
     }
 
     void xorPtr(RegisterID src, RegisterID dest)
@@ -204,7 +210,7 @@ public:
         xor32(src, dest);
     }
 
-    void xorPtr(Imm32 imm, RegisterID srcDest)
+    void xorPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         xor32(imm, srcDest);
     }
@@ -230,7 +236,7 @@ public:
         return load32WithAddressOffsetPatch(address, dest);
     }
 
-    void setPtr(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void setPtr(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         set32Compare32(cond, left, right, dest);
     }
@@ -250,14 +256,14 @@ public:
         store32(src, address);
     }
 
-    void storePtr(ImmPtr imm, ImplicitAddress address)
+    void storePtr(TrustedImmPtr imm, ImplicitAddress address)
     {
-        store32(Imm32(imm), address);
+        store32(TrustedImm32(imm), address);
     }
 
-    void storePtr(ImmPtr imm, void* address)
+    void storePtr(TrustedImmPtr imm, void* address)
     {
-        store32(Imm32(imm), address);
+        store32(TrustedImm32(imm), address);
     }
 
     DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address)
@@ -271,9 +277,9 @@ public:
         return branch32(cond, left, right);
     }
 
-    Jump branchPtr(Condition cond, RegisterID left, ImmPtr right)
+    Jump branchPtr(Condition cond, RegisterID left, TrustedImmPtr right)
     {
-        return branch32(cond, left, Imm32(right));
+        return branch32(cond, left, TrustedImm32(right));
     }
 
     Jump branchPtr(Condition cond, RegisterID left, Address right)
@@ -291,14 +297,14 @@ public:
         return branch32(cond, left, right);
     }
 
-    Jump branchPtr(Condition cond, Address left, ImmPtr right)
+    Jump branchPtr(Condition cond, Address left, TrustedImmPtr right)
     {
-        return branch32(cond, left, Imm32(right));
+        return branch32(cond, left, TrustedImm32(right));
     }
 
-    Jump branchPtr(Condition cond, AbsoluteAddress left, ImmPtr right)
+    Jump branchPtr(Condition cond, AbsoluteAddress left, TrustedImmPtr right)
     {
-        return branch32(cond, left, Imm32(right));
+        return branch32(cond, left, TrustedImm32(right));
     }
 
     Jump branchTestPtr(Condition cond, RegisterID reg, RegisterID mask)
@@ -306,17 +312,17 @@ public:
         return branchTest32(cond, reg, mask);
     }
 
-    Jump branchTestPtr(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
         return branchTest32(cond, reg, mask);
     }
 
-    Jump branchTestPtr(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         return branchTest32(cond, address, mask);
     }
 
-    Jump branchTestPtr(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
         return branchTest32(cond, address, mask);
     }
@@ -327,12 +333,12 @@ public:
         return branchAdd32(cond, src, dest);
     }
 
-    Jump branchSubPtr(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchSubPtr(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         return branchSub32(cond, imm, dest);
     }
     using MacroAssemblerBase::branchTest8;
-    Jump branchTest8(Condition cond, ExtendedAddress address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, ExtendedAddress address, TrustedImm32 mask = TrustedImm32(-1))
     {
         return MacroAssemblerBase::branchTest8(cond, Address(address.base, address.offset), mask);
     }
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
index 3fcfec8..80f69bf 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -86,14 +86,14 @@ public:
         m_assembler.adds_r(dest, dest, src);
     }
 
-    void add32(Imm32 imm, Address address)
+    void add32(TrustedImm32 imm, Address address)
     {
         load32(address, ARMRegisters::S1);
         add32(imm, ARMRegisters::S1);
         store32(ARMRegisters::S1, address);
     }
 
-    void add32(Imm32 imm, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.adds_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
@@ -109,7 +109,7 @@ public:
         m_assembler.ands_r(dest, dest, src);
     }
 
-    void and32(Imm32 imm, RegisterID dest)
+    void and32(TrustedImm32 imm, RegisterID dest)
     {
         ARMWord w = m_assembler.getImm(imm.m_value, ARMRegisters::S0, true);
         if (w & ARMAssembler::OP2_INV_IMM)
@@ -127,7 +127,7 @@ public:
         m_assembler.movs_r(dest, m_assembler.lsl_r(dest, ARMRegisters::S0));
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.movs_r(dest, m_assembler.lsl(dest, imm.m_value & 0x1f));
     }
@@ -141,7 +141,7 @@ public:
         m_assembler.muls_r(dest, dest, src);
     }
 
-    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         move(imm, ARMRegisters::S0);
         m_assembler.muls_r(dest, src, ARMRegisters::S0);
@@ -162,7 +162,7 @@ public:
         m_assembler.orrs_r(dest, dest, src);
     }
 
-    void or32(Imm32 imm, RegisterID dest)
+    void or32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.orrs_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
@@ -176,7 +176,7 @@ public:
         m_assembler.movs_r(dest, m_assembler.asr_r(dest, ARMRegisters::S0));
     }
 
-    void rshift32(Imm32 imm, RegisterID dest)
+    void rshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.movs_r(dest, m_assembler.asr(dest, imm.m_value & 0x1f));
     }
@@ -190,7 +190,7 @@ public:
         m_assembler.movs_r(dest, m_assembler.lsr_r(dest, ARMRegisters::S0));
     }
     
-    void urshift32(Imm32 imm, RegisterID dest)
+    void urshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.movs_r(dest, m_assembler.lsr(dest, imm.m_value & 0x1f));
     }
@@ -200,12 +200,12 @@ public:
         m_assembler.subs_r(dest, dest, src);
     }
 
-    void sub32(Imm32 imm, RegisterID dest)
+    void sub32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.subs_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
-    void sub32(Imm32 imm, Address address)
+    void sub32(TrustedImm32 imm, Address address)
     {
         load32(address, ARMRegisters::S1);
         sub32(imm, ARMRegisters::S1);
@@ -223,7 +223,7 @@ public:
         m_assembler.eors_r(dest, dest, src);
     }
 
-    void xor32(Imm32 imm, RegisterID dest)
+    void xor32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.eors_r(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
@@ -271,13 +271,6 @@ public:
         return dataLabel;
     }
 
-    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
-    {
-        Label label(this);
-        load32(address, dest);
-        return label;
-    }
-
     void load16(BaseIndex address, RegisterID dest)
     {
         m_assembler.add_r(ARMRegisters::S1, address.base, m_assembler.lsl(address.index, address.scale));
@@ -310,7 +303,7 @@ public:
         m_assembler.baseIndexTransfer32(false, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
-    void store32(Imm32 imm, ImplicitAddress address)
+    void store32(TrustedImm32 imm, ImplicitAddress address)
     {
         if (imm.m_isPointer)
             m_assembler.ldr_un_imm(ARMRegisters::S1, imm.m_value);
@@ -325,7 +318,7 @@ public:
         m_assembler.dtr_u(false, src, ARMRegisters::S0, 0);
     }
 
-    void store32(Imm32 imm, void* address)
+    void store32(TrustedImm32 imm, void* address)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
         if (imm.m_isPointer)
@@ -351,13 +344,13 @@ public:
         push(ARMRegisters::S1);
     }
 
-    void push(Imm32 imm)
+    void push(TrustedImm32 imm)
     {
         move(imm, ARMRegisters::S0);
         push(ARMRegisters::S0);
     }
 
-    void move(Imm32 imm, RegisterID dest)
+    void move(TrustedImm32 imm, RegisterID dest)
     {
         if (imm.m_isPointer)
             m_assembler.ldr_un_imm(dest, imm.m_value);
@@ -370,9 +363,9 @@ public:
         m_assembler.mov_r(dest, src);
     }
 
-    void move(ImmPtr imm, RegisterID dest)
+    void move(TrustedImmPtr imm, RegisterID dest)
     {
-        move(Imm32(imm), dest);
+        move(TrustedImm32(imm), dest);
     }
 
     void swap(RegisterID reg1, RegisterID reg2)
@@ -394,7 +387,7 @@ public:
             move(src, dest);
     }
 
-    Jump branch8(Condition cond, Address left, Imm32 right)
+    Jump branch8(Condition cond, Address left, TrustedImm32 right)
     {
         load8(left, ARMRegisters::S1);
         return branch32(cond, ARMRegisters::S1, right);
@@ -406,7 +399,7 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond), useConstantPool));
     }
 
-    Jump branch32(Condition cond, RegisterID left, Imm32 right, int useConstantPool = 0)
+    Jump branch32(Condition cond, RegisterID left, TrustedImm32 right, int useConstantPool = 0)
     {
         if (right.m_isPointer) {
             m_assembler.ldr_un_imm(ARMRegisters::S0, right.m_value);
@@ -433,19 +426,19 @@ public:
         return branch32(cond, ARMRegisters::S1, right);
     }
 
-    Jump branch32(Condition cond, Address left, Imm32 right)
+    Jump branch32(Condition cond, Address left, TrustedImm32 right)
     {
         load32(left, ARMRegisters::S1);
         return branch32(cond, ARMRegisters::S1, right);
     }
 
-    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         load32(left, ARMRegisters::S1);
         return branch32(cond, ARMRegisters::S1, right);
     }
 
-    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         load32WithUnalignedHalfWords(left, ARMRegisters::S1);
         return branch32(cond, ARMRegisters::S1, right);
@@ -460,7 +453,7 @@ public:
         return jump();
     }
 
-    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch16(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         load16(left, ARMRegisters::S0);
         move(right, ARMRegisters::S1);
@@ -468,7 +461,7 @@ public:
         return m_assembler.jmp(ARMCondition(cond));
     }
 
-    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         load8(address, ARMRegisters::S1);
         return branchTest32(cond, ARMRegisters::S1, mask);
@@ -481,7 +474,7 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
-    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         ARMWord w = m_assembler.getImm(mask.m_value, ARMRegisters::S0, true);
@@ -492,13 +485,13 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
-    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         load32(address, ARMRegisters::S1);
         return branchTest32(cond, ARMRegisters::S1, mask);
     }
 
-    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
         load32(address, ARMRegisters::S1);
         return branchTest32(cond, ARMRegisters::S1, mask);
@@ -526,7 +519,7 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
-    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchAdd32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         add32(imm, dest);
@@ -555,7 +548,7 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
-    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    Jump branchMul32(Condition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         if (cond == Overflow) {
@@ -575,7 +568,7 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
-    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchSub32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         sub32(imm, dest);
@@ -635,7 +628,7 @@ public:
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
-    void set32Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set32Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
         m_assembler.mov_r(dest, ARMAssembler::getOp2(0));
@@ -655,13 +648,13 @@ public:
         set32Compare32(cond, ARMRegisters::S1, right, dest);
     }
 
-    void set8Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set8Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         // ARM doesn't have byte registers
         set32Compare32(cond, left, right, dest);
     }
 
-    void set32Test32(Condition cond, RegisterID reg, Imm32 mask, RegisterID dest)
+    void set32Test32(Condition cond, RegisterID reg, TrustedImm32 mask, RegisterID dest)
     {
         if (mask.m_value == -1)
             m_assembler.cmp_r(0, reg);
@@ -671,24 +664,24 @@ public:
         m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
     }
 
-    void set32Test32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test32(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         load32(address, ARMRegisters::S1);
         set32Test32(cond, ARMRegisters::S1, mask, dest);
     }
 
-    void set32Test8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test8(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         load8(address, ARMRegisters::S1);
         set32Test32(cond, ARMRegisters::S1, mask, dest);
     }
 
-    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.add_r(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
     }
 
-    void add32(Imm32 imm, AbsoluteAddress address)
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S1, reinterpret_cast<ARMWord>(address.m_ptr));
         m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
@@ -697,7 +690,7 @@ public:
         m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
-    void sub32(Imm32 imm, AbsoluteAddress address)
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S1, reinterpret_cast<ARMWord>(address.m_ptr));
         m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
@@ -706,7 +699,7 @@ public:
         m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
-    void load32(void* address, RegisterID dest)
+    void load32(const void* address, RegisterID dest)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
         m_assembler.dtr_u(true, dest, ARMRegisters::S0, 0);
@@ -718,7 +711,7 @@ public:
         return branch32(cond, ARMRegisters::S1, right);
     }
 
-    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    Jump branch32(Condition cond, AbsoluteAddress left, TrustedImm32 right)
     {
         load32(left.m_ptr, ARMRegisters::S1);
         return branch32(cond, ARMRegisters::S1, right);
@@ -755,21 +748,21 @@ public:
         return Call::fromTailJump(oldJump);
     }
 
-    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
     {
         DataLabelPtr dataLabel(this);
         m_assembler.ldr_un_imm(dest, reinterpret_cast<ARMWord>(initialValue.m_value));
         return dataLabel;
     }
 
-    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         dataLabel = moveWithPatch(initialRightValue, ARMRegisters::S1);
         Jump jump = branch32(cond, left, ARMRegisters::S1, true);
         return jump;
     }
 
-    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         load32(left, ARMRegisters::S1);
         dataLabel = moveWithPatch(initialRightValue, ARMRegisters::S0);
@@ -777,7 +770,7 @@ public:
         return jump;
     }
 
-    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
     {
         DataLabelPtr dataLabel = moveWithPatch(initialValue, ARMRegisters::S1);
         store32(ARMRegisters::S1, address);
@@ -786,7 +779,7 @@ public:
 
     DataLabelPtr storePtrWithPatch(ImplicitAddress address)
     {
-        return storePtrWithPatch(ImmPtr(0), address);
+        return storePtrWithPatch(TrustedImmPtr(0), address);
     }
 
     // Floating point operators
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index a3c1301..84e0a5e 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -139,7 +139,7 @@ public:
     // Integer arithmetic operations:
     //
     // Operations are typically two operand - operation(source, srcDst)
-    // For many operations the source may be an Imm32, the srcDst operand
+    // For many operations the source may be an TrustedImm32, the srcDst operand
     // may often be a memory location (explictly described using an Address
     // object).
 
@@ -148,12 +148,12 @@ public:
         m_assembler.add(dest, dest, src);
     }
 
-    void add32(Imm32 imm, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID dest)
     {
         add32(imm, dest, dest);
     }
 
-    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
         if (armImm.isValid())
@@ -164,7 +164,7 @@ public:
         }
     }
 
-    void add32(Imm32 imm, Address address)
+    void add32(TrustedImm32 imm, Address address)
     {
         load32(address, dataTempRegister);
 
@@ -187,7 +187,7 @@ public:
         add32(dataTempRegister, dest);
     }
 
-    void add32(Imm32 imm, AbsoluteAddress address)
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
     {
         load32(address.m_ptr, dataTempRegister);
 
@@ -209,7 +209,7 @@ public:
         m_assembler.ARM_and(dest, dest, src);
     }
 
-    void and32(Imm32 imm, RegisterID dest)
+    void and32(TrustedImm32 imm, RegisterID dest)
     {
         ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
         if (armImm.isValid())
@@ -235,7 +235,7 @@ public:
         m_assembler.lsl(dest, dest, dataTempRegister);
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.lsl(dest, dest, imm.m_value & 0x1f);
     }
@@ -245,7 +245,7 @@ public:
         m_assembler.smull(dest, dataTempRegister, dest, src);
     }
 
-    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         move(imm, dataTempRegister);
         m_assembler.smull(dest, dataTempRegister, src, dataTempRegister);
@@ -266,7 +266,7 @@ public:
         m_assembler.orr(dest, dest, src);
     }
 
-    void or32(Imm32 imm, RegisterID dest)
+    void or32(TrustedImm32 imm, RegisterID dest)
     {
         ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
         if (armImm.isValid())
@@ -287,7 +287,7 @@ public:
         m_assembler.asr(dest, dest, dataTempRegister);
     }
 
-    void rshift32(Imm32 imm, RegisterID dest)
+    void rshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.asr(dest, dest, imm.m_value & 0x1f);
     }
@@ -302,7 +302,7 @@ public:
         m_assembler.lsr(dest, dest, dataTempRegister);
     }
     
-    void urshift32(Imm32 imm, RegisterID dest)
+    void urshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.lsr(dest, dest, imm.m_value & 0x1f);
     }
@@ -312,7 +312,7 @@ public:
         m_assembler.sub(dest, dest, src);
     }
 
-    void sub32(Imm32 imm, RegisterID dest)
+    void sub32(TrustedImm32 imm, RegisterID dest)
     {
         ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
         if (armImm.isValid())
@@ -323,7 +323,7 @@ public:
         }
     }
 
-    void sub32(Imm32 imm, Address address)
+    void sub32(TrustedImm32 imm, Address address)
     {
         load32(address, dataTempRegister);
 
@@ -346,7 +346,7 @@ public:
         sub32(dataTempRegister, dest);
     }
 
-    void sub32(Imm32 imm, AbsoluteAddress address)
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
     {
         load32(address.m_ptr, dataTempRegister);
 
@@ -368,7 +368,7 @@ public:
         m_assembler.eor(dest, dest, src);
     }
 
-    void xor32(Imm32 imm, RegisterID dest)
+    void xor32(TrustedImm32 imm, RegisterID dest)
     {
         ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
         if (armImm.isValid())
@@ -383,7 +383,7 @@ public:
     // Memory access operations:
     //
     // Loads are of the form load(address, destination) and stores of the form
-    // store(source, address).  The source for a store may be an Imm32.  Address
+    // store(source, address).  The source for a store may be an TrustedImm32.  Address
     // operand objects to loads and store will be implicitly constructed if a
     // register is passed.
 
@@ -460,9 +460,9 @@ public:
         load32(setupArmAddress(address), dest);
     }
 
-    void load32(void* address, RegisterID dest)
+    void load32(const void* address, RegisterID dest)
     {
-        move(ImmPtr(address), addressTempRegister);
+        move(TrustedImmPtr(address), addressTempRegister);
         m_assembler.ldr(dest, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
     }
 
@@ -473,15 +473,7 @@ public:
 
     DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
     {
-        DataLabel32 label = moveWithPatch(Imm32(address.offset), dataTempRegister);
-        load32(ArmAddress(address.base, dataTempRegister), dest);
-        return label;
-    }
-
-    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
-    {
-        Label label(this);
-        moveFixedWidthEncoding(Imm32(address.offset), dataTempRegister);
+        DataLabel32 label = moveWithPatch(TrustedImm32(address.offset), dataTempRegister);
         load32(ArmAddress(address.base, dataTempRegister), dest);
         return label;
     }
@@ -497,14 +489,14 @@ public:
         if (armImm.isValid())
             m_assembler.ldrh(dest, address.base, armImm);
         else {
-            move(Imm32(address.offset), dataTempRegister);
+            move(TrustedImm32(address.offset), dataTempRegister);
             m_assembler.ldrh(dest, address.base, dataTempRegister);
         }
     }
 
     DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
     {
-        DataLabel32 label = moveWithPatch(Imm32(address.offset), dataTempRegister);
+        DataLabel32 label = moveWithPatch(TrustedImm32(address.offset), dataTempRegister);
         store32(src, ArmAddress(address.base, dataTempRegister));
         return label;
     }
@@ -519,19 +511,19 @@ public:
         store32(src, setupArmAddress(address));
     }
 
-    void store32(Imm32 imm, ImplicitAddress address)
+    void store32(TrustedImm32 imm, ImplicitAddress address)
     {
         move(imm, dataTempRegister);
         store32(dataTempRegister, setupArmAddress(address));
     }
 
-    void store32(RegisterID src, void* address)
+    void store32(RegisterID src, const void* address)
     {
-        move(ImmPtr(address), addressTempRegister);
+        move(TrustedImmPtr(address), addressTempRegister);
         m_assembler.str(src, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
     }
 
-    void store32(Imm32 imm, void* address)
+    void store32(TrustedImm32 imm, const void* address)
     {
         move(imm, dataTempRegister);
         store32(dataTempRegister, address);
@@ -566,7 +558,7 @@ public:
 
         // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
         if ((offset & 3) || (offset > (255 * 4)) || (offset < -(255 * 4))) {
-            add32(Imm32(offset), base, addressTempRegister);
+            add32(TrustedImm32(offset), base, addressTempRegister);
             base = addressTempRegister;
             offset = 0;
         }
@@ -576,7 +568,7 @@ public:
 
     void loadDouble(const void* address, FPRegisterID dest)
     {
-        move(ImmPtr(address), addressTempRegister);
+        move(TrustedImmPtr(address), addressTempRegister);
         m_assembler.vldr(dest, addressTempRegister, 0);
     }
 
@@ -587,7 +579,7 @@ public:
 
         // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
         if ((offset & 3) || (offset > (255 * 4)) || (offset < -(255 * 4))) {
-            add32(Imm32(offset), base, addressTempRegister);
+            add32(TrustedImm32(offset), base, addressTempRegister);
             base = addressTempRegister;
             offset = 0;
         }
@@ -756,7 +748,7 @@ public:
         push(dataTempRegister);
     }
 
-    void push(Imm32 imm)
+    void push(TrustedImm32 imm)
     {
         move(imm, dataTempRegister);
         push(dataTempRegister);
@@ -766,7 +758,7 @@ public:
     //
     // Move values in registers.
 
-    void move(Imm32 imm, RegisterID dest)
+    void move(TrustedImm32 imm, RegisterID dest)
     {
         uint32_t value = imm.m_value;
 
@@ -792,9 +784,9 @@ public:
         m_assembler.mov(dest, src);
     }
 
-    void move(ImmPtr imm, RegisterID dest)
+    void move(TrustedImmPtr imm, RegisterID dest)
     {
-        move(Imm32(imm), dest);
+        move(TrustedImm32(imm), dest);
     }
 
     void swap(RegisterID reg1, RegisterID reg2)
@@ -829,7 +821,7 @@ public:
     // used (representing the names 'below' and 'above').
     //
     // Operands to the comparision are provided in the expected order, e.g.
-    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // jle32(reg1, TrustedImm32(5)) will branch if the value held in reg1, when
     // treated as a signed 32bit value, is less than or equal to 5.
     //
     // jz and jnz test whether the first operand is equal to zero, and take
@@ -837,7 +829,7 @@ public:
 private:
 
     // Should we be using TEQ for equal/not-equal?
-    void compare32(RegisterID left, Imm32 right)
+    void compare32(RegisterID left, TrustedImm32 right)
     {
         int32_t imm = right.m_value;
         if (!imm)
@@ -849,13 +841,13 @@ private:
             else if ((armImm = ARMThumbImmediate::makeEncodedImm(-imm)).isValid())
                 m_assembler.cmn(left, armImm);
             else {
-                move(Imm32(imm), dataTempRegister);
+                move(TrustedImm32(imm), dataTempRegister);
                 m_assembler.cmp(left, dataTempRegister);
             }
         }
     }
 
-    void test32(RegisterID reg, Imm32 mask)
+    void test32(RegisterID reg, TrustedImm32 mask)
     {
         int32_t imm = mask.m_value;
 
@@ -879,7 +871,7 @@ public:
         return Jump(makeBranch(cond));
     }
 
-    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    Jump branch32(Condition cond, RegisterID left, TrustedImm32 right)
     {
         compare32(left, right);
         return Jump(makeBranch(cond));
@@ -897,21 +889,21 @@ public:
         return branch32(cond, dataTempRegister, right);
     }
 
-    Jump branch32(Condition cond, Address left, Imm32 right)
+    Jump branch32(Condition cond, Address left, TrustedImm32 right)
     {
         // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
         load32(left, addressTempRegister);
         return branch32(cond, addressTempRegister, right);
     }
 
-    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
         load32(left, addressTempRegister);
         return branch32(cond, addressTempRegister, right);
     }
 
-    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
         load32WithUnalignedHalfWords(left, addressTempRegister);
@@ -924,7 +916,7 @@ public:
         return branch32(cond, dataTempRegister, right);
     }
 
-    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    Jump branch32(Condition cond, AbsoluteAddress left, TrustedImm32 right)
     {
         // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
         load32(left.m_ptr, addressTempRegister);
@@ -939,21 +931,21 @@ public:
         return branch32(cond, dataTempRegister, addressTempRegister);
     }
 
-    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch16(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
         load16(left, addressTempRegister);
         m_assembler.lsl(addressTempRegister, addressTempRegister, 16);
-        return branch32(cond, addressTempRegister, Imm32(right.m_value << 16));
+        return branch32(cond, addressTempRegister, TrustedImm32(right.m_value << 16));
     }
 
-    Jump branch8(Condition cond, RegisterID left, Imm32 right)
+    Jump branch8(Condition cond, RegisterID left, TrustedImm32 right)
     {
         compare32(left, right);
         return Jump(makeBranch(cond));
     }
 
-    Jump branch8(Condition cond, Address left, Imm32 right)
+    Jump branch8(Condition cond, Address left, TrustedImm32 right)
     {
         // use addressTempRegister incase the branch8 we call uses dataTempRegister. :-/
         load8(left, addressTempRegister);
@@ -967,14 +959,14 @@ public:
         return Jump(makeBranch(cond));
     }
 
-    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         test32(reg, mask);
         return Jump(makeBranch(cond));
     }
 
-    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         // use addressTempRegister incase the branchTest32 we call uses dataTempRegister. :-/
@@ -982,7 +974,7 @@ public:
         return branchTest32(cond, addressTempRegister, mask);
     }
 
-    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         // use addressTempRegister incase the branchTest32 we call uses dataTempRegister. :-/
@@ -990,14 +982,14 @@ public:
         return branchTest32(cond, addressTempRegister, mask);
     }
 
-    Jump branchTest8(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         test32(reg, mask);
         return Jump(makeBranch(cond));
     }
 
-    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         // use addressTempRegister incase the branchTest8 we call uses dataTempRegister. :-/
@@ -1040,7 +1032,7 @@ public:
         return Jump(makeBranch(cond));
     }
 
-    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchAdd32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
@@ -1061,7 +1053,7 @@ public:
         return branch32(NotEqual, addressTempRegister, dataTempRegister);
     }
 
-    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    Jump branchMul32(Condition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         ASSERT_UNUSED(cond, cond == Overflow);
         move(imm, dataTempRegister);
@@ -1084,7 +1076,7 @@ public:
         return Jump(makeBranch(cond));
     }
 
-    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchSub32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
@@ -1119,13 +1111,13 @@ public:
 
     Call nearCall()
     {
-        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
         return Call(m_assembler.blx(dataTempRegister, ARMv7Assembler::JumpFixed), Call::LinkableNear);
     }
 
     Call call()
     {
-        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
         return Call(m_assembler.blx(dataTempRegister, ARMv7Assembler::JumpFixed), Call::Linkable);
     }
 
@@ -1159,7 +1151,7 @@ public:
         set32Compare32(cond, dataTempRegister, right, dest);
     }
 
-    void set32Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set32Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         compare32(left, right);
         m_assembler.it(armV7Condition(cond), false);
@@ -1177,7 +1169,7 @@ public:
         set32Compare32(cond, left, right, dest);
     }
 
-    void set8Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set8Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         set32Compare32(cond, left, right, dest);
     }
@@ -1186,7 +1178,7 @@ public:
     // The mask should be optional... paerhaps the argument order should be
     // dest-src, operations always have a dest? ... possibly not true, considering
     // asm ops like test, or pseudo ops like pop().
-    void set32Test32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test32(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         load32(address, dataTempRegister);
         test32(dataTempRegister, mask);
@@ -1195,7 +1187,7 @@ public:
         m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
     }
 
-    void set32Test8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test8(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         load8(address, dataTempRegister);
         test32(dataTempRegister, mask);
@@ -1204,44 +1196,44 @@ public:
         m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
     }
 
-    DataLabel32 moveWithPatch(Imm32 imm, RegisterID dst)
+    DataLabel32 moveWithPatch(TrustedImm32 imm, RegisterID dst)
     {
         moveFixedWidthEncoding(imm, dst);
         return DataLabel32(this);
     }
 
-    DataLabelPtr moveWithPatch(ImmPtr imm, RegisterID dst)
+    DataLabelPtr moveWithPatch(TrustedImmPtr imm, RegisterID dst)
     {
-        moveFixedWidthEncoding(Imm32(imm), dst);
+        moveFixedWidthEncoding(TrustedImm32(imm), dst);
         return DataLabelPtr(this);
     }
 
-    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
         return branch32(cond, left, dataTempRegister);
     }
 
-    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         load32(left, addressTempRegister);
         dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
         return branch32(cond, addressTempRegister, dataTempRegister);
     }
 
-    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
     {
         DataLabelPtr label = moveWithPatch(initialValue, dataTempRegister);
         store32(dataTempRegister, address);
         return label;
     }
-    DataLabelPtr storePtrWithPatch(ImplicitAddress address) { return storePtrWithPatch(ImmPtr(0), address); }
+    DataLabelPtr storePtrWithPatch(ImplicitAddress address) { return storePtrWithPatch(TrustedImmPtr(0), address); }
 
 
     Call tailRecursiveCall()
     {
         // Like a normal call, but don't link.
-        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
         return Call(m_assembler.bx(dataTempRegister, ARMv7Assembler::JumpFixed), Call::Linkable);
     }
 
@@ -1265,14 +1257,14 @@ protected:
 
     ARMv7Assembler::JmpSrc makeJump()
     {
-        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
         return m_assembler.bx(dataTempRegister, inUninterruptedSequence() ? ARMv7Assembler::JumpNoConditionFixedSize : ARMv7Assembler::JumpNoCondition);
     }
 
     ARMv7Assembler::JmpSrc makeBranch(ARMv7Assembler::Condition cond)
     {
         m_assembler.it(cond, true, true);
-        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
         return m_assembler.bx(dataTempRegister, inUninterruptedSequence() ? ARMv7Assembler::JumpConditionFixedSize : ARMv7Assembler::JumpCondition, cond);
     }
     ARMv7Assembler::JmpSrc makeBranch(Condition cond) { return makeBranch(armV7Condition(cond)); }
@@ -1285,7 +1277,7 @@ protected:
             if (imm.isValid())
                 m_assembler.add(addressTempRegister, address.base, imm);
             else {
-                move(Imm32(address.offset), addressTempRegister);
+                move(TrustedImm32(address.offset), addressTempRegister);
                 m_assembler.add(addressTempRegister, addressTempRegister, address.base);
             }
 
@@ -1299,7 +1291,7 @@ protected:
         if ((address.offset >= -0xff) && (address.offset <= 0xfff))
             return ArmAddress(address.base, address.offset);
 
-        move(Imm32(address.offset), addressTempRegister);
+        move(TrustedImm32(address.offset), addressTempRegister);
         return ArmAddress(address.base, addressTempRegister);
     }
 
@@ -1308,7 +1300,7 @@ protected:
         if ((address.offset >= -0xff) && (address.offset <= 0xfff))
             return ArmAddress(address.base, address.offset);
 
-        move(Imm32(address.offset), addressTempRegister);
+        move(TrustedImm32(address.offset), addressTempRegister);
         return ArmAddress(address.base, addressTempRegister);
     }
 
@@ -1321,14 +1313,14 @@ protected:
         if (imm.isValid())
             m_assembler.add(addressTempRegister, address.base, imm);
         else {
-            move(Imm32(address.offset), addressTempRegister);
+            move(TrustedImm32(address.offset), addressTempRegister);
             m_assembler.add(addressTempRegister, addressTempRegister, address.base);
         }
 
         return addressTempRegister;
     }
 
-    void moveFixedWidthEncoding(Imm32 imm, RegisterID dst)
+    void moveFixedWidthEncoding(TrustedImm32 imm, RegisterID dst)
     {
         uint32_t value = imm.m_value;
         m_assembler.movT3(dst, ARMThumbImmediate::makeUInt16(value & 0xffff));
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index 543b0fa..2183b22 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -65,15 +65,47 @@ public:
     {
     }
 
+    template<typename returnType>
+    FunctionPtr(returnType(*value)())
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1>
+    FunctionPtr(returnType(*value)(argType1))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2>
+    FunctionPtr(returnType(*value)(argType1, argType2))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2, typename argType3>
+    FunctionPtr(returnType(*value)(argType1, argType2, argType3))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2, typename argType3, typename argType4>
+    FunctionPtr(returnType(*value)(argType1, argType2, argType3, argType4))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
     template<typename FunctionType>
     explicit FunctionPtr(FunctionType* value)
-#if COMPILER(RVCT)
-     // RVTC compiler needs C-style cast as it fails with the following error
-     // Error:  #694: reinterpret_cast cannot cast away const or other type qualifiers
-        : m_value((void*)(value))
-#else
-        : m_value(reinterpret_cast<void*>(value))
-#endif
+        // Using a C-ctyle cast here to avoid compiler error on RVTC:
+        // Error:  #694: reinterpret_cast cannot cast away const or other type qualifiers
+        // (I guess on RVTC function pointers have a different constness to GCC/MSVC?)
+        : m_value((void*)value)
     {
         ASSERT_VALID_CODE_POINTER(m_value);
     }
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h b/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
index fcfbcda..1bcec38 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
@@ -95,7 +95,7 @@ public:
     // Integer arithmetic operations:
     //
     // Operations are typically two operand - operation(source, srcDst)
-    // For many operations the source may be an Imm32, the srcDst operand
+    // For many operations the source may be an TrustedImm32, the srcDst operand
     // may often be a memory location (explictly described using an Address
     // object).
 
@@ -104,12 +104,12 @@ public:
         m_assembler.addu(dest, dest, src);
     }
 
-    void add32(Imm32 imm, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID dest)
     {
         add32(imm, dest, dest);
     }
 
-    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         if (!imm.m_isPointer && imm.m_value >= -32768 && imm.m_value <= 32767
             && !m_fixedWidth) {
@@ -127,7 +127,7 @@ public:
         }
     }
 
-    void add32(Imm32 imm, Address address)
+    void add32(TrustedImm32 imm, Address address)
     {
         if (address.offset >= -32768 && address.offset <= 32767
             && !m_fixedWidth) {
@@ -207,7 +207,7 @@ public:
         }
     }
 
-    void add32(Imm32 imm, AbsoluteAddress address)
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
     {
         /*
            li   addrTemp, address
@@ -216,7 +216,7 @@ public:
            addu dataTemp, dataTemp, immTemp
            sw   dataTemp, 0(addrTemp)
         */
-        move(ImmPtr(address.m_ptr), addrTempRegister);
+        move(TrustedImmPtr(address.m_ptr), addrTempRegister);
         m_assembler.lw(dataTempRegister, addrTempRegister, 0);
         if (!imm.m_isPointer && imm.m_value >= -32768 && imm.m_value <= 32767
             && !m_fixedWidth)
@@ -233,7 +233,7 @@ public:
         m_assembler.andInsn(dest, dest, src);
     }
 
-    void and32(Imm32 imm, RegisterID dest)
+    void and32(TrustedImm32 imm, RegisterID dest)
     {
         if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
             move(MIPSRegisters::zero, dest);
@@ -250,7 +250,7 @@ public:
         }
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void lshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.sll(dest, dest, imm.m_value);
     }
@@ -265,7 +265,7 @@ public:
         m_assembler.mul(dest, dest, src);
     }
 
-    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
             move(MIPSRegisters::zero, dest);
@@ -296,7 +296,7 @@ public:
         m_assembler.orInsn(dest, dest, src);
     }
 
-    void or32(Imm32 imm, RegisterID dest)
+    void or32(TrustedImm32 imm, RegisterID dest)
     {
         if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
             return;
@@ -320,7 +320,7 @@ public:
         m_assembler.srav(dest, dest, shiftAmount);
     }
 
-    void rshift32(Imm32 imm, RegisterID dest)
+    void rshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.sra(dest, dest, imm.m_value);
     }
@@ -330,7 +330,7 @@ public:
         m_assembler.srlv(dest, dest, shiftAmount);
     }
 
-    void urshift32(Imm32 imm, RegisterID dest)
+    void urshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.srl(dest, dest, imm.m_value);
     }
@@ -340,7 +340,7 @@ public:
         m_assembler.subu(dest, dest, src);
     }
 
-    void sub32(Imm32 imm, RegisterID dest)
+    void sub32(TrustedImm32 imm, RegisterID dest)
     {
         if (!imm.m_isPointer && imm.m_value >= -32767 && imm.m_value <= 32768
             && !m_fixedWidth) {
@@ -358,7 +358,7 @@ public:
         }
     }
 
-    void sub32(Imm32 imm, Address address)
+    void sub32(TrustedImm32 imm, Address address)
     {
         if (address.offset >= -32768 && address.offset <= 32767
             && !m_fixedWidth) {
@@ -413,7 +413,7 @@ public:
         sub32(dataTempRegister, dest);
     }
 
-    void sub32(Imm32 imm, AbsoluteAddress address)
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
     {
         /*
            li   addrTemp, address
@@ -422,7 +422,7 @@ public:
            subu dataTemp, dataTemp, immTemp
            sw   dataTemp, 0(addrTemp)
         */
-        move(ImmPtr(address.m_ptr), addrTempRegister);
+        move(TrustedImmPtr(address.m_ptr), addrTempRegister);
         m_assembler.lw(dataTempRegister, addrTempRegister, 0);
 
         if (!imm.m_isPointer && imm.m_value >= -32767 && imm.m_value <= 32768
@@ -441,7 +441,7 @@ public:
         m_assembler.xorInsn(dest, dest, src);
     }
 
-    void xor32(Imm32 imm, RegisterID dest)
+    void xor32(TrustedImm32 imm, RegisterID dest)
     {
         /*
             li  immTemp, imm
@@ -459,7 +459,7 @@ public:
     // Memory access operations:
     //
     // Loads are of the form load(address, destination) and stores of the form
-    // store(source, address).  The source for a store may be an Imm32.  Address
+    // store(source, address).  The source for a store may be an TrustedImm32.  Address
     // operand objects to loads and store will be implicitly constructed if a
     // register is passed.
 
@@ -581,13 +581,13 @@ public:
         }
     }
 
-    void load32(void* address, RegisterID dest)
+    void load32(const void* address, RegisterID dest)
     {
         /*
             li  addrTemp, address
             lw  dest, 0(addrTemp)
         */
-        move(ImmPtr(address), addrTempRegister);
+        move(TrustedImmPtr(address), addrTempRegister);
         m_assembler.lw(dest, addrTempRegister, 0);
     }
 
@@ -601,30 +601,13 @@ public:
             lw  dest, 0(addrTemp)
         */
         DataLabel32 dataLabel(this);
-        move(Imm32(address.offset), addrTempRegister);
+        move(TrustedImm32(address.offset), addrTempRegister);
         m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
         m_assembler.lw(dest, addrTempRegister, 0);
         m_fixedWidth = false;
         return dataLabel;
     }
 
-    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
-    {
-        m_fixedWidth = true;
-        /*
-            lui         addrTemp, address.offset >> 16
-            ori         addrTemp, addrTemp, address.offset & 0xffff
-            addu        addrTemp, addrTemp, address.base
-            lw          dest, 0(addrTemp)
-        */
-        Label label(this);
-        move(Imm32(address.offset), addrTempRegister);
-        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
-        m_assembler.lw(dest, addrTempRegister, 0);
-        m_fixedWidth = false;
-        return label;
-    }
-
     /* Need to use zero-extened load half-word for load16.  */
     void load16(ImplicitAddress address, RegisterID dest)
     {
@@ -683,7 +666,7 @@ public:
             sw  src, 0(addrTemp)
         */
         DataLabel32 dataLabel(this);
-        move(Imm32(address.offset), addrTempRegister);
+        move(TrustedImm32(address.offset), addrTempRegister);
         m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
         m_assembler.sw(src, addrTempRegister, 0);
         m_fixedWidth = false;
@@ -736,7 +719,7 @@ public:
         }
     }
 
-    void store32(Imm32 imm, ImplicitAddress address)
+    void store32(TrustedImm32 imm, ImplicitAddress address)
     {
         if (address.offset >= -32768 && address.offset <= 32767
             && !m_fixedWidth) {
@@ -766,17 +749,17 @@ public:
         }
     }
 
-    void store32(RegisterID src, void* address)
+    void store32(RegisterID src, const void* address)
     {
         /*
             li  addrTemp, address
             sw  src, 0(addrTemp)
         */
-        move(ImmPtr(address), addrTempRegister);
+        move(TrustedImmPtr(address), addrTempRegister);
         m_assembler.sw(src, addrTempRegister, 0);
     }
 
-    void store32(Imm32 imm, void* address)
+    void store32(TrustedImm32 imm, const void* address)
     {
         /*
             li  immTemp, imm
@@ -784,11 +767,11 @@ public:
             sw  src, 0(addrTemp)
         */
         if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth) {
-            move(ImmPtr(address), addrTempRegister);
+            move(TrustedImmPtr(address), addrTempRegister);
             m_assembler.sw(MIPSRegisters::zero, addrTempRegister, 0);
         } else {
             move(imm, immTempRegister);
-            move(ImmPtr(address), addrTempRegister);
+            move(TrustedImmPtr(address), addrTempRegister);
             m_assembler.sw(immTempRegister, addrTempRegister, 0);
         }
     }
@@ -848,7 +831,7 @@ public:
         push(dataTempRegister);
     }
 
-    void push(Imm32 imm)
+    void push(TrustedImm32 imm)
     {
         move(imm, immTempRegister);
         push(immTempRegister);
@@ -858,7 +841,7 @@ public:
     //
     // Move values in registers.
 
-    void move(Imm32 imm, RegisterID dest)
+    void move(TrustedImm32 imm, RegisterID dest)
     {
         if (!imm.m_isPointer && !imm.m_value && !m_fixedWidth)
             move(MIPSRegisters::zero, dest);
@@ -875,9 +858,9 @@ public:
             m_assembler.move(dest, src);
     }
 
-    void move(ImmPtr imm, RegisterID dest)
+    void move(TrustedImmPtr imm, RegisterID dest)
     {
-        move(Imm32(imm), dest);
+        move(TrustedImm32(imm), dest);
     }
 
     void swap(RegisterID reg1, RegisterID reg2)
@@ -911,13 +894,13 @@ public:
     // used (representing the names 'below' and 'above').
     //
     // Operands to the comparision are provided in the expected order, e.g.
-    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // jle32(reg1, TrustedImm32(5)) will branch if the value held in reg1, when
     // treated as a signed 32bit value, is less than or equal to 5.
     //
     // jz and jnz test whether the first operand is equal to zero, and take
     // an optional second operand of a mask under which to perform the test.
 
-    Jump branch8(Condition cond, Address left, Imm32 right)
+    Jump branch8(Condition cond, Address left, TrustedImm32 right)
     {
         // Make sure the immediate value is unsigned 8 bits.
         ASSERT(!(right.m_value & 0xFFFFFF00));
@@ -1002,7 +985,7 @@ public:
         return Jump();
     }
 
-    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    Jump branch32(Condition cond, RegisterID left, TrustedImm32 right)
     {
         move(right, immTempRegister);
         return branch32(cond, left, immTempRegister);
@@ -1020,14 +1003,14 @@ public:
         return branch32(cond, dataTempRegister, right);
     }
 
-    Jump branch32(Condition cond, Address left, Imm32 right)
+    Jump branch32(Condition cond, Address left, TrustedImm32 right)
     {
         load32(left, dataTempRegister);
         move(right, immTempRegister);
         return branch32(cond, dataTempRegister, immTempRegister);
     }
 
-    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         load32(left, dataTempRegister);
         // Be careful that the previous load32() uses immTempRegister.
@@ -1036,7 +1019,7 @@ public:
         return branch32(cond, dataTempRegister, immTempRegister);
     }
 
-    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         load32WithUnalignedHalfWords(left, dataTempRegister);
         // Be careful that the previous load32WithUnalignedHalfWords()
@@ -1052,7 +1035,7 @@ public:
         return branch32(cond, dataTempRegister, right);
     }
 
-    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    Jump branch32(Condition cond, AbsoluteAddress left, TrustedImm32 right)
     {
         load32(left.m_ptr, dataTempRegister);
         move(right, immTempRegister);
@@ -1065,7 +1048,7 @@ public:
         return branch32(cond, dataTempRegister, right);
     }
 
-    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch16(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         ASSERT(!(right.m_value & 0xFFFF0000));
         load16(left, dataTempRegister);
@@ -1084,7 +1067,7 @@ public:
         return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
     }
 
-    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         if (mask.m_value == -1 && !m_fixedWidth) {
@@ -1096,19 +1079,19 @@ public:
         return branchTest32(cond, reg, immTempRegister);
     }
 
-    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         load32(address, dataTempRegister);
         return branchTest32(cond, dataTempRegister, mask);
     }
 
-    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
         load32(address, dataTempRegister);
         return branchTest32(cond, dataTempRegister, mask);
     }
 
-    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         load8(address, dataTempRegister);
         return branchTest32(cond, dataTempRegister, mask);
@@ -1191,7 +1174,7 @@ public:
         return Jump();
     }
 
-    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchAdd32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         move(imm, immTempRegister);
         return branchAdd32(cond, immTempRegister, dest);
@@ -1242,7 +1225,7 @@ public:
         return Jump();
     }
 
-    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    Jump branchMul32(Condition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         move(imm, immTempRegister);
         move(src, dest);
@@ -1296,7 +1279,7 @@ public:
         return Jump();
     }
 
-    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchSub32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         move(imm, immTempRegister);
         return branchSub32(cond, immTempRegister, dest);
@@ -1377,7 +1360,7 @@ public:
         set32Compare32(cond, left, right, dest);
     }
 
-    void set8Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set8Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         move(right, immTempRegister);
         set32Compare32(cond, left, immTempRegister, dest);
@@ -1434,13 +1417,13 @@ public:
         }
     }
 
-    void set32Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set32Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         move(right, immTempRegister);
         set32Compare32(cond, left, immTempRegister, dest);
     }
 
-    void set32Test8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test8(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         load8(address, dataTempRegister);
@@ -1460,7 +1443,7 @@ public:
         }
     }
 
-    void set32Test32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test32(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         ASSERT((cond == Zero) || (cond == NonZero));
         load32(address, dataTempRegister);
@@ -1480,7 +1463,7 @@ public:
         }
     }
 
-    DataLabel32 moveWithPatch(Imm32 imm, RegisterID dest)
+    DataLabel32 moveWithPatch(TrustedImm32 imm, RegisterID dest)
     {
         m_fixedWidth = true;
         DataLabel32 label(this);
@@ -1489,7 +1472,7 @@ public:
         return label;
     }
 
-    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
     {
         m_fixedWidth = true;
         DataLabelPtr label(this);
@@ -1498,7 +1481,7 @@ public:
         return label;
     }
 
-    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         m_fixedWidth = true;
         dataLabel = moveWithPatch(initialRightValue, immTempRegister);
@@ -1507,7 +1490,7 @@ public:
         return temp;
     }
 
-    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         m_fixedWidth = true;
         load32(left, dataTempRegister);
@@ -1517,7 +1500,7 @@ public:
         return temp;
     }
 
-    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
     {
         m_fixedWidth = true;
         DataLabelPtr dataLabel = moveWithPatch(initialValue, dataTempRegister);
@@ -1528,14 +1511,14 @@ public:
 
     DataLabelPtr storePtrWithPatch(ImplicitAddress address)
     {
-        return storePtrWithPatch(ImmPtr(0), address);
+        return storePtrWithPatch(TrustedImmPtr(0), address);
     }
 
     Call tailRecursiveCall()
     {
         // Like a normal call, but don't update the returned address register
         m_fixedWidth = true;
-        move(Imm32(0), MIPSRegisters::t9);
+        move(TrustedImm32(0), MIPSRegisters::t9);
         m_assembler.jr(MIPSRegisters::t9);
         m_assembler.nop();
         m_fixedWidth = false;
@@ -1557,7 +1540,7 @@ public:
             lwc1        dest, 0(addrTemp)
             lwc1        dest+1, 4(addrTemp)
          */
-        move(Imm32(address.offset), addrTempRegister);
+        move(TrustedImm32(address.offset), addrTempRegister);
         m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
         m_assembler.lwc1(dest, addrTempRegister, 0);
         m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, 4);
@@ -1586,7 +1569,7 @@ public:
             lwc1        dest, 0(addrTemp)
             lwc1        dest+1, 4(addrTemp)
          */
-        move(ImmPtr(address), addrTempRegister);
+        move(TrustedImmPtr(address), addrTempRegister);
         m_assembler.lwc1(dest, addrTempRegister, 0);
         m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, 4);
 #else
@@ -1594,7 +1577,7 @@ public:
             li          addrTemp, address
             ldc1        dest, 0(addrTemp)
         */
-        move(ImmPtr(address), addrTempRegister);
+        move(TrustedImmPtr(address), addrTempRegister);
         m_assembler.ldc1(dest, addrTempRegister, 0);
 #endif
     }
@@ -1609,7 +1592,7 @@ public:
             swc1        dest, 0(addrTemp)
             swc1        dest+1, 4(addrTemp)
          */
-        move(Imm32(address.offset), addrTempRegister);
+        move(TrustedImm32(address.offset), addrTempRegister);
         m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
         m_assembler.swc1(src, addrTempRegister, 0);
         m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, 4);
@@ -1796,7 +1779,7 @@ public:
     {
         m_assembler.truncwd(fpTempRegister, src);
         m_assembler.mfc1(dest, fpTempRegister);
-        return branch32(Equal, dest, Imm32(0x7fffffff));
+        return branch32(Equal, dest, TrustedImm32(0x7fffffff));
     }
 
     // Convert 'src' to an integer, and places the resulting 'dest'.
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerSH4.cpp b/Source/JavaScriptCore/assembler/MacroAssemblerSH4.cpp
new file mode 100644
index 0000000..f718845
--- /dev/null
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerSH4.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2011 STMicroelectronics. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+
+#if ENABLE(ASSEMBLER) && CPU(SH4)
+
+#include "MacroAssemblerSH4.h"
+
+namespace JSC {
+const Condition MacroAssemblerSH4::Equal = SH4Assembler::EQ;
+const Condition MacroAssemblerSH4::NotEqual = SH4Assembler::NE;
+const Condition MacroAssemblerSH4::GreaterThan = SH4Assembler::GT;
+const Condition MacroAssemblerSH4::GreaterThanOrEqual = SH4Assembler::GE;
+const Condition MacroAssemblerSH4::LessThan = SH4Assembler::LT;
+const Condition MacroAssemblerSH4::LessThanOrEqual = SH4Assembler::LE;
+const Condition MacroAssemblerSH4::UGreaterThan = SH4Assembler::HI;
+const Condition MacroAssemblerSH4::UGreaterThanOrEqual = SH4Assembler::HS;
+const Condition MacroAssemblerSH4::ULessThan = SH4Assembler::LI;
+const Condition MacroAssemblerSH4::ULessThanOrEqual = SH4Assembler::LS;
+const Condition MacroAssemblerSH4::Zero = SH4Assembler::EQ;
+const Condition MacroAssemblerSH4::NonZero = SH4Assembler::NE;
+const Condition MacroAssemblerSH4::Overflow = SH4Assembler::OF;
+const Condition MacroAssemblerSH4::Above = SH4Assembler::HI;
+const Condition MacroAssemblerSH4::AboveOrEqual = SH4Assembler::HS;
+const Condition MacroAssemblerSH4::Below = SH4Assembler::LI;
+const Condition MacroAssemblerSH4::BelowOrEqual = SH4Assembler::LS;
+const Condition MacroAssemblerSH4::DoubleEqual = SH4Assembler::EQ;
+const Condition MacroAssemblerSH4::DoubleNotEqual = SH4Assembler::NE;
+const Condition MacroAssemblerSH4::DoubleGreaterThan = SH4Assembler::GT;
+const Condition MacroAssemblerSH4::DoubleGreaterThanOrEqual = SH4Assembler::GE;
+const Condition MacroAssemblerSH4::DoubleLessThan = SH4Assembler::LT;
+const Condition MacroAssemblerSH4::DoubleLessThanOrEqual = SH4Assembler::LE;
+const Condition MacroAssemblerSH4::DoubleEqualOrUnordered = SH4Assembler::EQU;
+const Condition MacroAssemblerSH4::DoubleNotEqualOrUnordered = SH4Assembler::NEU;
+const Condition MacroAssemblerSH4::DoubleGreaterThanOrUnordered = SH4Assembler::GTU;
+const Condition MacroAssemblerSH4::DoubleGreaterThanOrEqualOrUnordered = SH4Assembler::GEU;
+const Condition MacroAssemblerSH4::DoubleLessThanOrUnordered = SH4Assembler::LTU;
+const Condition MacroAssemblerSH4::DoubleLessThanOrEqualOrUnordered = SH4Assembler::LEU;
+const Condition MacroAssemblerSH4::Signed = SH4Assembler::SI;
+
+void MacroAssemblerSH4::linkCall(void* code, Call call, FunctionPtr function)
+{
+    SH4Assembler::linkCall(code, call.m_jmp, function.value());
+}
+
+void MacroAssemblerSH4::repatchCall(CodeLocationCall call, CodeLocationLabel destination)
+{
+    SH4Assembler::relinkCall(call.dataLocation(), destination.executableAddress());
+}
+
+void MacroAssemblerSH4::repatchCall(CodeLocationCall call, FunctionPtr destination)
+{
+    SH4Assembler::relinkCall(call.dataLocation(), destination.executableAddress());
+}
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h b/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
new file mode 100644
index 0000000..7e15e6c
--- /dev/null
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
@@ -0,0 +1,1751 @@
+/*
+ * Copyright (C) 2009-2011 STMicroelectronics. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef MacroAssemblerSH4_h
+#define MacroAssemblerSH4_h
+
+#if ENABLE(ASSEMBLER) && CPU(SH4)
+
+#include "AbstractMacroAssembler.h"
+#include "SH4Assembler.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+typedef SH4Assembler::Condition Condition;
+
+class MacroAssemblerSH4 : public AbstractMacroAssembler<SH4Assembler> {
+public:
+    typedef SH4Assembler::FPRegisterID FPRegisterID;
+
+    static const Condition Equal;
+    static const Condition NotEqual;
+    static const Condition GreaterThan;
+    static const Condition GreaterThanOrEqual;
+    static const Condition LessThan;
+    static const Condition LessThanOrEqual;
+    static const Condition UGreaterThan;
+    static const Condition UGreaterThanOrEqual;
+    static const Condition ULessThan;
+    static const Condition ULessThanOrEqual;
+    static const Condition Zero;
+    static const Condition NonZero;
+    static const Condition Overflow;
+    static const Condition Above;
+    static const Condition AboveOrEqual;
+    static const Condition Below;
+    static const Condition BelowOrEqual;
+    static const Condition DoubleEqual;
+    static const Condition DoubleNotEqual;
+    static const Condition DoubleGreaterThan;
+    static const Condition DoubleGreaterThanOrEqual;
+    static const Condition DoubleLessThan;
+    static const Condition DoubleLessThanOrEqual;
+    static const Condition DoubleEqualOrUnordered;
+    static const Condition DoubleNotEqualOrUnordered;
+    static const Condition DoubleGreaterThanOrUnordered;
+    static const Condition DoubleGreaterThanOrEqualOrUnordered;
+    static const Condition DoubleLessThanOrUnordered;
+    static const Condition DoubleLessThanOrEqualOrUnordered;
+    static const Condition Signed;
+    static const Scale ScalePtr = TimesFour;
+    static const FPRegisterID fscratch = SH4Registers::fr10;
+    static const RegisterID stackPointerRegister = SH4Registers::sp;
+    static const RegisterID linkRegister = SH4Registers::pr;
+    static const RegisterID scratchReg3 = SH4Registers::r13;
+
+    RegisterID claimScratch()
+    {
+        return m_assembler.claimScratch();
+    }
+
+    void releaseScratch(RegisterID reg)
+    {
+        m_assembler.releaseScratch(reg);
+    }
+
+    // Integer arithmetic operations
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addlRegReg(src, dest);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (m_assembler.isImmediate(imm.m_value)) {
+            m_assembler.addlImm8r(imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        m_assembler.addlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            m_assembler.movlRegReg(src, dest);
+        add32(imm, dest);
+    }
+
+    void add32(TrustedImm32 imm, Address address)
+    {
+        RegisterID scr = claimScratch();
+        load32(address, scr);
+        add32(imm, scr);
+        store32(scr, address);
+        releaseScratch(scr);
+    }
+
+    void add32(Address src, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src, scr);
+        m_assembler.addlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andlRegReg(src, dest);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID dest)
+    {
+        if ((imm.m_value <= 255) && (imm.m_value >= 0) && (dest == SH4Registers::r0)) {
+            m_assembler.andlImm8r(imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant((imm.m_value), scr);
+        m_assembler.andlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void lshift32(RegisterID shiftamount, RegisterID dest)
+    {
+        m_assembler.shllRegReg(dest, shiftamount);
+    }
+
+    void rshift32(int imm, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(-imm, scr);
+        m_assembler.shaRegReg(dest, scr);
+        releaseScratch(scr);
+    }
+
+    void lshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        if ((imm.m_value == 1) || (imm.m_value == 2) || (imm.m_value == 8) || (imm.m_value == 16)) {
+            m_assembler.shllImm8r(imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        m_assembler.shllRegReg(dest, scr);
+        releaseScratch(scr);
+    }
+
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.imullRegReg(src, dest);
+        m_assembler.stsmacl(dest);
+    }
+
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        move(imm, scr);
+        if  (src != dest)
+            move(src, dest);
+        mul32(scr,  dest);
+        releaseScratch(scr);
+    }
+
+    void not32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.notlReg(src, dest);
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orlRegReg(src, dest);
+    }
+
+    void or32(TrustedImm32 imm, RegisterID dest)
+    {
+        if ((imm.m_value <= 255) && (imm.m_value >= 0) && (dest == SH4Registers::r0)) {
+            m_assembler.orlImm8r(imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        m_assembler.orlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void rshift32(RegisterID shiftamount, RegisterID dest)
+    {
+        compare32(32, shiftamount, Equal);
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 4);
+        m_assembler.branch(BT_OPCODE, 1);
+        m_assembler.neg(shiftamount, shiftamount);
+        m_assembler.shaRegReg(dest, shiftamount);
+    }
+
+    void rshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (imm.m_value & 0x1f)
+            rshift32(imm.m_value & 0x1f, dest);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.sublRegReg(src, dest);
+    }
+
+    void sub32(TrustedImm32 imm, AbsoluteAddress address, RegisterID scratchReg)
+    {
+        RegisterID result = claimScratch();
+
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address.m_ptr), scratchReg);
+        m_assembler.movlMemReg(scratchReg, result);
+
+        if (m_assembler.isImmediate(-imm.m_value))
+            m_assembler.addlImm8r(-imm.m_value, result);
+        else {
+            m_assembler.loadConstant(imm.m_value, scratchReg3);
+            m_assembler.sublRegReg(scratchReg3, result);
+        }
+
+        store32(result, scratchReg);
+        releaseScratch(result);
+    }
+
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        RegisterID result = claimScratch();
+        RegisterID scratchReg = claimScratch();
+
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address.m_ptr), scratchReg);
+        m_assembler.movlMemReg(scratchReg, result);
+
+        if (m_assembler.isImmediate(-imm.m_value))
+            m_assembler.addlImm8r(-imm.m_value, result);
+        else {
+            m_assembler.loadConstant(imm.m_value, scratchReg3);
+            m_assembler.sublRegReg(scratchReg3, result);
+        }
+
+        store32(result, scratchReg);
+        releaseScratch(result);
+        releaseScratch(scratchReg);
+    }
+
+    void add32(TrustedImm32 imm, AbsoluteAddress address, RegisterID scratchReg)
+    {
+        RegisterID result = claimScratch();
+
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address.m_ptr), scratchReg);
+        m_assembler.movlMemReg(scratchReg, result);
+
+        if (m_assembler.isImmediate(imm.m_value))
+            m_assembler.addlImm8r(imm.m_value, result);
+        else {
+            m_assembler.loadConstant(imm.m_value, scratchReg3);
+            m_assembler.addlRegReg(scratchReg3, result);
+        }
+
+        store32(result, scratchReg);
+        releaseScratch(result);
+    }
+
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        RegisterID result = claimScratch();
+        RegisterID scratchReg = claimScratch();
+
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address.m_ptr), scratchReg);
+        m_assembler.movlMemReg(scratchReg, result);
+
+        if (m_assembler.isImmediate(imm.m_value))
+            m_assembler.addlImm8r(imm.m_value, result);
+        else {
+            m_assembler.loadConstant(imm.m_value, scratchReg3);
+            m_assembler.addlRegReg(scratchReg3, result);
+        }
+
+        store32(result, scratchReg);
+        releaseScratch(result);
+        releaseScratch(scratchReg);
+    }
+
+    void sub32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (m_assembler.isImmediate(-imm.m_value)) {
+            m_assembler.addlImm8r(-imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        m_assembler.sublRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src, scr);
+        m_assembler.sublRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorlRegReg(src, dest);
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID srcDest)
+    {
+        if ((srcDest != SH4Registers::r0) || (imm.m_value > 255) || (imm.m_value < 0)) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant((imm.m_value), scr);
+            m_assembler.xorlRegReg(scr, srcDest);
+            releaseScratch(scr);
+            return;
+        }
+
+        m_assembler.xorlImm8r(imm.m_value, srcDest);
+    }
+
+    void compare32(int imm, RegisterID dst, Condition cond)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && (dst == SH4Registers::r0) && m_assembler.isImmediate(imm)) {
+            m_assembler.cmpEqImmR0(imm, dst, cond);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm, scr);
+        m_assembler.cmplRegReg(scr, dst, cond);
+        releaseScratch(scr);
+    }
+
+    void compare32(int offset, RegisterID base, RegisterID left, Condition cond)
+    {
+        RegisterID scr = claimScratch();
+        if (!offset) {
+            m_assembler.movlMemReg(base, scr);
+            m_assembler.cmplRegReg(scr, left, cond);
+            releaseScratch(scr);
+            return;
+        }
+
+        if ((offset < 0) || (offset >= 64)) {
+            m_assembler.loadConstant(offset, scr);
+            m_assembler.addlRegReg(base, scr);
+            m_assembler.movlMemReg(scr, scr);
+            m_assembler.cmplRegReg(scr, left, cond);
+            releaseScratch(scr);
+            return;
+        }
+
+        m_assembler.movlMemReg(offset >> 2, base, scr);
+        m_assembler.cmplRegReg(scr, left, cond);
+        releaseScratch(scr);
+    }
+
+    void testImm(int imm, int offset, RegisterID base)
+    {
+        RegisterID scr = claimScratch();
+        RegisterID scr1 = claimScratch();
+
+        if ((offset < 0) || (offset >= 64)) {
+            m_assembler.loadConstant(offset, scr);
+            m_assembler.addlRegReg(base, scr);
+            m_assembler.movlMemReg(scr, scr);
+        } else if (offset)
+            m_assembler.movlMemReg(offset >> 2, base, scr);
+        else
+            m_assembler.movlMemReg(base, scr);
+        if (m_assembler.isImmediate(imm))
+            m_assembler.movImm8(imm, scr1);
+        else
+            m_assembler.loadConstant(imm, scr1);
+
+        m_assembler.testlRegReg(scr, scr1);
+        releaseScratch(scr);
+        releaseScratch(scr1);
+    }
+
+    void testlImm(int imm, RegisterID dst)
+    {
+        if ((dst == SH4Registers::r0) && (imm <= 255) && (imm >= 0)) {
+            m_assembler.testlImm8r(imm, dst);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm, scr);
+        m_assembler.testlRegReg(scr, dst);
+        releaseScratch(scr);
+    }
+
+    void compare32(RegisterID right, int offset, RegisterID base, Condition cond)
+    {
+        if (!offset) {
+            RegisterID scr = claimScratch();
+            m_assembler.movlMemReg(base, scr);
+            m_assembler.cmplRegReg(right, scr, cond);
+            releaseScratch(scr);
+            return;
+        }
+
+        if ((offset < 0) || (offset >= 64)) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(offset, scr);
+            m_assembler.addlRegReg(base, scr);
+            m_assembler.movlMemReg(scr, scr);
+            m_assembler.cmplRegReg(right, scr, cond);
+            releaseScratch(scr);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.movlMemReg(offset >> 2, base, scr);
+        m_assembler.cmplRegReg(right, scr, cond);
+        releaseScratch(scr);
+    }
+
+    void compare32(int imm, int offset, RegisterID base, Condition cond)
+    {
+        if (!offset) {
+            RegisterID scr = claimScratch();
+            RegisterID scr1 = claimScratch();
+            m_assembler.movlMemReg(base, scr);
+            m_assembler.loadConstant(imm, scr1);
+            m_assembler.cmplRegReg(scr1, scr, cond);
+            releaseScratch(scr1);
+            releaseScratch(scr);
+            return;
+        }
+
+        if ((offset < 0) || (offset >= 64)) {
+            RegisterID scr = claimScratch();
+            RegisterID scr1 = claimScratch();
+            m_assembler.loadConstant(offset, scr);
+            m_assembler.addlRegReg(base, scr);
+            m_assembler.movlMemReg(scr, scr);
+            m_assembler.loadConstant(imm, scr1);
+            m_assembler.cmplRegReg(scr1, scr, cond);
+            releaseScratch(scr1);
+            releaseScratch(scr);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        RegisterID scr1 = claimScratch();
+        m_assembler.movlMemReg(offset >> 2, base, scr);
+        m_assembler.loadConstant(imm, scr1);
+        m_assembler.cmplRegReg(scr1, scr, cond);
+        releaseScratch(scr1);
+        releaseScratch(scr);
+    }
+
+    // Memory access operation
+
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        load32(address.base, address.offset, dest);
+    }
+
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        load8(address.base, address.offset, dest);
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+        load32(scr, address.offset, dest);
+        releaseScratch(scr);
+    }
+
+    void load32(void* address, RegisterID dest)
+    {
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address), dest);
+        m_assembler.movlMemReg(dest, dest);
+    }
+
+    void load32(RegisterID base, int offset, RegisterID dest)
+    {
+        if (!offset) {
+            m_assembler.movlMemReg(base, dest);
+            return;
+        }
+
+        if ((offset >= 0) && (offset < 64)) {
+            m_assembler.movlMemReg(offset >> 2, base, dest);
+            return;
+        }
+
+        if ((dest == SH4Registers::r0) && (dest != base)) {
+            m_assembler.loadConstant((offset), dest);
+            m_assembler.movlR0mr(base, dest);
+            return;
+        }
+
+        RegisterID scr;
+        if (dest == base)
+            scr = claimScratch();
+        else
+            scr = dest;
+        m_assembler.loadConstant((offset), scr);
+        m_assembler.addlRegReg(base, scr);
+        m_assembler.movlMemReg(scr, dest);
+
+        if (dest == base)
+            releaseScratch(scr);
+    }
+
+    void load8(RegisterID base, int offset, RegisterID dest)
+    {
+        if (!offset) {
+            m_assembler.movbMemReg(base, dest);
+            return;
+        }
+
+        if ((offset > 0) && (offset < 64) && (dest == SH4Registers::r0)) {
+            m_assembler.movbMemReg(offset, base, dest);
+            return;
+        }
+
+        if (base != dest) {
+            m_assembler.loadConstant((offset), dest);
+            m_assembler.addlRegReg(base, dest);
+            m_assembler.movbMemReg(dest, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant((offset), scr);
+        m_assembler.addlRegReg(base, scr);
+        m_assembler.movbMemReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void load32(RegisterID r0, RegisterID src, RegisterID dst)
+    {
+        ASSERT(r0 == SH4Registers::r0);
+        m_assembler.movlR0mr(src, dst);
+    }
+
+    void load32(RegisterID src, RegisterID dst)
+    {
+        m_assembler.movlMemReg(src, dst);
+    }
+
+    void load16(ImplicitAddress address, RegisterID dest)
+    {
+        if (!address.offset) {
+            m_assembler.movwMemReg(address.base, dest);
+            return;
+        }
+
+        if ((address.offset > 0) && (address.offset < 64) && (dest == SH4Registers::r0)) {
+            m_assembler.movwMemReg(address.offset, address.base, dest);
+            return;
+        }
+
+        if (address.base != dest) {
+            m_assembler.loadConstant((address.offset), dest);
+            m_assembler.addlRegReg(address.base, dest);
+            m_assembler.movwMemReg(dest, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant((address.offset), scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.movwMemReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void load16(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movwMemReg(src, dest);
+    }
+
+    void load16(RegisterID r0, RegisterID src, RegisterID dest)
+    {
+        ASSERT(r0 == SH4Registers::r0);
+        m_assembler.movwR0mr(src, dest);
+    }
+
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+
+        if (address.offset)
+            add32(TrustedImm32(address.offset), scr);
+        if (scr == SH4Registers::r0)
+            m_assembler.movwR0mr(address.base, scr);
+        else {
+            add32(address.base, scr);
+            load16(scr, scr);
+        }
+
+        extuw(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        store32(src, address.offset, address.base, scr);
+        releaseScratch(scr);
+    }
+
+    void store32(RegisterID src, int offset, RegisterID base, RegisterID scr)
+    {
+        if (!offset) {
+            m_assembler.movlRegMem(src, base);
+            return;
+        }
+
+        if ((offset >=0) && (offset < 64)) {
+            m_assembler.movlRegMem(src, offset >> 2, base);
+            return;
+        }
+
+        m_assembler.loadConstant((offset), scr);
+        if (scr == SH4Registers::r0) {
+            m_assembler.movlRegMemr0(src, base);
+            return;
+        }
+
+        m_assembler.addlRegReg(base, scr);
+        m_assembler.movlRegMem(src, scr);
+    }
+
+    void store32(RegisterID src, RegisterID offset, RegisterID base)
+    {
+        ASSERT(offset == SH4Registers::r0);
+        m_assembler.movlRegMemr0(src, base);
+    }
+
+    void store32(RegisterID src, RegisterID dst)
+    {
+        m_assembler.movlRegMem(src, dst);
+    }
+
+    void store32(TrustedImm32 imm, ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        RegisterID scr1 = claimScratch();
+        m_assembler.loadConstant((imm.m_value), scr);
+        store32(scr, address.offset, address.base, scr1);
+        releaseScratch(scr);
+        releaseScratch(scr1);
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+        store32(src, Address(scr, address.offset));
+
+        releaseScratch(scr);
+    }
+
+    void store32(TrustedImm32 imm, void* address)
+    {
+        RegisterID scr = claimScratch();
+        RegisterID scr1 = claimScratch();
+        m_assembler.loadConstant((imm.m_value), scr);
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address), scr1);
+        m_assembler.movlMemReg(scr, scr1);
+        releaseScratch(scr);
+        releaseScratch(scr1);
+    }
+
+    void store32(RegisterID src, void* address)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address), scr);
+        m_assembler.movlMemReg(src, scr);
+        releaseScratch(scr);
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        DataLabel32 label(this);
+        m_assembler.loadConstantUnReusable(address.offset, scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.movlMemReg(scr, dest);
+        releaseScratch(scr);
+        return label;
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        RegisterID scr = claimScratch();
+        DataLabel32 label(this);
+        m_assembler.loadConstantUnReusable(address.offset, scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.movlRegMem(src, scr);
+        releaseScratch(scr);
+        return label;
+    }
+
+     // Floating-point operations
+
+    bool supportsFloatingPoint() const { return true; }
+    bool supportsFloatingPointTruncate() const { return true; }
+    bool supportsFloatingPointSqrt() const { return true; }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+
+        m_assembler.loadConstant(address.offset, scr);
+        if (address.base == SH4Registers::r0) {
+            m_assembler.fmovsReadr0r(scr, (FPRegisterID)(dest + 1));
+            m_assembler.addlImm8r(4, scr);
+            m_assembler.fmovsReadr0r(scr, dest);
+            releaseScratch(scr);
+            return;
+        }
+
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.fmovsReadrminc(scr, (FPRegisterID)(dest + 1));
+        m_assembler.fmovsReadrm(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void loadDouble(const void* address, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(address), scr);
+        m_assembler.fmovsReadrminc(scr, (FPRegisterID)(dest + 1));
+        m_assembler.fmovsReadrm(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(address.offset, scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.fmovsWriterm((FPRegisterID)(src + 1), scr);
+        m_assembler.addlImm8r(4, scr);
+        m_assembler.fmovsWriterm(src, scr);
+        releaseScratch(scr);
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.daddRegReg(src, dest);
+    }
+
+    void addDouble(Address address, FPRegisterID dest)
+    {
+        loadDouble(address, fscratch);
+        addDouble(fscratch, dest);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.dsubRegReg(src, dest);
+    }
+
+    void subDouble(Address address, FPRegisterID dest)
+    {
+        loadDouble(address, fscratch);
+        subDouble(fscratch, dest);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.dmulRegReg(src, dest);
+    }
+
+    void mulDouble(Address address, FPRegisterID dest)
+    {
+        loadDouble(address, fscratch);
+        mulDouble(fscratch, dest);
+    }
+
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.ddivRegReg(src, dest);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.ldsrmfpul(src);
+        m_assembler.floatfpulDreg(dest);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(src.m_ptr), scr);
+        convertInt32ToDouble(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void convertInt32ToDouble(Address src, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src, scr);
+        convertInt32ToDouble(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+
+        if (address.offset)
+            add32(TrustedImm32(address.offset), scr);
+
+        RegisterID scr1 = claimScratch();
+        load16(scr, scr1);
+        add32(TrustedImm32(2), scr);
+        load16(scr, dest);
+        move(TrustedImm32(16), scr);
+        m_assembler.shllRegReg(dest, scr);
+        or32(scr1, dest);
+
+        releaseScratch(scr);
+        releaseScratch(scr1);
+    }
+
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, TrustedImm32 right)
+    {
+        RegisterID scr = scratchReg3;
+        load32WithUnalignedHalfWords(left, scr);
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testlRegReg(scr, scr);
+        else
+            compare32(right.m_value, scr, cond);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchDoubleNonZero(FPRegisterID reg, FPRegisterID scratch)
+    {
+        m_assembler.movImm8(0, scratchReg3);
+        convertInt32ToDouble(scratchReg3, scratch);
+        return branchDouble(DoubleNotEqual, reg, scratch);
+    }
+
+    Jump branchDoubleZeroOrNaN(FPRegisterID reg, FPRegisterID scratch)
+    {
+        m_assembler.movImm8(0, scratchReg3);
+        convertInt32ToDouble(scratchReg3, scratch);
+        return branchDouble(DoubleEqualOrUnordered, reg, scratch);
+    }
+
+    Jump branchDouble(Condition cond, FPRegisterID left, FPRegisterID right)
+    {
+        if (cond == DoubleEqual) {
+            m_assembler.dcmppeq(right, left);
+            return branchTrue();
+        }
+
+        if (cond == DoubleNotEqual) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+            m_assembler.dcnvds(right);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            m_assembler.branch(BT_OPCODE, 8);
+            m_assembler.dcnvds(left);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.branch(BT_OPCODE, 4);
+            m_assembler.dcmppeq(right, left);
+            releaseScratch(scr);
+            return branchFalse();
+        }
+
+        if (cond == DoubleGreaterThan) {
+            m_assembler.dcmppgt(right, left);
+            return branchTrue();
+        }
+
+        if (cond == DoubleGreaterThanOrEqual) {
+            m_assembler.dcmppgt(left, right);
+            return branchFalse();
+        }
+
+        if (cond == DoubleLessThan) {
+            m_assembler.dcmppgt(left, right);
+            return branchTrue();
+        }
+
+        if (cond == DoubleLessThanOrEqual) {
+            m_assembler.dcmppgt(right, left);
+            return branchFalse();
+        }
+
+        if (cond == DoubleEqualOrUnordered) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+            m_assembler.dcnvds(right);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            m_assembler.branch(BT_OPCODE, 5);
+            m_assembler.dcnvds(left);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.branch(BT_OPCODE, 1);
+            m_assembler.dcmppeq(left, right);
+            releaseScratch(scr);
+            return branchTrue();
+        }
+
+        if (cond == DoubleGreaterThanOrUnordered) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+            m_assembler.dcnvds(right);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            m_assembler.branch(BT_OPCODE, 5);
+            m_assembler.dcnvds(left);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.branch(BT_OPCODE, 1);
+            m_assembler.dcmppgt(right, left);
+            releaseScratch(scr);
+            return branchTrue();
+        }
+
+        if (cond == DoubleGreaterThanOrEqualOrUnordered) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+            m_assembler.dcnvds(right);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            m_assembler.branch(BT_OPCODE, 5);
+            m_assembler.dcnvds(left);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.branch(BT_OPCODE, 1);
+            m_assembler.dcmppgt(left, right);
+            releaseScratch(scr);
+            return branchFalse();
+        }
+
+        if (cond == DoubleLessThanOrUnordered) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+            m_assembler.dcnvds(right);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            m_assembler.branch(BT_OPCODE, 5);
+            m_assembler.dcnvds(left);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.branch(BT_OPCODE, 1);
+            m_assembler.dcmppgt(left, right);
+            releaseScratch(scr);
+            return branchTrue();
+        }
+
+        if (cond == DoubleLessThanOrEqualOrUnordered) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+            m_assembler.dcnvds(right);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            m_assembler.branch(BT_OPCODE, 5);
+            m_assembler.dcnvds(left);
+            m_assembler.stsfpulReg(scr);
+            m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+            m_assembler.branch(BT_OPCODE, 1);
+            m_assembler.dcmppgt(right, left);
+            releaseScratch(scr);
+            return branchFalse();
+        }
+
+        ASSERT(cond == DoubleNotEqualOrUnordered);
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(0x7fbfffff, scratchReg3);
+        m_assembler.dcnvds(right);
+        m_assembler.stsfpulReg(scr);
+        m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+        m_assembler.branch(BT_OPCODE, 5);
+        m_assembler.dcnvds(left);
+        m_assembler.stsfpulReg(scr);
+        m_assembler.cmplRegReg(scratchReg3, scr, Equal);
+        m_assembler.branch(BT_OPCODE, 1);
+        m_assembler.dcmppeq(right, left);
+        releaseScratch(scr);
+        return branchFalse();
+    }
+
+    Jump branchTrue()
+    {
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 6, sizeof(uint32_t));
+        Jump m_jump = Jump(m_assembler.je());
+        m_assembler.loadConstantUnReusable(0x0, scratchReg3);
+        m_assembler.nop();
+        m_assembler.nop();
+        return m_jump;
+    }
+
+    Jump branchFalse()
+    {
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 6, sizeof(uint32_t));
+        Jump m_jump = Jump(m_assembler.jne());
+        m_assembler.loadConstantUnReusable(0x0, scratchReg3);
+        m_assembler.nop();
+        m_assembler.nop();
+        return m_jump;
+    }
+
+    void set8Compare32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        set32Compare32(cond, left, right, dest);
+    }
+
+    void set8Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        if (left != dest) {
+            m_assembler.loadConstant(right.m_value, dest);
+            set32Compare32(cond, left, dest, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(right.m_value, scr);
+        set32Compare32(cond, left, scr, dest);
+        releaseScratch(scr);
+    }
+
+    Jump branch32(Condition cond, BaseIndex left, TrustedImm32 right)
+    {
+        RegisterID scr = claimScratch();
+        move(left.index, scr);
+        lshift32(TrustedImm32(left.scale), scr);
+        add32(left.base, scr);
+        load32(scr, left.offset, scr);
+        compare32(right.m_value, scr, cond);
+        releaseScratch(scr);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    void sqrtDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        if (dest != src)
+            m_assembler.dmovRegReg(src, dest);
+        m_assembler.dsqrt(dest);
+    }
+
+    Jump branchTest8(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        RegisterID addressTempRegister = claimScratch();
+        load8(address, addressTempRegister);
+        Jump jmp = branchTest32(cond, addressTempRegister, mask);
+        releaseScratch(addressTempRegister);
+        return jmp;
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+    }
+
+    Jump branch8(Condition cond, Address left, TrustedImm32 right)
+    {
+        RegisterID addressTempRegister = claimScratch();
+        load8(left, addressTempRegister);
+        Jump jmp = branch32(cond, addressTempRegister, right);
+        releaseScratch(addressTempRegister);
+        return jmp;
+    }
+
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.ftrcdrmfpul(src);
+        m_assembler.stsfpulReg(dest);
+        m_assembler.loadConstant(0x7fffffff, scratchReg3);
+        m_assembler.cmplRegReg(dest, scratchReg3, Equal);
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 14, sizeof(uint32_t));
+        m_assembler.branch(BT_OPCODE, 2);
+        m_assembler.addlImm8r(1, scratchReg3);
+        m_assembler.cmplRegReg(dest, scratchReg3, Equal);
+        return branchTrue();
+    }
+
+    // Stack manipulation operations
+
+    void pop(RegisterID dest)
+    {
+        m_assembler.popReg(dest);
+    }
+
+    void push(RegisterID src)
+    {
+        m_assembler.pushReg(src);
+    }
+
+    void push(Address address)
+    {
+        if (!address.offset) {
+            push(address.base);
+            return;
+        }
+
+        if ((address.offset < 0) || (address.offset >= 64)) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(address.offset, scr);
+            m_assembler.addlRegReg(address.base, scr);
+            m_assembler.movlMemReg(scr, SH4Registers::sp);
+            m_assembler.addlImm8r(-4, SH4Registers::sp);
+            releaseScratch(scr);
+            return;
+        }
+
+        m_assembler.movlMemReg(address.offset >> 2, address.base, SH4Registers::sp);
+        m_assembler.addlImm8r(-4, SH4Registers::sp);
+    }
+
+    void push(TrustedImm32 imm)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        push(scr);
+        releaseScratch(scr);
+    }
+
+    // Register move operations
+
+    void move(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.loadConstant(imm.m_value, dest);
+    }
+
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
+    {
+        DataLabelPtr dataLabel(this);
+        m_assembler.loadConstantUnReusable(reinterpret_cast<uint32_t>(initialValue.m_value), dest, true);
+        return dataLabel;
+    }
+
+    void move(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movlRegReg(src, dest);
+    }
+
+    void move(TrustedImmPtr imm, RegisterID dest)
+    {
+        m_assembler.loadConstant(imm.asIntptr(), dest);
+    }
+
+    void extuw(RegisterID src, RegisterID dst)
+    {
+        m_assembler.extuw(src, dst);
+    }
+
+    void set32Compare32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmplRegReg(right, left, cond);
+        if (cond != NotEqual) {
+            m_assembler.movt(dest);
+            return;
+        }
+
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 4);
+        m_assembler.movImm8(0, dest);
+        m_assembler.branch(BT_OPCODE, 0);
+        m_assembler.movImm8(1, dest);
+    }
+
+    void set32Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        if (left != dest) {
+            move(right, dest);
+            set32Compare32(cond, left, dest, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        move(right, scr);
+        set32Compare32(cond, left, scr, dest);
+        releaseScratch(scr);
+    }
+
+    void set32Test8(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        load8(address, dest);
+        if (mask.m_value == -1)
+            compare32(0, dest, cond);
+        else
+            testlImm(mask.m_value, dest);
+        if (cond != NonZero) {
+            m_assembler.movt(dest);
+            return;
+        }
+
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 4);
+        m_assembler.movImm8(0, dest);
+        m_assembler.branch(BT_OPCODE, 0);
+        m_assembler.movImm8(1, dest);
+    }
+
+    void loadPtrLinkReg(ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        load32(address, scr);
+        m_assembler.ldspr(scr);
+        releaseScratch(scr);
+    }
+
+    Jump branch32(Condition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmplRegReg(right, left, cond);
+        /* BT label => BF off
+           nop         LDR reg
+           nop         braf @reg
+           nop         nop
+         */
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(Condition cond, RegisterID left, TrustedImm32 right)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testlRegReg(left, left);
+        else
+            compare32(right.m_value, left, cond);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Address right)
+    {
+        compare32(right.offset, right.base, left, cond);
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(Condition cond, Address left, RegisterID right)
+    {
+        compare32(right, left.offset, left.base, cond);
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(Condition cond, Address left, TrustedImm32 right)
+    {
+        compare32(right.m_value, left.offset, left.base, cond);
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
+    {
+        RegisterID scr = claimScratch();
+
+        move(TrustedImm32(reinterpret_cast<uint32_t>(left.m_ptr)), scr);
+        m_assembler.cmplRegReg(right, scr, cond);
+        releaseScratch(scr);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        RegisterID addressTempRegister = claimScratch();
+
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(left.m_ptr), addressTempRegister);
+        m_assembler.movlMemReg(addressTempRegister, addressTempRegister);
+        compare32(right.m_value, addressTempRegister, cond);
+        releaseScratch(addressTempRegister);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch16(Condition cond,  BaseIndex left, RegisterID right)
+    {
+        RegisterID scr = claimScratch();
+
+        move(left.index, scr);
+        lshift32(TrustedImm32(left.scale), scr);
+
+        if (left.offset)
+            add32(TrustedImm32(left.offset), scr);
+        add32(left.base, scr);
+        load16(scr, scr);
+        extuw(scr, scr);
+        releaseScratch(scr);
+
+        return branch32(cond, scr, right);
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, TrustedImm32 right)
+    {
+        RegisterID scr = claimScratch();
+
+        move(left.index, scr);
+        lshift32(TrustedImm32(left.scale), scr);
+
+        if (left.offset)
+            add32(TrustedImm32(left.offset), scr);
+        add32(left.base, scr);
+        load16(scr, scr);
+        extuw(scr, scr);
+        RegisterID scr1 = claimScratch();
+        m_assembler.loadConstant(right.m_value, scr1);
+        releaseScratch(scr);
+        releaseScratch(scr1);
+
+        return branch32(cond, scr, scr1);
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        m_assembler.testlRegReg(reg, mask);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        if (mask.m_value == -1)
+            m_assembler.testlRegReg(reg, reg);
+        else
+            testlImm(mask.m_value, reg);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchTest32(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        if (mask.m_value == -1)
+            compare32(0, address.offset, address.base, cond);
+        else
+            testImm(mask.m_value, address.offset, address.base);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchTest32(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+        load32(scr, address.offset, scr);
+
+        if (mask.m_value == -1)
+            m_assembler.testlRegReg(scr, scr);
+        else
+            testlImm(mask.m_value, scr);
+
+        releaseScratch(scr);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump jump()
+    {
+        return Jump(m_assembler.jmp());
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.jmpReg(target);
+    }
+
+    void jump(Address address)
+    {
+        RegisterID scr = claimScratch();
+
+        if ((address.offset < 0) || (address.offset >= 64)) {
+            m_assembler.loadConstant(address.offset, scr);
+            m_assembler.addlRegReg(address.base, scr);
+            m_assembler.movlMemReg(scr, scr);
+        } else if (address.offset)
+            m_assembler.movlMemReg(address.offset >> 2, address.base, scr);
+        else
+            m_assembler.movlMemReg(address.base, scr);
+        m_assembler.jmpReg(scr);
+
+        releaseScratch(scr);
+    }
+
+    // Arithmetic control flow operations
+
+    Jump branchAdd32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow) {
+            m_assembler.addvlRegReg(src, dest);
+            return branchTrue();
+        }
+
+        if (cond == Signed) {
+            m_assembler.addlRegReg(src, dest);
+            // Check if dest is negative
+            m_assembler.cmppz(dest);
+            return branchFalse();
+        }
+
+        m_assembler.addlRegReg(src, dest);
+        compare32(0, dest, Equal);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchAdd32(Condition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        move(imm, scratchReg3);
+        return branchAdd32(cond, scratchReg3, dest);
+    }
+
+    Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow) {
+            RegisterID scr1 = claimScratch();
+            RegisterID scr = claimScratch();
+            m_assembler.dmullRegReg(src, dest);
+            m_assembler.stsmacl(dest);
+            m_assembler.movImm8(-31, scr);
+            m_assembler.movlRegReg(dest, scr1);
+            m_assembler.shaRegReg(scr1, scr);
+            m_assembler.stsmach(scr);
+            m_assembler.cmplRegReg(scr, scr1, Zero);
+            releaseScratch(scr1);
+            releaseScratch(scr);
+            return branchFalse();
+        }
+
+        m_assembler.imullRegReg(src, dest);
+        m_assembler.stsmacl(dest);
+        if (cond == Signed) {
+            // Check if dest is negative
+            m_assembler.cmppz(dest);
+            return branchFalse();
+        }
+
+        compare32(0, dest, cond);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchMul32(Condition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        move(imm, scratchReg3);
+        if (src != dest)
+            move(src, dest);
+
+        return branchMul32(cond, scratchReg3, dest);
+    }
+
+    Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow) {
+            m_assembler.subvlRegReg(src, dest);
+            return branchTrue();
+        }
+
+        if (cond == Signed) {
+            // Check if dest is negative
+            m_assembler.sublRegReg(src, dest);
+            compare32(0, dest, LessThan);
+            return branchTrue();
+        }
+
+        sub32(src, dest);
+        compare32(0, dest, cond);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchSub32(Condition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        move(imm, scratchReg3);
+        return branchSub32(cond, scratchReg3, dest);
+    }
+
+    Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Signed) {
+            or32(src, dest);
+            compare32(0, dest, LessThan);
+            return branchTrue();
+        }
+
+        or32(src, dest);
+        compare32(0, dest, cond);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
+    {
+        m_assembler.ftrcdrmfpul(src);
+        m_assembler.stsfpulReg(dest);
+        convertInt32ToDouble(dest, fscratch);
+        failureCases.append(branchDouble(DoubleNotEqualOrUnordered, fscratch, src));
+
+        if (dest == SH4Registers::r0)
+            m_assembler.cmpEqImmR0(0, dest, Equal);
+        else {
+            m_assembler.movImm8(0, scratchReg3);
+            m_assembler.cmplRegReg(scratchReg3, dest, Equal);
+        }
+        failureCases.append(branchTrue());
+    }
+
+    void neg32(RegisterID dst)
+    {
+        m_assembler.neg(dst, dst);
+    }
+
+    void not32(RegisterID dst)
+    {
+        m_assembler.notlReg(dst, dst);
+    }
+
+    void urshift32(RegisterID shiftamount, RegisterID dest)
+    {
+        compare32(32, shiftamount, Equal);
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 4);
+        m_assembler.branch(BT_OPCODE, 1);
+        m_assembler.neg(shiftamount, shiftamount);
+        m_assembler.shllRegReg(dest, shiftamount);
+    }
+
+    void urshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(-(imm.m_value), scr);
+        m_assembler.shaRegReg(dest, scr);
+        releaseScratch(scr);
+    }
+
+    Call call()
+    {
+        return Call(m_assembler.call(), Call::Linkable);
+    }
+
+    Call nearCall()
+    {
+        return Call(m_assembler.call(), Call::LinkableNear);
+    }
+
+    Call call(RegisterID target)
+    {
+        return Call(m_assembler.call(target), Call::None);
+    }
+
+    void call(Address address, RegisterID target)
+    {
+        load32(address.base, address.offset, target);
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 2);
+        m_assembler.branch(JSR_OPCODE, target);
+        m_assembler.nop();
+    }
+
+    void breakpoint()
+    {
+        m_assembler.bkpt();
+        m_assembler.nop();
+    }
+
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        RegisterID dataTempRegister = claimScratch();
+
+        dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
+        m_assembler.cmplRegReg(dataTempRegister, left, cond);
+        releaseScratch(dataTempRegister);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        RegisterID scr = claimScratch();
+
+        m_assembler.loadConstant(left.offset, scr);
+        m_assembler.addlRegReg(left.base, scr);
+        m_assembler.movlMemReg(scr, scr);
+        RegisterID scr1 = claimScratch();
+        dataLabel = moveWithPatch(initialRightValue, scr1);
+        m_assembler.cmplRegReg(scr1, scr, cond);
+        releaseScratch(scr);
+        releaseScratch(scr1);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    void ret()
+    {
+        m_assembler.ret();
+        m_assembler.nop();
+    }
+
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        DataLabelPtr label = moveWithPatch(initialValue, scr);
+        store32(scr, address);
+        releaseScratch(scr);
+        return label;
+    }
+
+    DataLabelPtr storePtrWithPatch(ImplicitAddress address) { return storePtrWithPatch(TrustedImmPtr(0), address); }
+
+    int sizeOfConstantPool()
+    {
+        return m_assembler.sizeOfConstantPool();
+    }
+
+    Call tailRecursiveCall()
+    {
+        RegisterID scr = claimScratch();
+
+        m_assembler.loadConstantUnReusable(0x0, scr, true);
+        Jump m_jump = Jump(m_assembler.jmp(scr));
+        releaseScratch(scr);
+
+        return Call::fromTailJump(m_jump);
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        return tailRecursiveCall();
+    }
+
+private:
+    friend class LinkBuffer;
+    friend class RepatchBuffer;
+
+    static void linkCall(void*, Call, FunctionPtr);
+    static void repatchCall(CodeLocationCall, CodeLocationLabel);
+    static void repatchCall(CodeLocationCall, FunctionPtr);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerSH4_h
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86.h
index 0918996..b180e2b 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86.h
@@ -52,32 +52,32 @@ public:
     using MacroAssemblerX86Common::loadDouble;
     using MacroAssemblerX86Common::convertInt32ToDouble;
 
-    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.leal_mr(imm.m_value, src, dest);
     }
 
-    void add32(Imm32 imm, AbsoluteAddress address)
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.addl_im(imm.m_value, address.m_ptr);
     }
     
-    void addWithCarry32(Imm32 imm, AbsoluteAddress address)
+    void addWithCarry32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.adcl_im(imm.m_value, address.m_ptr);
     }
     
-    void and32(Imm32 imm, AbsoluteAddress address)
+    void and32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.andl_im(imm.m_value, address.m_ptr);
     }
     
-    void or32(Imm32 imm, AbsoluteAddress address)
+    void or32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.orl_im(imm.m_value, address.m_ptr);
     }
 
-    void sub32(Imm32 imm, AbsoluteAddress address)
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.subl_im(imm.m_value, address.m_ptr);
     }
@@ -98,7 +98,7 @@ public:
         m_assembler.cvtsi2sd_mr(src.m_ptr, dest);
     }
 
-    void store32(Imm32 imm, void* address)
+    void store32(TrustedImm32 imm, void* address)
     {
         m_assembler.movl_i32m(imm.m_value, address);
     }
@@ -114,7 +114,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    Jump branch32(Condition cond, AbsoluteAddress left, TrustedImm32 right)
     {
         m_assembler.cmpl_im(right.m_value, left.m_ptr);
         return Jump(m_assembler.jCC(x86Condition(cond)));
@@ -136,39 +136,32 @@ public:
     }
 
 
-    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
     {
         m_assembler.movl_i32r(initialValue.asIntptr(), dest);
         return DataLabelPtr(this);
     }
 
-    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         m_assembler.cmpl_ir_force32(initialRightValue.asIntptr(), left);
         dataLabel = DataLabelPtr(this);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         m_assembler.cmpl_im_force32(initialRightValue.asIntptr(), left.offset, left.base);
         dataLabel = DataLabelPtr(this);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
     {
         m_assembler.movl_i32m(initialValue.asIntptr(), address.offset, address.base);
         return DataLabelPtr(this);
     }
 
-    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
-    {
-        Label label(this);
-        load32(address, dest);
-        return label;
-    }
-
     bool supportsFloatingPoint() const { return m_isSSE2Present; }
     // See comment on MacroAssemblerARMv7::supportsFloatingPointTruncate()
     bool supportsFloatingPointTruncate() const { return m_isSSE2Present; }
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index a02074c..027a4ce 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -83,7 +83,7 @@ public:
     // Integer arithmetic operations:
     //
     // Operations are typically two operand - operation(source, srcDst)
-    // For many operations the source may be an Imm32, the srcDst operand
+    // For many operations the source may be an TrustedImm32, the srcDst operand
     // may often be a memory location (explictly described using an Address
     // object).
 
@@ -92,12 +92,12 @@ public:
         m_assembler.addl_rr(src, dest);
     }
 
-    void add32(Imm32 imm, Address address)
+    void add32(TrustedImm32 imm, Address address)
     {
         m_assembler.addl_im(imm.m_value, address.offset, address.base);
     }
 
-    void add32(Imm32 imm, RegisterID dest)
+    void add32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.addl_ir(imm.m_value, dest);
     }
@@ -117,7 +117,7 @@ public:
         m_assembler.andl_rr(src, dest);
     }
 
-    void and32(Imm32 imm, RegisterID dest)
+    void and32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.andl_ir(imm.m_value, dest);
     }
@@ -132,36 +132,64 @@ public:
         m_assembler.andl_mr(src.offset, src.base, dest);
     }
 
-    void and32(Imm32 imm, Address address)
+    void and32(TrustedImm32 imm, Address address)
     {
         m_assembler.andl_im(imm.m_value, address.offset, address.base);
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void and32(RegisterID op1, RegisterID op2, RegisterID dest)
     {
-        m_assembler.shll_i8r(imm.m_value, dest);
+        if (op1 == op2)
+            zeroExtend32ToPtr(op1, dest);
+        else if (op1 == dest)
+            and32(op2, dest);
+        else {
+            move(op2, dest);
+            and32(op1, dest);
+        }
     }
-    
+
+    void and32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+        and32(imm, dest);
+    }
+
     void lshift32(RegisterID shift_amount, RegisterID dest)
     {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86Registers::ecx) {
-            swap(shift_amount, X86Registers::ecx);
+        ASSERT(shift_amount != dest);
 
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.shll_CLr(X86Registers::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86Registers::ecx)
-                m_assembler.shll_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.shll_CLr(dest);
-        
-            swap(shift_amount, X86Registers::ecx);
-        } else
+        if (shift_amount == X86Registers::ecx)
             m_assembler.shll_CLr(dest);
+        else {
+            // On x86 we can only shift by ecx; if asked to shift by another register we'll
+            // need rejig the shift amount into ecx first, and restore the registers afterwards.
+            // If we dest is ecx, then shift the swapped register!
+            swap(shift_amount, X86Registers::ecx);
+            m_assembler.shll_CLr(dest == X86Registers::ecx ? shift_amount : dest);
+            swap(shift_amount, X86Registers::ecx);
+        }
+    }
+
+    void lshift32(RegisterID src, RegisterID shift_amount, RegisterID dest)
+    {
+        ASSERT(shift_amount != dest);
+
+        if (src != dest)
+            move(src, dest);
+        lshift32(shift_amount, dest);
+    }
+
+    void lshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.shll_i8r(imm.m_value, dest);
+    }
+    
+    void lshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+        lshift32(imm, dest);
     }
     
     void mul32(RegisterID src, RegisterID dest)
@@ -174,7 +202,7 @@ public:
         m_assembler.imull_mr(src.offset, src.base, dest);
     }
     
-    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.imull_i32r(src, imm.m_value, dest);
     }
@@ -204,7 +232,7 @@ public:
         m_assembler.orl_rr(src, dest);
     }
 
-    void or32(Imm32 imm, RegisterID dest)
+    void or32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.orl_ir(imm.m_value, dest);
     }
@@ -219,76 +247,114 @@ public:
         m_assembler.orl_mr(src.offset, src.base, dest);
     }
 
-    void or32(Imm32 imm, Address address)
+    void or32(TrustedImm32 imm, Address address)
     {
         m_assembler.orl_im(imm.m_value, address.offset, address.base);
     }
 
+    void or32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2)
+            zeroExtend32ToPtr(op1, dest);
+        else if (op1 == dest)
+            or32(op2, dest);
+        else {
+            move(op2, dest);
+            or32(op1, dest);
+        }
+    }
+
+    void or32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+        or32(imm, dest);
+    }
+
     void rshift32(RegisterID shift_amount, RegisterID dest)
     {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86Registers::ecx) {
-            swap(shift_amount, X86Registers::ecx);
+        ASSERT(shift_amount != dest);
 
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.sarl_CLr(X86Registers::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86Registers::ecx)
-                m_assembler.sarl_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.sarl_CLr(dest);
-        
-            swap(shift_amount, X86Registers::ecx);
-        } else
+        if (shift_amount == X86Registers::ecx)
             m_assembler.sarl_CLr(dest);
+        else {
+            // On x86 we can only shift by ecx; if asked to shift by another register we'll
+            // need rejig the shift amount into ecx first, and restore the registers afterwards.
+            // If we dest is ecx, then shift the swapped register!
+            swap(shift_amount, X86Registers::ecx);
+            m_assembler.sarl_CLr(dest == X86Registers::ecx ? shift_amount : dest);
+            swap(shift_amount, X86Registers::ecx);
+        }
     }
 
-    void rshift32(Imm32 imm, RegisterID dest)
+    void rshift32(RegisterID src, RegisterID shift_amount, RegisterID dest)
+    {
+        ASSERT(shift_amount != dest);
+
+        if (src != dest)
+            move(src, dest);
+        rshift32(shift_amount, dest);
+    }
+
+    void rshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.sarl_i8r(imm.m_value, dest);
     }
     
+    void rshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+        rshift32(imm, dest);
+    }
+    
     void urshift32(RegisterID shift_amount, RegisterID dest)
     {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86Registers::ecx) {
+        ASSERT(shift_amount != dest);
+
+        if (shift_amount == X86Registers::ecx)
+            m_assembler.shrl_CLr(dest);
+        else {
+            // On x86 we can only shift by ecx; if asked to shift by another register we'll
+            // need rejig the shift amount into ecx first, and restore the registers afterwards.
+            // If we dest is ecx, then shift the swapped register!
             swap(shift_amount, X86Registers::ecx);
-            
-            // E.g. transform "shrl %eax, %eax" -> "xchgl %eax, %ecx; shrl %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.shrl_CLr(X86Registers::ecx);
-            // E.g. transform "shrl %eax, %ecx" -> "xchgl %eax, %ecx; shrl %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86Registers::ecx)
-                m_assembler.shrl_CLr(shift_amount);
-            // E.g. transform "shrl %eax, %ebx" -> "xchgl %eax, %ecx; shrl %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.shrl_CLr(dest);
-            
+            m_assembler.shrl_CLr(dest == X86Registers::ecx ? shift_amount : dest);
             swap(shift_amount, X86Registers::ecx);
-        } else
-            m_assembler.shrl_CLr(dest);
+        }
     }
-    
-    void urshift32(Imm32 imm, RegisterID dest)
+
+    void urshift32(RegisterID src, RegisterID shift_amount, RegisterID dest)
     {
-        m_assembler.shrl_i8r(imm.m_value, dest);
+        ASSERT(shift_amount != dest);
+
+        if (src != dest)
+            move(src, dest);
+        urshift32(shift_amount, dest);
     }
 
+    void urshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.shrl_i8r(imm.m_value, dest);
+    }
+    
+    void urshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+        urshift32(imm, dest);
+    }
+    
     void sub32(RegisterID src, RegisterID dest)
     {
         m_assembler.subl_rr(src, dest);
     }
     
-    void sub32(Imm32 imm, RegisterID dest)
+    void sub32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.subl_ir(imm.m_value, dest);
     }
     
-    void sub32(Imm32 imm, Address address)
+    void sub32(TrustedImm32 imm, Address address)
     {
         m_assembler.subl_im(imm.m_value, address.offset, address.base);
     }
@@ -309,12 +375,12 @@ public:
         m_assembler.xorl_rr(src, dest);
     }
 
-    void xor32(Imm32 imm, Address dest)
+    void xor32(TrustedImm32 imm, Address dest)
     {
         m_assembler.xorl_im(imm.m_value, dest.offset, dest.base);
     }
 
-    void xor32(Imm32 imm, RegisterID dest)
+    void xor32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.xorl_ir(imm.m_value, dest);
     }
@@ -329,6 +395,24 @@ public:
         m_assembler.xorl_mr(src.offset, src.base, dest);
     }
     
+    void xor32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2)
+            move(TrustedImm32(0), dest);
+        else if (op1 == dest)
+            xor32(op2, dest);
+        else {
+            move(op2, dest);
+            xor32(op1, dest);
+        }
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+        xor32(imm, dest);
+    }
+
     void sqrtDouble(FPRegisterID src, FPRegisterID dst)
     {
         m_assembler.sqrtsd_rr(src, dst);
@@ -337,7 +421,7 @@ public:
     // Memory access operations:
     //
     // Loads are of the form load(address, destination) and stores of the form
-    // store(source, address).  The source for a store may be an Imm32.  Address
+    // store(source, address).  The source for a store may be an TrustedImm32.  Address
     // operand objects to loads and store will be implicitly constructed if a
     // register is passed.
 
@@ -388,7 +472,7 @@ public:
         m_assembler.movl_rm(src, address.offset, address.base, address.index, address.scale);
     }
 
-    void store32(Imm32 imm, ImplicitAddress address)
+    void store32(TrustedImm32 imm, ImplicitAddress address)
     {
         m_assembler.movl_i32m(imm.m_value, address.offset, address.base);
     }
@@ -398,6 +482,13 @@ public:
     //
     // Presently only supports SSE, not x87 floating point.
 
+    void moveDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        if (src != dest)
+            m_assembler.movsd_rr(src, dest);
+    }
+
     void loadDouble(ImplicitAddress address, FPRegisterID dest)
     {
         ASSERT(isSSE2Present());
@@ -416,6 +507,17 @@ public:
         m_assembler.addsd_rr(src, dest);
     }
 
+    void addDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        if (op1 == dest)
+            addDouble(op2, dest);
+        else {
+            moveDouble(op2, dest);
+            addDouble(op1, dest);
+        }
+    }
+
     void addDouble(Address src, FPRegisterID dest)
     {
         ASSERT(isSSE2Present());
@@ -428,6 +530,15 @@ public:
         m_assembler.divsd_rr(src, dest);
     }
 
+    void divDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        // B := A / B is invalid.
+        ASSERT(op1 == dest || op2 != dest);
+
+        moveDouble(op1, dest);
+        divDouble(op2, dest);
+    }
+
     void divDouble(Address src, FPRegisterID dest)
     {
         ASSERT(isSSE2Present());
@@ -440,6 +551,15 @@ public:
         m_assembler.subsd_rr(src, dest);
     }
 
+    void subDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        // B := A - B is invalid.
+        ASSERT(op1 == dest || op2 != dest);
+
+        moveDouble(op1, dest);
+        subDouble(op2, dest);
+    }
+
     void subDouble(Address src, FPRegisterID dest)
     {
         ASSERT(isSSE2Present());
@@ -452,6 +572,17 @@ public:
         m_assembler.mulsd_rr(src, dest);
     }
 
+    void mulDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        if (op1 == dest)
+            mulDouble(op2, dest);
+        else {
+            moveDouble(op2, dest);
+            mulDouble(op1, dest);
+        }
+    }
+
     void mulDouble(Address src, FPRegisterID dest)
     {
         ASSERT(isSSE2Present());
@@ -501,11 +632,12 @@ public:
     // If the result is not representable as a 32 bit value, branch.
     // May also branch for some values that are representable in 32 bits
     // (specifically, in this case, INT_MIN).
-    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    enum BranchTruncateType { BranchIfTruncateFailed, BranchIfTruncateSuccessful };
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
     {
         ASSERT(isSSE2Present());
         m_assembler.cvttsd2si_rr(src, dest);
-        return branch32(Equal, dest, Imm32(0x80000000));
+        return branch32(branchType ? NotEqual : Equal, dest, TrustedImm32(0x80000000));
     }
 
     // Convert 'src' to an integer, and places the resulting 'dest'.
@@ -564,7 +696,7 @@ public:
         m_assembler.push_m(address.offset, address.base);
     }
 
-    void push(Imm32 imm)
+    void push(TrustedImm32 imm)
     {
         m_assembler.push_i32(imm.m_value);
     }
@@ -574,9 +706,9 @@ public:
     //
     // Move values in registers.
 
-    void move(Imm32 imm, RegisterID dest)
+    void move(TrustedImm32 imm, RegisterID dest)
     {
-        // Note: on 64-bit the Imm32 value is zero extended into the register, it
+        // Note: on 64-bit the TrustedImm32 value is zero extended into the register, it
         // may be useful to have a separate version that sign extends the value?
         if (!imm.m_value)
             m_assembler.xorl_rr(dest, dest);
@@ -593,7 +725,7 @@ public:
             m_assembler.movq_rr(src, dest);
     }
 
-    void move(ImmPtr imm, RegisterID dest)
+    void move(TrustedImmPtr imm, RegisterID dest)
     {
         m_assembler.movq_i64r(imm.asIntptr(), dest);
     }
@@ -620,7 +752,7 @@ public:
             m_assembler.movl_rr(src, dest);
     }
 
-    void move(ImmPtr imm, RegisterID dest)
+    void move(TrustedImmPtr imm, RegisterID dest)
     {
         m_assembler.movl_i32r(imm.asIntptr(), dest);
     }
@@ -655,14 +787,14 @@ public:
     // used (representing the names 'below' and 'above').
     //
     // Operands to the comparision are provided in the expected order, e.g.
-    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // jle32(reg1, TrustedImm32(5)) will branch if the value held in reg1, when
     // treated as a signed 32bit value, is less than or equal to 5.
     //
     // jz and jnz test whether the first operand is equal to zero, and take
     // an optional second operand of a mask under which to perform the test.
 
 public:
-    Jump branch8(Condition cond, Address left, Imm32 right)
+    Jump branch8(Condition cond, Address left, TrustedImm32 right)
     {
         m_assembler.cmpb_im(right.m_value, left.offset, left.base);
         return Jump(m_assembler.jCC(x86Condition(cond)));
@@ -674,7 +806,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    Jump branch32(Condition cond, RegisterID left, TrustedImm32 right)
     {
         if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
             m_assembler.testl_rr(left, left);
@@ -695,19 +827,19 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branch32(Condition cond, Address left, Imm32 right)
+    Jump branch32(Condition cond, Address left, TrustedImm32 right)
     {
         m_assembler.cmpl_im(right.m_value, left.offset, left.base);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         m_assembler.cmpl_im(right.m_value, left.offset, left.base, left.index, left.scale);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         return branch32(cond, left, right);
     }
@@ -718,7 +850,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    Jump branch16(Condition cond, BaseIndex left, TrustedImm32 right)
     {
         ASSERT(!(right.m_value & 0xFFFF0000));
 
@@ -728,14 +860,14 @@ public:
 
     Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
     {
-        ASSERT((cond == Zero) || (cond == NonZero));
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
         m_assembler.testl_rr(reg, mask);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
-        ASSERT((cond == Zero) || (cond == NonZero));
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
         // if we are only interested in the low seven bits, this can be tested with a testb
         if (mask.m_value == -1)
             m_assembler.testl_rr(reg, reg);
@@ -746,9 +878,9 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
-        ASSERT((cond == Zero) || (cond == NonZero));
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
         if (mask.m_value == -1)
             m_assembler.cmpl_im(0, address.offset, address.base);
         else
@@ -756,9 +888,9 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTest32(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
-        ASSERT((cond == Zero) || (cond == NonZero));
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
         if (mask.m_value == -1)
             m_assembler.cmpl_im(0, address.offset, address.base, address.index, address.scale);
         else
@@ -766,9 +898,23 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
-    Jump branchTest8(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
-        ASSERT((cond == Zero) || (cond == NonZero));
+        // Byte in TrustedImm32 is not well defined, so be a little permisive here, but don't accept nonsense values.
+        ASSERT(mask.m_value >= -128 && mask.m_value <= 255);
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
+        if (mask.m_value == -1)
+            m_assembler.testb_rr(reg, reg);
+        else
+            m_assembler.testb_i8r(mask.m_value, reg);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest8(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        // Byte in TrustedImm32 is not well defined, so be a little permisive here, but don't accept nonsense values.
+        ASSERT(mask.m_value >= -128 && mask.m_value <= 255);
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
         if (mask.m_value == -1)
             m_assembler.cmpb_im(0, address.offset, address.base);
         else
@@ -776,9 +922,11 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
-    Jump branchTest8(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
-        ASSERT((cond == Zero) || (cond == NonZero));
+        // Byte in TrustedImm32 is not well defined, so be a little permisive here, but don't accept nonsense values.
+        ASSERT(mask.m_value >= -128 && mask.m_value <= 255);
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
         if (mask.m_value == -1)
             m_assembler.cmpb_im(0, address.offset, address.base, address.index, address.scale);
         else
@@ -820,14 +968,14 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchAdd32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         add32(imm, dest);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
-    Jump branchAdd32(Condition cond, Imm32 src, Address dest)
+    Jump branchAdd32(Condition cond, TrustedImm32 src, Address dest)
     {
         ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
         add32(src, dest);
@@ -848,6 +996,20 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
+    Jump branchAdd32(Condition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src1 == dest)
+            return branchAdd32(cond, src2, dest);
+        move(src2, dest);
+        return branchAdd32(cond, src1, dest);
+    }
+
+    Jump branchAdd32(Condition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move(src, dest);
+        return branchAdd32(cond, imm, dest);
+    }
+
     Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
     {
         ASSERT(cond == Overflow);
@@ -862,13 +1024,21 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
-    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    Jump branchMul32(Condition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         ASSERT(cond == Overflow);
         mul32(imm, src, dest);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
+    Jump branchMul32(Condition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src1 == dest)
+            return branchMul32(cond, src2, dest);
+        move(src2, dest);
+        return branchMul32(cond, src1, dest);
+    }
+
     Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
@@ -876,14 +1046,14 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
     
-    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchSub32(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         sub32(imm, dest);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchSub32(Condition cond, Imm32 imm, Address dest)
+    Jump branchSub32(Condition cond, TrustedImm32 imm, Address dest)
     {
         ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
         sub32(imm, dest);
@@ -904,6 +1074,21 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
+    Jump branchSub32(Condition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        // B := A - B is invalid.
+        ASSERT(src1 == dest || src2 != dest);
+
+        move(src1, dest);
+        return branchSub32(cond, src2, dest);
+    }
+
+    Jump branchSub32(Condition cond, RegisterID src1, TrustedImm32 src2, RegisterID dest)
+    {
+        move(src1, dest);
+        return branchSub32(cond, src2, dest);
+    }
+
     Jump branchNeg32(Condition cond, RegisterID srcDest)
     {
         ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
@@ -958,7 +1143,7 @@ public:
         m_assembler.setCC_r(x86Condition(cond), dest);
     }
 
-    void set8Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set8Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
             m_assembler.testl_rr(left, left);
@@ -974,7 +1159,7 @@ public:
         m_assembler.movzbl_rr(dest, dest);
     }
 
-    void set32Compare32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void set32Compare32(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
             m_assembler.testl_rr(left, left);
@@ -989,7 +1174,7 @@ public:
     // dest-src, operations always have a dest? ... possibly not true, considering
     // asm ops like test, or pseudo ops like pop().
 
-    void set32Test8(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test8(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         if (mask.m_value == -1)
             m_assembler.cmpb_im(0, address.offset, address.base);
@@ -999,7 +1184,7 @@ public:
         m_assembler.movzbl_rr(dest, dest);
     }
 
-    void set32Test32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    void set32Test32(Condition cond, Address address, TrustedImm32 mask, RegisterID dest)
     {
         if (mask.m_value == -1)
             m_assembler.cmpl_im(0, address.offset, address.base);
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index 168c93f..30c717f 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -48,30 +48,31 @@ public:
     using MacroAssemblerX86Common::load32;
     using MacroAssemblerX86Common::store32;
     using MacroAssemblerX86Common::call;
+    using MacroAssemblerX86Common::addDouble;
     using MacroAssemblerX86Common::loadDouble;
     using MacroAssemblerX86Common::convertInt32ToDouble;
 
-    void add32(Imm32 imm, AbsoluteAddress address)
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
     {
-        move(ImmPtr(address.m_ptr), scratchRegister);
+        move(TrustedImmPtr(address.m_ptr), scratchRegister);
         add32(imm, Address(scratchRegister));
     }
     
-    void and32(Imm32 imm, AbsoluteAddress address)
+    void and32(TrustedImm32 imm, AbsoluteAddress address)
     {
-        move(ImmPtr(address.m_ptr), scratchRegister);
+        move(TrustedImmPtr(address.m_ptr), scratchRegister);
         and32(imm, Address(scratchRegister));
     }
     
-    void or32(Imm32 imm, AbsoluteAddress address)
+    void or32(TrustedImm32 imm, AbsoluteAddress address)
     {
-        move(ImmPtr(address.m_ptr), scratchRegister);
+        move(TrustedImmPtr(address.m_ptr), scratchRegister);
         or32(imm, Address(scratchRegister));
     }
 
-    void sub32(Imm32 imm, AbsoluteAddress address)
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
     {
-        move(ImmPtr(address.m_ptr), scratchRegister);
+        move(TrustedImmPtr(address.m_ptr), scratchRegister);
         sub32(imm, Address(scratchRegister));
     }
 
@@ -88,17 +89,23 @@ public:
 
     void loadDouble(const void* address, FPRegisterID dest)
     {
-        move(ImmPtr(address), scratchRegister);
+        move(TrustedImmPtr(address), scratchRegister);
         loadDouble(scratchRegister, dest);
     }
 
-    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    void addDouble(AbsoluteAddress address, FPRegisterID dest)
     {
-        move(Imm32(*static_cast<int32_t*>(src.m_ptr)), scratchRegister);
+        move(TrustedImmPtr(address.m_ptr), scratchRegister);
+        m_assembler.addsd_mr(0, scratchRegister, dest);
+    }
+
+    void convertInt32ToDouble(TrustedImm32 imm, FPRegisterID dest)
+    {
+        move(imm, scratchRegister);
         m_assembler.cvtsi2sd_rr(scratchRegister, dest);
     }
 
-    void store32(Imm32 imm, void* address)
+    void store32(TrustedImm32 imm, void* address)
     {
         move(X86Registers::eax, scratchRegister);
         move(imm, X86Registers::eax);
@@ -108,7 +115,7 @@ public:
 
     Call call()
     {
-        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        DataLabelPtr label = moveWithPatch(TrustedImmPtr(0), scratchRegister);
         Call result = Call(m_assembler.call(scratchRegister), Call::Linkable);
         ASSERT(differenceBetween(label, result) == REPTACH_OFFSET_CALL_R11);
         return result;
@@ -116,7 +123,7 @@ public:
 
     Call tailRecursiveCall()
     {
-        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        DataLabelPtr label = moveWithPatch(TrustedImmPtr(0), scratchRegister);
         Jump newJump = Jump(m_assembler.jmp_r(scratchRegister));
         ASSERT(differenceBetween(label, newJump) == REPTACH_OFFSET_CALL_R11);
         return Call::fromTailJump(newJump);
@@ -125,7 +132,7 @@ public:
     Call makeTailRecursiveCall(Jump oldJump)
     {
         oldJump.link(this);
-        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        DataLabelPtr label = moveWithPatch(TrustedImmPtr(0), scratchRegister);
         Jump newJump = Jump(m_assembler.jmp_r(scratchRegister));
         ASSERT(differenceBetween(label, newJump) == REPTACH_OFFSET_CALL_R11);
         return Call::fromTailJump(newJump);
@@ -137,30 +144,30 @@ public:
         m_assembler.addq_rr(src, dest);
     }
 
-    void addPtr(Imm32 imm, RegisterID srcDest)
+    void addPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         m_assembler.addq_ir(imm.m_value, srcDest);
     }
 
-    void addPtr(ImmPtr imm, RegisterID dest)
+    void addPtr(TrustedImmPtr imm, RegisterID dest)
     {
         move(imm, scratchRegister);
         m_assembler.addq_rr(scratchRegister, dest);
     }
 
-    void addPtr(Imm32 imm, RegisterID src, RegisterID dest)
+    void addPtr(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         m_assembler.leaq_mr(imm.m_value, src, dest);
     }
 
-    void addPtr(Imm32 imm, Address address)
+    void addPtr(TrustedImm32 imm, Address address)
     {
         m_assembler.addq_im(imm.m_value, address.offset, address.base);
     }
 
-    void addPtr(Imm32 imm, AbsoluteAddress address)
+    void addPtr(TrustedImm32 imm, AbsoluteAddress address)
     {
-        move(ImmPtr(address.m_ptr), scratchRegister);
+        move(TrustedImmPtr(address.m_ptr), scratchRegister);
         addPtr(imm, Address(scratchRegister));
     }
     
@@ -169,7 +176,7 @@ public:
         m_assembler.andq_rr(src, dest);
     }
 
-    void andPtr(Imm32 imm, RegisterID srcDest)
+    void andPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         m_assembler.andq_ir(imm.m_value, srcDest);
     }
@@ -179,28 +186,46 @@ public:
         m_assembler.orq_rr(src, dest);
     }
 
-    void orPtr(ImmPtr imm, RegisterID dest)
+    void orPtr(TrustedImmPtr imm, RegisterID dest)
     {
         move(imm, scratchRegister);
         m_assembler.orq_rr(scratchRegister, dest);
     }
 
-    void orPtr(Imm32 imm, RegisterID dest)
+    void orPtr(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.orq_ir(imm.m_value, dest);
     }
 
+    void orPtr(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2)
+            move(op1, dest);
+        else if (op1 == dest)
+            orPtr(op2, dest);
+        else {
+            move(op2, dest);
+            orPtr(op1, dest);
+        }
+    }
+
+    void orPtr(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+        orPtr(imm, dest);
+    }
+
     void subPtr(RegisterID src, RegisterID dest)
     {
         m_assembler.subq_rr(src, dest);
     }
     
-    void subPtr(Imm32 imm, RegisterID dest)
+    void subPtr(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.subq_ir(imm.m_value, dest);
     }
     
-    void subPtr(ImmPtr imm, RegisterID dest)
+    void subPtr(TrustedImmPtr imm, RegisterID dest)
     {
         move(imm, scratchRegister);
         m_assembler.subq_rr(scratchRegister, dest);
@@ -211,7 +236,7 @@ public:
         m_assembler.xorq_rr(src, dest);
     }
 
-    void xorPtr(Imm32 imm, RegisterID srcDest)
+    void xorPtr(TrustedImm32 imm, RegisterID srcDest)
     {
         m_assembler.xorq_ir(imm.m_value, srcDest);
     }
@@ -227,7 +252,7 @@ public:
         m_assembler.movq_mr(address.offset, address.base, address.index, address.scale, dest);
     }
 
-    void loadPtr(void* address, RegisterID dest)
+    void loadPtr(const void* address, RegisterID dest)
     {
         if (dest == X86Registers::eax)
             m_assembler.movq_mEAX(address);
@@ -265,7 +290,7 @@ public:
         }
     }
 
-    void storePtr(ImmPtr imm, ImplicitAddress address)
+    void storePtr(TrustedImmPtr imm, ImplicitAddress address)
     {
         move(imm, scratchRegister);
         storePtr(scratchRegister, address);
@@ -287,7 +312,7 @@ public:
         m_assembler.movq_rr(src, dest);
     }
 
-    void setPtr(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    void setPtr(Condition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
             m_assembler.testq_rr(left, left);
@@ -303,7 +328,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchPtr(Condition cond, RegisterID left, ImmPtr right)
+    Jump branchPtr(Condition cond, RegisterID left, TrustedImmPtr right)
     {
         move(right, scratchRegister);
         return branchPtr(cond, left, scratchRegister);
@@ -317,7 +342,7 @@ public:
 
     Jump branchPtr(Condition cond, AbsoluteAddress left, RegisterID right)
     {
-        move(ImmPtr(left.m_ptr), scratchRegister);
+        move(TrustedImmPtr(left.m_ptr), scratchRegister);
         return branchPtr(cond, Address(scratchRegister), right);
     }
 
@@ -327,7 +352,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchPtr(Condition cond, Address left, ImmPtr right)
+    Jump branchPtr(Condition cond, Address left, TrustedImmPtr right)
     {
         move(right, scratchRegister);
         return branchPtr(cond, left, scratchRegister);
@@ -339,7 +364,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchTestPtr(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
     {
         // if we are only interested in the low seven bits, this can be tested with a testb
         if (mask.m_value == -1)
@@ -351,7 +376,13 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchTestPtr(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        loadPtr(address.m_ptr, scratchRegister);
+        return branchTestPtr(cond, scratchRegister, mask);
+    }
+
+    Jump branchTestPtr(Condition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
     {
         if (mask.m_value == -1)
             m_assembler.cmpq_im(0, address.offset, address.base);
@@ -360,7 +391,7 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchTestPtr(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
     {
         if (mask.m_value == -1)
             m_assembler.cmpq_im(0, address.offset, address.base, address.index, address.scale);
@@ -377,32 +408,32 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    Jump branchSubPtr(Condition cond, Imm32 imm, RegisterID dest)
+    Jump branchSubPtr(Condition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
         subPtr(imm, dest);
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
-    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
     {
         m_assembler.movq_i64r(initialValue.asIntptr(), dest);
         return DataLabelPtr(this);
     }
 
-    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         dataLabel = moveWithPatch(initialRightValue, scratchRegister);
         return branchPtr(cond, left, scratchRegister);
     }
 
-    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
     {
         dataLabel = moveWithPatch(initialRightValue, scratchRegister);
         return branchPtr(cond, left, scratchRegister);
     }
 
-    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
     {
         DataLabelPtr label = moveWithPatch(initialValue, scratchRegister);
         storePtr(scratchRegister, address);
@@ -410,20 +441,13 @@ public:
     }
 
     using MacroAssemblerX86Common::branchTest8;
-    Jump branchTest8(Condition cond, ExtendedAddress address, Imm32 mask = Imm32(-1))
+    Jump branchTest8(Condition cond, ExtendedAddress address, TrustedImm32 mask = TrustedImm32(-1))
     {
-        ImmPtr addr(reinterpret_cast<void*>(address.offset));
+        TrustedImmPtr addr(reinterpret_cast<void*>(address.offset));
         MacroAssemblerX86Common::move(addr, scratchRegister);
         return MacroAssemblerX86Common::branchTest8(cond, BaseIndex(scratchRegister, address.base, TimesOne), mask);
     }
 
-    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
-    {
-        Label label(this);
-        loadPtr(address, dest);
-        return label;
-    }
-
     bool supportsFloatingPoint() const { return true; }
     // See comment on MacroAssemblerARMv7::supportsFloatingPointTruncate()
     bool supportsFloatingPointTruncate() const { return true; }
diff --git a/Source/JavaScriptCore/assembler/RepatchBuffer.h b/Source/JavaScriptCore/assembler/RepatchBuffer.h
index 72cf6b2..e9feb65 100644
--- a/Source/JavaScriptCore/assembler/RepatchBuffer.h
+++ b/Source/JavaScriptCore/assembler/RepatchBuffer.h
@@ -92,11 +92,6 @@ public:
         MacroAssembler::repatchPointer(dataLabelPtr, value);
     }
 
-    void repatchLoadPtrToLEA(CodeLocationInstruction instruction)
-    {
-        MacroAssembler::repatchLoadPtrToLEA(instruction);
-    }
-
     void relinkCallerToTrampoline(ReturnAddressPtr returnAddress, CodeLocationLabel label)
     {
         relink(CodeLocationCall(CodePtr(returnAddress)), label);
diff --git a/Source/JavaScriptCore/assembler/SH4Assembler.h b/Source/JavaScriptCore/assembler/SH4Assembler.h
new file mode 100644
index 0000000..5726ae8
--- /dev/null
+++ b/Source/JavaScriptCore/assembler/SH4Assembler.h
@@ -0,0 +1,2067 @@
+/*
+ * Copyright (C) 2009-2011 STMicroelectronics. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SH4Assembler_h
+#define SH4Assembler_h
+
+#if ENABLE(ASSEMBLER) && CPU(SH4)
+
+#include "AssemblerBuffer.h"
+#include "AssemblerBufferWithConstantPool.h"
+#include <stdarg.h>
+#include <stdint.h>
+#include <wtf/Assertions.h>
+#include <wtf/Vector.h>
+
+#ifndef NDEBUG
+#define SH4_ASSEMBLER_TRACING
+#endif
+
+namespace JSC {
+typedef uint16_t SH4Word;
+
+enum {
+    INVALID_OPCODE = 0xffff,
+    ADD_OPCODE = 0x300c,
+    ADDIMM_OPCODE = 0x7000,
+    ADDC_OPCODE = 0x300e,
+    ADDV_OPCODE = 0x300f,
+    AND_OPCODE = 0x2009,
+    ANDIMM_OPCODE = 0xc900,
+    DIV0_OPCODE = 0x2007,
+    DIV1_OPCODE = 0x3004,
+    BF_OPCODE = 0x8b00,
+    BFS_OPCODE = 0x8f00,
+    BRA_OPCODE = 0xa000,
+    BRAF_OPCODE = 0x0023,
+    NOP_OPCODE = 0x0009,
+    BSR_OPCODE = 0xb000,
+    RTS_OPCODE = 0x000b,
+    BT_OPCODE = 0x8900,
+    BTS_OPCODE = 0x8d00,
+    BSRF_OPCODE = 0x0003,
+    BRK_OPCODE = 0x003b,
+    FTRC_OPCODE = 0xf03d,
+    CMPEQ_OPCODE = 0x3000,
+    CMPEQIMM_OPCODE = 0x8800,
+    CMPGE_OPCODE = 0x3003,
+    CMPGT_OPCODE = 0x3007,
+    CMPHI_OPCODE = 0x3006,
+    CMPHS_OPCODE = 0x3002,
+    CMPPL_OPCODE = 0x4015,
+    CMPPZ_OPCODE = 0x4011,
+    CMPSTR_OPCODE = 0x200c,
+    DT_OPCODE = 0x4010,
+    FCMPEQ_OPCODE = 0xf004,
+    FCMPGT_OPCODE = 0xf005,
+    FMOV_OPCODE = 0xf00c,
+    FADD_OPCODE = 0xf000,
+    FMUL_OPCODE = 0xf002,
+    FSUB_OPCODE = 0xf001,
+    FDIV_OPCODE = 0xf003,
+    FNEG_OPCODE = 0xf04d,
+    JMP_OPCODE = 0x402b,
+    JSR_OPCODE = 0x400b,
+    LDSPR_OPCODE = 0x402a,
+    LDSLPR_OPCODE = 0x4026,
+    MOV_OPCODE = 0x6003,
+    MOVIMM_OPCODE = 0xe000,
+    MOVB_WRITE_RN_OPCODE = 0x2000,
+    MOVB_WRITE_RNDEC_OPCODE = 0x2004,
+    MOVB_WRITE_R0RN_OPCODE = 0x0004,
+    MOVB_WRITE_OFFGBR_OPCODE = 0xc000,
+    MOVB_WRITE_OFFRN_OPCODE = 0x8000,
+    MOVB_READ_RM_OPCODE = 0x6000,
+    MOVB_READ_RMINC_OPCODE = 0x6004,
+    MOVB_READ_R0RM_OPCODE = 0x000c,
+    MOVB_READ_OFFGBR_OPCODE = 0xc400,
+    MOVB_READ_OFFRM_OPCODE = 0x8400,
+    MOVL_WRITE_RN_OPCODE = 0x2002,
+    MOVL_WRITE_RNDEC_OPCODE = 0x2006,
+    MOVL_WRITE_R0RN_OPCODE = 0x0006,
+    MOVL_WRITE_OFFGBR_OPCODE = 0xc200,
+    MOVL_WRITE_OFFRN_OPCODE = 0x1000,
+    MOVL_READ_RM_OPCODE = 0x6002,
+    MOVL_READ_RMINC_OPCODE = 0x6006,
+    MOVL_READ_R0RM_OPCODE = 0x000e,
+    MOVL_READ_OFFGBR_OPCODE = 0xc600,
+    MOVL_READ_OFFPC_OPCODE = 0xd000,
+    MOVL_READ_OFFRM_OPCODE = 0x5000,
+    MOVW_WRITE_RN_OPCODE = 0x2001,
+    MOVW_READ_RM_OPCODE = 0x6001,
+    MOVW_READ_R0RM_OPCODE = 0x000d,
+    MOVW_READ_OFFRM_OPCODE = 0x8500,
+    MOVW_READ_OFFPC_OPCODE = 0x9000,
+    MOVA_READ_OFFPC_OPCODE = 0xc700,
+    MOVT_OPCODE = 0x0029,
+    MULL_OPCODE = 0x0007,
+    DMULL_L_OPCODE = 0x3005,
+    STSMACL_OPCODE = 0x001a,
+    STSMACH_OPCODE = 0x000a,
+    DMULSL_OPCODE = 0x300d,
+    NEG_OPCODE = 0x600b,
+    NEGC_OPCODE = 0x600a,
+    NOT_OPCODE = 0x6007,
+    OR_OPCODE = 0x200b,
+    ORIMM_OPCODE = 0xcb00,
+    ORBIMM_OPCODE = 0xcf00,
+    SETS_OPCODE = 0x0058,
+    SETT_OPCODE = 0x0018,
+    SHAD_OPCODE = 0x400c,
+    SHAL_OPCODE = 0x4020,
+    SHAR_OPCODE = 0x4021,
+    SHLD_OPCODE = 0x400d,
+    SHLL_OPCODE = 0x4000,
+    SHLL2_OPCODE = 0x4008,
+    SHLL8_OPCODE = 0x4018,
+    SHLL16_OPCODE = 0x4028,
+    SHLR_OPCODE = 0x4001,
+    SHLR2_OPCODE = 0x4009,
+    SHLR8_OPCODE = 0x4019,
+    SHLR16_OPCODE = 0x4029,
+    STSPR_OPCODE = 0x002a,
+    STSLPR_OPCODE = 0x4022,
+    FLOAT_OPCODE = 0xf02d,
+    SUB_OPCODE = 0x3008,
+    SUBC_OPCODE = 0x300a,
+    SUBV_OPCODE = 0x300b,
+    TST_OPCODE = 0x2008,
+    TSTIMM_OPCODE = 0xc800,
+    TSTB_OPCODE = 0xcc00,
+    EXTUW_OPCODE = 0x600d,
+    XOR_OPCODE = 0x200a,
+    XORIMM_OPCODE = 0xca00,
+    XORB_OPCODE = 0xce00,
+    FMOVS_READ_RM_INC_OPCODE = 0xf009,
+    FMOVS_READ_RM_OPCODE = 0xf008,
+    FMOVS_READ_R0RM_OPCODE = 0xf006,
+    FMOVS_WRITE_RN_OPCODE = 0xf00a,
+    FMOVS_WRITE_RN_DEC_OPCODE = 0xf00b,
+    FMOVS_WRITE_R0RN_OPCODE = 0xf007,
+    FCNVDS_DRM_FPUL_OPCODE = 0xf0bd,
+    LDS_RM_FPUL_OPCODE = 0x405a,
+    FLDS_FRM_FPUL_OPCODE = 0xf01d,
+    STS_FPUL_RN_OPCODE = 0x005a,
+    FSTS_FPUL_FRN_OPCODE = 0xF00d,
+    LDSFPSCR_OPCODE = 0x406a,
+    STSFPSCR_OPCODE = 0x006a,
+    LDSRMFPUL_OPCODE = 0x405a,
+    FSTSFPULFRN_OPCODE = 0xf00d,
+    FSQRT_OPCODE = 0xf06d,
+    FSCHG_OPCODE = 0xf3fd,
+    CLRT_OPCODE = 8,
+};
+
+namespace SH4Registers {
+typedef enum {
+    r0,
+    r1,
+    r2,
+    r3,
+    r4,
+    r5,
+    r6,
+    r7,
+    r8,
+    r9,
+    r10,
+    r11,
+    r12,
+    r13,
+    r14, fp = r14,
+    r15, sp = r15,
+    pc,
+    pr,
+} RegisterID;
+
+typedef enum {
+    fr0, dr0 = fr0,
+    fr1,
+    fr2, dr2 = fr2,
+    fr3,
+    fr4, dr4 = fr4,
+    fr5,
+    fr6, dr6 = fr6,
+    fr7,
+    fr8, dr8 = fr8,
+    fr9,
+    fr10, dr10 = fr10,
+    fr11,
+    fr12, dr12 = fr12,
+    fr13,
+    fr14, dr14 = fr14,
+    fr15,
+} FPRegisterID;
+}
+
+inline uint16_t getOpcodeGroup1(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0xf) << 8) | ((rn & 0xf) << 4));
+}
+
+inline uint16_t getOpcodeGroup2(uint16_t opc, int rm)
+{
+    return (opc | ((rm & 0xf) << 8));
+}
+
+inline uint16_t getOpcodeGroup3(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0xf) << 8) | (rn & 0xff));
+}
+
+inline uint16_t getOpcodeGroup4(uint16_t opc, int rm, int rn, int offset)
+{
+    return (opc | ((rm & 0xf) << 8) | ((rn & 0xf) << 4) | (offset & 0xf));
+}
+
+inline uint16_t getOpcodeGroup5(uint16_t opc, int rm)
+{
+    return (opc | (rm & 0xff));
+}
+
+inline uint16_t getOpcodeGroup6(uint16_t opc, int rm)
+{
+    return (opc | (rm & 0xfff));
+}
+
+inline uint16_t getOpcodeGroup7(uint16_t opc, int rm)
+{
+    return (opc | ((rm & 0x7) << 9));
+}
+
+inline uint16_t getOpcodeGroup8(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0x7) << 9) | ((rn & 0x7) << 5));
+}
+
+inline uint16_t getOpcodeGroup9(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0xf) << 8) | ((rn & 0x7) << 5));
+}
+
+inline uint16_t getOpcodeGroup10(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0x7) << 9) | ((rn & 0xf) << 4));
+}
+
+inline uint16_t getOpcodeGroup11(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0xf) << 4) | (rn & 0xf));
+}
+
+inline uint16_t getRn(uint16_t x)
+{
+    return ((x & 0xf00) >> 8);
+}
+
+inline uint16_t getRm(uint16_t x)
+{
+    return ((x & 0xf0) >> 4);
+}
+
+inline uint16_t getDisp(uint16_t x)
+{
+    return (x & 0xf);
+}
+
+inline uint16_t getImm8(uint16_t x)
+{
+    return (x & 0xff);
+}
+
+inline uint16_t getImm12(uint16_t x)
+{
+    return (x & 0xfff);
+}
+
+inline uint16_t getDRn(uint16_t x)
+{
+    return ((x & 0xe00) >> 9);
+}
+
+inline uint16_t getDRm(uint16_t x)
+{
+    return ((x & 0xe0) >> 5);
+}
+
+class SH4Assembler {
+public:
+    typedef SH4Registers::RegisterID RegisterID;
+    typedef SH4Registers::FPRegisterID FPRegisterID;
+    typedef AssemblerBufferWithConstantPool<512, 4, 2, SH4Assembler> SH4Buffer;
+    static const RegisterID scratchReg1 = SH4Registers::r3;
+    static const RegisterID scratchReg2 = SH4Registers::r11;
+    static const uint32_t maxInstructionSize = 16;
+
+    enum {
+        padForAlign8 = 0x00,
+        padForAlign16 = 0x0009,
+        padForAlign32 = 0x00090009,
+    };
+
+    SH4Assembler()
+    {
+        m_claimscratchReg = 0x0;
+    }
+
+    // SH4 condition codes
+    typedef enum {
+        EQ = 0x0, // Equal
+        NE = 0x1, // Not Equal
+        HS = 0x2, // Unsigend Greater Than equal
+        HI = 0x3, // Unsigend Greater Than
+        LS = 0x4, // Unsigend Lower or Same
+        LI = 0x5, // Unsigend Lower
+        GE = 0x6, // Greater or Equal
+        LT = 0x7, // Less Than
+        GT = 0x8, // Greater Than
+        LE = 0x9, // Less or Equal
+        OF = 0xa, // OverFlow
+        SI = 0xb, // Signed
+        EQU= 0xc, // Equal or unordered(NaN)
+        NEU= 0xd,
+        GTU= 0xe,
+        GEU= 0xf,
+        LTU= 0x10,
+        LEU= 0x11,
+    } Condition;
+
+    // Opaque label types
+public:
+    class JmpSrc {
+        friend class SH4Assembler;
+    public:
+        JmpSrc()
+            : m_offset(-1)
+        {
+        }
+
+    private:
+        JmpSrc(int offset)
+            : m_offset(offset)
+        {
+        }
+
+        int m_offset;
+    };
+
+    class JmpDst {
+        friend class SH4Assembler;
+    public:
+        JmpDst()
+            : m_offset(-1)
+            , m_used(false)
+        {
+        }
+
+        bool isUsed() const { return m_used; }
+        bool isSet() const { return (m_offset != -1); }
+        void used() { m_used = true; }
+
+    private:
+        JmpDst(int offset)
+            : m_offset(offset)
+            , m_used(false)
+        {
+            ASSERT(m_offset == offset);
+        }
+
+        int m_offset : 31;
+        int m_used : 1;
+    };
+
+    bool isImmediate(int constant)
+    {
+        return ((constant <= 127) && (constant >= -128));
+    }
+
+    RegisterID claimScratch()
+    {
+        ASSERT((m_claimscratchReg != 0x3));
+
+        if (!(m_claimscratchReg & 0x1)) {
+            m_claimscratchReg = (m_claimscratchReg | 0x1);
+            return scratchReg1;
+        }
+
+        m_claimscratchReg = (m_claimscratchReg | 0x2);
+        return scratchReg2;
+    }
+
+    void releaseScratch(RegisterID scratchR)
+    {
+        if (scratchR == scratchReg1)
+            m_claimscratchReg = (m_claimscratchReg & 0x2);
+        else
+            m_claimscratchReg = (m_claimscratchReg & 0x1);
+    }
+
+    // Stack operations
+
+    void pushReg(RegisterID reg)
+    {
+        if (reg == SH4Registers::pr) {
+            oneShortOp(getOpcodeGroup2(STSLPR_OPCODE, SH4Registers::sp));
+            return;
+        }
+
+        oneShortOp(getOpcodeGroup1(MOVL_WRITE_RNDEC_OPCODE, SH4Registers::sp, reg));
+    }
+
+    void popReg(RegisterID reg)
+    {
+        if (reg == SH4Registers::pr) {
+            oneShortOp(getOpcodeGroup2(LDSLPR_OPCODE, SH4Registers::sp));
+            return;
+        }
+
+        oneShortOp(getOpcodeGroup1(MOVL_READ_RMINC_OPCODE, reg, SH4Registers::sp));
+    }
+
+    void movt(RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup2(MOVT_OPCODE, dst);
+        oneShortOp(opc);
+    }
+
+    // Arithmetic operations
+
+    void addlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(ADD_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void addclRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(ADDC_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void addvlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(ADDV_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void addlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 127) && (imm8 >= -128));
+
+        uint16_t opc = getOpcodeGroup3(ADDIMM_OPCODE, dst, imm8);
+        oneShortOp(opc);
+    }
+
+    void andlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(AND_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void andlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 255) && (imm8 >= 0));
+        ASSERT(dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup5(ANDIMM_OPCODE, imm8);
+        oneShortOp(opc);
+    }
+
+    void div1lRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(DIV1_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void div0lRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(DIV0_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void notlReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(NOT_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void orlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(OR_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void orlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 255) && (imm8 >= 0));
+        ASSERT(dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup5(ORIMM_OPCODE, imm8);
+        oneShortOp(opc);
+    }
+
+    void sublRegReg(RegisterID src, RegisterID dst)
+    {
+         uint16_t opc = getOpcodeGroup1(SUB_OPCODE, dst, src);
+         oneShortOp(opc);
+    }
+
+    void subvlRegReg(RegisterID src, RegisterID dst)
+    {
+         uint16_t opc = getOpcodeGroup1(SUBV_OPCODE, dst, src);
+         oneShortOp(opc);
+    }
+
+    void xorlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(XOR_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void xorlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 255) && (imm8 >= 0));
+        ASSERT(dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup5(XORIMM_OPCODE, imm8);
+        oneShortOp(opc);
+    }
+
+    void shllImm8r(int imm, RegisterID dst)
+    {
+        switch (imm) {
+        case 1:
+            oneShortOp(getOpcodeGroup2(SHLL_OPCODE, dst));
+            break;
+        case 2:
+            oneShortOp(getOpcodeGroup2(SHLL2_OPCODE, dst));
+            break;
+        case 8:
+            oneShortOp(getOpcodeGroup2(SHLL8_OPCODE, dst));
+            break;
+        case 16:
+            oneShortOp(getOpcodeGroup2(SHLL16_OPCODE, dst));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void neg(RegisterID dst, RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup1(NEG_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void shllRegReg(RegisterID dst, RegisterID rShift)
+    {
+        uint16_t opc = getOpcodeGroup1(SHLD_OPCODE, dst, rShift);
+        oneShortOp(opc);
+    }
+
+    void shlrRegReg(RegisterID dst, RegisterID rShift)
+    {
+        neg(rShift, rShift);
+        shllRegReg(dst, rShift);
+    }
+
+    void sharRegReg(RegisterID dst, RegisterID rShift)
+    {
+        neg(rShift, rShift);
+        shaRegReg(dst, rShift);
+    }
+
+    void shaRegReg(RegisterID dst, RegisterID rShift)
+    {
+        uint16_t opc = getOpcodeGroup1(SHAD_OPCODE, dst, rShift);
+        oneShortOp(opc);
+    }
+
+    void shlrImm8r(int imm, RegisterID dst)
+    {
+        switch (imm) {
+        case 1:
+            oneShortOp(getOpcodeGroup2(SHLR_OPCODE, dst));
+            break;
+        case 2:
+            oneShortOp(getOpcodeGroup2(SHLR2_OPCODE, dst));
+            break;
+        case 8:
+            oneShortOp(getOpcodeGroup2(SHLR8_OPCODE, dst));
+            break;
+        case 16:
+            oneShortOp(getOpcodeGroup2(SHLR16_OPCODE, dst));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void imullRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MULL_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void dmullRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(DMULL_L_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void dmulslRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(DMULSL_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void stsmacl(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(STSMACL_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void stsmach(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(STSMACH_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    // Comparisons
+
+    void cmplRegReg(RegisterID left, RegisterID right, Condition cond)
+    {
+        switch (cond) {
+        case NE:
+            oneShortOp(getOpcodeGroup1(CMPEQ_OPCODE, right, left));
+            break;
+        case GT:
+            oneShortOp(getOpcodeGroup1(CMPGT_OPCODE, right, left));
+            break;
+        case EQ:
+            oneShortOp(getOpcodeGroup1(CMPEQ_OPCODE, right, left));
+            break;
+        case GE:
+            oneShortOp(getOpcodeGroup1(CMPGE_OPCODE, right, left));
+            break;
+        case HS:
+            oneShortOp(getOpcodeGroup1(CMPHS_OPCODE, right, left));
+            break;
+        case HI:
+            oneShortOp(getOpcodeGroup1(CMPHI_OPCODE, right, left));
+            break;
+        case LI:
+            oneShortOp(getOpcodeGroup1(CMPHI_OPCODE, left, right));
+            break;
+        case LS:
+            oneShortOp(getOpcodeGroup1(CMPHS_OPCODE, left, right));
+            break;
+        case LE:
+            oneShortOp(getOpcodeGroup1(CMPGE_OPCODE, left, right));
+            break;
+        case LT:
+            oneShortOp(getOpcodeGroup1(CMPGT_OPCODE, left, right));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void cmppl(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(CMPPL_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void cmppz(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(CMPPZ_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void cmpEqImmR0(int imm, RegisterID dst, Condition cond)
+    {
+        uint16_t opc = getOpcodeGroup5(CMPEQIMM_OPCODE, imm);
+        oneShortOp(opc);
+    }
+
+    void testlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(TST_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void testlImm8r(int imm, RegisterID dst)
+    {
+        ASSERT((dst == SH4Registers::r0) && (imm <= 255) && (imm >= 0));
+
+        uint16_t opc = getOpcodeGroup5(TSTIMM_OPCODE, imm);
+        oneShortOp(opc);
+    }
+
+    void nop()
+    {
+        oneShortOp(NOP_OPCODE, false);
+    }
+
+    void sett()
+    {
+        oneShortOp(SETT_OPCODE);
+    }
+
+    void clrt()
+    {
+        oneShortOp(CLRT_OPCODE);
+    }
+
+    void fschg()
+    {
+        oneShortOp(FSCHG_OPCODE);
+    }
+
+    void bkpt()
+    {
+        oneShortOp(BRK_OPCODE, false);
+    }
+
+    void branch(uint16_t opc, int label)
+    {
+        switch (opc) {
+        case BT_OPCODE:
+            ASSERT((label <= 127) && (label >= -128));
+            oneShortOp(getOpcodeGroup5(BT_OPCODE, label));
+            break;
+        case BRA_OPCODE:
+            ASSERT((label <= 2047) && (label >= -2048));
+            oneShortOp(getOpcodeGroup6(BRA_OPCODE, label));
+            break;
+        case BF_OPCODE:
+            ASSERT((label <= 127) && (label >= -128));
+            oneShortOp(getOpcodeGroup5(BF_OPCODE, label));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void branch(uint16_t opc, RegisterID reg)
+    {
+        switch (opc) {
+        case BRAF_OPCODE:
+            oneShortOp(getOpcodeGroup2(BRAF_OPCODE, reg));
+            break;
+        case JMP_OPCODE:
+            oneShortOp(getOpcodeGroup2(JMP_OPCODE, reg));
+            break;
+        case JSR_OPCODE:
+            oneShortOp(getOpcodeGroup2(JSR_OPCODE, reg));
+            break;
+        case BSRF_OPCODE:
+            oneShortOp(getOpcodeGroup2(BSRF_OPCODE, reg));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void ldspr(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(LDSPR_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void stspr(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(STSPR_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void extuw(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(EXTUW_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    // float operations
+
+    void ldsrmfpul(RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(LDS_RM_FPUL_OPCODE, src);
+        oneShortOp(opc);
+    }
+
+    void fneg(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup2(FNEG_OPCODE, dst);
+        oneShortOp(opc, true, false);
+    }
+
+    void fsqrt(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup2(FSQRT_OPCODE, dst);
+        oneShortOp(opc, true, false);
+    }
+
+    void stsfpulReg(RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(STS_FPUL_RN_OPCODE, src);
+        oneShortOp(opc);
+    }
+
+    void floatfpulfrn(RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(FLOAT_OPCODE, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmull(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMUL_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsReadrm(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_READ_RM_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsWriterm(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_WRITE_RN_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsWriter0r(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_WRITE_R0RN_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsReadr0r(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_READ_R0RM_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsReadrminc(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_READ_RM_INC_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsWriterndec(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_WRITE_RN_DEC_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void ftrcRegfpul(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(FTRC_OPCODE, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fldsfpul(RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(FLDS_FRM_FPUL_OPCODE, src);
+        oneShortOp(opc);
+    }
+
+    void fstsfpul(RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(FSTS_FPUL_FRN_OPCODE, src);
+        oneShortOp(opc);
+    }
+
+    void ldsfpscr(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(LDSFPSCR_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void stsfpscr(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(STSFPSCR_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    // double operations
+
+    void dcnvds(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup7(FCNVDS_DRM_FPUL_OPCODE, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dcmppeq(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FCMPEQ_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dcmppgt(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FCMPGT_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dmulRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FMUL_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dsubRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FSUB_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void daddRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FADD_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dmovRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FMOV_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void ddivRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FDIV_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dsqrt(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup7(FSQRT_OPCODE, dst >> 1);
+        oneShortOp(opc);
+    }
+
+    void dneg(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup7(FNEG_OPCODE, dst >> 1);
+        oneShortOp(opc);
+    }
+
+    void fmovReadrm(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup10(FMOVS_READ_RM_OPCODE, dst >> 1, src);
+        oneShortOp(opc);
+    }
+
+    void fmovWriterm(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup9(FMOVS_WRITE_RN_OPCODE, dst, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void fmovWriter0r(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup9(FMOVS_WRITE_R0RN_OPCODE, dst, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void fmovReadr0r(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup10(FMOVS_READ_R0RM_OPCODE, dst >> 1, src);
+        oneShortOp(opc);
+    }
+
+    void fmovReadrminc(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup10(FMOVS_READ_RM_INC_OPCODE, dst >> 1, src);
+        oneShortOp(opc);
+    }
+
+    void fmovWriterndec(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup9(FMOVS_WRITE_RN_DEC_OPCODE, dst, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void floatfpulDreg(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup7(FLOAT_OPCODE, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void ftrcdrmfpul(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup7(FTRC_OPCODE, src >> 1);
+        oneShortOp(opc);
+    }
+
+    // Various move ops
+
+    void movImm8(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 127) && (imm8 >= -128));
+
+        uint16_t opc = getOpcodeGroup3(MOVIMM_OPCODE, dst, imm8);
+        oneShortOp(opc);
+    }
+
+    void movlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOV_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movwRegMem(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVW_WRITE_RN_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movwMemReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVW_READ_RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movwPCReg(int offset, RegisterID base, RegisterID dst)
+    {
+        ASSERT(base == SH4Registers::pc);
+        ASSERT((offset <= 255) && (offset >= 0));
+
+        uint16_t opc = getOpcodeGroup3(MOVW_READ_OFFPC_OPCODE, dst, offset);
+        oneShortOp(opc);
+    }
+
+    void movwMemReg(int offset, RegisterID base, RegisterID dst)
+    {
+        ASSERT(dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup11(MOVW_READ_OFFRM_OPCODE, base, offset);
+        oneShortOp(opc);
+    }
+
+    void movwR0mr(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVW_READ_R0RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movlRegMem(RegisterID src, int offset, RegisterID base)
+    {
+        ASSERT((offset <= 15) && (offset >= 0));
+
+        if (!offset) {
+            oneShortOp(getOpcodeGroup1(MOVL_WRITE_RN_OPCODE, base, src));
+            return;
+        }
+
+        oneShortOp(getOpcodeGroup4(MOVL_WRITE_OFFRN_OPCODE, base, src, offset));
+    }
+
+    void movlRegMem(RegisterID src, RegisterID base)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_WRITE_RN_OPCODE, base, src);
+        oneShortOp(opc);
+    }
+
+    void movlMemReg(int offset, RegisterID base, RegisterID dst)
+    {
+        if (base == SH4Registers::pc) {
+            ASSERT((offset <= 255) && (offset >= 0));
+            oneShortOp(getOpcodeGroup3(MOVL_READ_OFFPC_OPCODE, dst, offset));
+            return;
+        }
+
+        ASSERT((offset <= 15) && (offset >= 0));
+        if (!offset) {
+            oneShortOp(getOpcodeGroup1(MOVL_READ_RM_OPCODE, dst, base));
+            return;
+        }
+
+        oneShortOp(getOpcodeGroup4(MOVL_READ_OFFRM_OPCODE, dst, base, offset));
+    }
+
+    void movbMemReg(int offset, RegisterID base, RegisterID dst)
+    {
+        ASSERT(dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup11(MOVB_READ_OFFRM_OPCODE, base, offset);
+        oneShortOp(opc);
+    }
+
+    void movbR0mr(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVB_READ_R0RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movbMemReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVB_READ_RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movlMemReg(RegisterID base, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_READ_RM_OPCODE, dst, base);
+        oneShortOp(opc);
+    }
+
+    void movlMemRegIn(RegisterID base, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_READ_RMINC_OPCODE, dst, base);
+        oneShortOp(opc);
+    }
+
+    void movlR0mr(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_READ_R0RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movlRegMemr0(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_WRITE_R0RN_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 127) && (imm8 >= -128));
+
+        uint16_t opc = getOpcodeGroup3(MOVIMM_OPCODE, dst, imm8);
+        oneShortOp(opc);
+    }
+
+    void loadConstant(uint32_t constant, RegisterID dst)
+    {
+        if (((int)constant <= 0x7f) && ((int)constant >= -0x80)) {
+            movImm8(constant, dst);
+            return;
+        }
+
+        uint16_t opc = getOpcodeGroup3(MOVIMM_OPCODE, dst, 0);
+
+        m_buffer.ensureSpace(maxInstructionSize, sizeof(uint32_t));
+        printInstr(getOpcodeGroup3(MOVIMM_OPCODE, dst, constant), m_buffer.uncheckedSize());
+        m_buffer.putShortWithConstantInt(opc, constant, true);
+    }
+
+    void loadConstantUnReusable(uint32_t constant, RegisterID dst, bool ensureSpace = false)
+    {
+        uint16_t opc = getOpcodeGroup3(MOVIMM_OPCODE, dst, 0);
+
+        if (ensureSpace)
+            m_buffer.ensureSpace(maxInstructionSize, sizeof(uint32_t));
+
+        printInstr(getOpcodeGroup3(MOVIMM_OPCODE, dst, constant), m_buffer.uncheckedSize());
+        m_buffer.putShortWithConstantInt(opc, constant);
+    }
+
+    // Flow control
+
+    JmpSrc call()
+    {
+        RegisterID scr = claimScratch();
+        m_buffer.ensureSpace(maxInstructionSize + 4, sizeof(uint32_t));
+        loadConstantUnReusable(0x0, scr);
+        branch(JSR_OPCODE, scr);
+        nop();
+        releaseScratch(scr);
+        return JmpSrc(m_buffer.uncheckedSize());
+    }
+
+    JmpSrc call(RegisterID dst)
+    {
+        m_buffer.ensureSpace(maxInstructionSize + 2);
+        branch(JSR_OPCODE, dst);
+        nop();
+        return JmpSrc(m_buffer.uncheckedSize());
+    }
+
+    JmpSrc jmp()
+    {
+        RegisterID scr = claimScratch();
+        m_buffer.ensureSpace(maxInstructionSize + 4, sizeof(uint32_t));
+        int m_size = m_buffer.uncheckedSize();
+        loadConstantUnReusable(0x0, scr);
+        branch(BRAF_OPCODE, scr);
+        nop();
+        releaseScratch(scr);
+        return JmpSrc(m_size);
+    }
+
+    JmpSrc jmp(RegisterID dst)
+    {
+        jmpReg(dst);
+        return JmpSrc(m_buffer.uncheckedSize());
+    }
+
+    void jmpReg(RegisterID dst)
+    {
+        m_buffer.ensureSpace(maxInstructionSize + 2);
+        branch(JMP_OPCODE, dst);
+        nop();
+    }
+
+    JmpSrc jne()
+    {
+        int m_size = m_buffer.uncheckedSize();
+        branch(BF_OPCODE, 0);
+        return JmpSrc(m_size);
+    }
+
+    JmpSrc je()
+    {
+        int m_size = m_buffer.uncheckedSize();
+        branch(BT_OPCODE, 0);
+        return JmpSrc(m_size);
+    }
+
+    void ret()
+    {
+        m_buffer.ensureSpace(maxInstructionSize + 2);
+        oneShortOp(RTS_OPCODE, false);
+    }
+
+    JmpDst label()
+    {
+        return JmpDst(m_buffer.size());
+    }
+
+    int sizeOfConstantPool()
+    {
+         return m_buffer.sizeOfConstantPool();
+    }
+
+    JmpDst align(int alignment)
+    {
+        m_buffer.ensureSpace(maxInstructionSize + 2);
+        while (!m_buffer.isAligned(alignment)) {
+            nop();
+            m_buffer.ensureSpace(maxInstructionSize + 2);
+        }
+        return label();
+    }
+
+    static void changePCrelativeAddress(int offset, uint16_t* instructionPtr, uint32_t newAddress)
+    {
+        uint32_t address = (offset << 2) + ((reinterpret_cast<uint32_t>(instructionPtr) + 4) &(~0x3));
+        *reinterpret_cast<uint32_t*>(address) = newAddress;
+    }
+
+    static uint16_t* getInstructionPtr(void* code, int offset)
+    {
+        return reinterpret_cast<uint16_t*> (reinterpret_cast<uint32_t>(code) + offset);
+    }
+
+    static void linkJump(void* code, JmpSrc from, void* to)
+    {
+        ASSERT(from.m_offset != -1);
+
+        uint16_t* instructionPtr = getInstructionPtr(code, from.m_offset);
+        uint16_t instruction = *instructionPtr;
+        int offsetBits = (reinterpret_cast<uint32_t>(to) - reinterpret_cast<uint32_t>(code)) - from.m_offset;
+
+        if (((instruction & 0xff00) == BT_OPCODE) || ((instruction & 0xff00) == BF_OPCODE)) {
+            /* BT label ==> BF 2
+               nop          LDR reg
+               nop          braf @reg
+               nop          nop
+            */
+            offsetBits -= 8;
+            instruction ^= 0x0202;
+            *instructionPtr++ = instruction;
+            changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits);
+            instruction = (BRAF_OPCODE | (*instructionPtr++ & 0xf00));
+            *instructionPtr = instruction;
+            printBlockInstr(instructionPtr - 2, from.m_offset, 3);
+            return;
+         }
+
+         /* MOV #imm, reg => LDR reg
+            braf @reg        braf @reg
+            nop              nop
+         */
+        ASSERT((*(instructionPtr + 1) & BRAF_OPCODE) == BRAF_OPCODE);
+
+        offsetBits -= 4;
+        if (offsetBits >= -4096 && offsetBits <= 4094) {
+            *instructionPtr = getOpcodeGroup6(BRA_OPCODE, offsetBits >> 1);
+            *(++instructionPtr) = NOP_OPCODE;
+            printBlockInstr(instructionPtr - 1, from.m_offset, 2);
+            return;
+        }
+
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits - 2);
+        printInstr(*instructionPtr, from.m_offset + 2);
+    }
+
+    static void linkCall(void* code, JmpSrc from, void* to)
+    {
+        uint16_t* instructionPtr = getInstructionPtr(code, from.m_offset);
+        instructionPtr -= 3;
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, reinterpret_cast<uint32_t>(to));
+    }
+
+    static void linkPointer(void* code, JmpDst where, void* value)
+    {
+        uint16_t* instructionPtr = getInstructionPtr(code, where.m_offset);
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, reinterpret_cast<uint32_t>(value));
+    }
+
+    static unsigned getCallReturnOffset(JmpSrc call)
+    {
+        ASSERT(call.m_offset >= 0);
+        return call.m_offset;
+    }
+
+    static uint32_t* getLdrImmAddressOnPool(SH4Word* insn, uint32_t* constPool)
+    {
+        return (constPool + (*insn & 0xff));
+    }
+
+    static SH4Word patchConstantPoolLoad(SH4Word load, int value)
+    {
+        return ((load & ~0xff) | value);
+    }
+
+    static SH4Buffer::TwoShorts placeConstantPoolBarrier(int offset)
+    {
+        ASSERT(((offset >> 1) <=2047) && ((offset >> 1) >= -2048));
+
+        SH4Buffer::TwoShorts m_barrier;
+        m_barrier.high = (BRA_OPCODE | (offset >> 1));
+        m_barrier.low = NOP_OPCODE;
+        printInstr(((BRA_OPCODE | (offset >> 1))), 0);
+        printInstr(NOP_OPCODE, 0);
+        return m_barrier;
+    }
+
+    static void patchConstantPoolLoad(void* loadAddr, void* constPoolAddr)
+    {
+        SH4Word* instructionPtr = reinterpret_cast<SH4Word*>(loadAddr);
+        SH4Word instruction = *instructionPtr;
+        SH4Word index = instruction & 0xff;
+
+        if ((instruction & 0xf000) != MOVIMM_OPCODE)
+            return;
+
+        ASSERT((((reinterpret_cast<uint32_t>(constPoolAddr) - reinterpret_cast<uint32_t>(loadAddr)) + index * 4)) < 1024);
+
+        int offset = reinterpret_cast<uint32_t>(constPoolAddr) + (index * 4) - ((reinterpret_cast<uint32_t>(instructionPtr) & ~0x03) + 4);
+        instruction &=0xf00;
+        instruction |= 0xd000;
+        offset &= 0x03ff;
+        instruction |= (offset >> 2);
+        *instructionPtr = instruction;
+        printInstr(instruction, reinterpret_cast<uint32_t>(loadAddr));
+    }
+
+    static void repatchPointer(void* where, void* value)
+    {
+        patchPointer(where, value);
+    }
+
+    static void repatchInt32(void* where, int32_t value)
+    {
+        uint16_t* instructionPtr = reinterpret_cast<uint16_t*>(where);
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, value);
+    }
+
+    static void relinkCall(void* from, void* to)
+    {
+        uint16_t* instructionPtr = reinterpret_cast<uint16_t*>(from);
+        instructionPtr -= 3;
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, reinterpret_cast<uint32_t>(to));
+    }
+
+    static void relinkJump(void* from, void* to)
+    {
+        uint16_t* instructionPtr = reinterpret_cast<uint16_t*> (from);
+        uint16_t instruction = *instructionPtr;
+        int32_t offsetBits = (reinterpret_cast<uint32_t>(to) - reinterpret_cast<uint32_t>(from));
+
+        if (((*instructionPtr & 0xff00) == BT_OPCODE) || ((*instructionPtr & 0xff00) == BF_OPCODE)) {
+            offsetBits -= 8;
+            instructionPtr++;
+            changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits);
+            instruction = (BRAF_OPCODE | (*instructionPtr++ & 0xf00));
+            *instructionPtr = instruction;
+            printBlockInstr(instructionPtr, reinterpret_cast<uint32_t>(from) + 1, 3);
+            return;
+        }
+
+        ASSERT((*(instructionPtr + 1) & BRAF_OPCODE) == BRAF_OPCODE);
+        offsetBits -= 4;
+        if (offsetBits >= -4096 && offsetBits <= 4094) {
+            *instructionPtr = getOpcodeGroup6(BRA_OPCODE, offsetBits >> 1);
+            *(++instructionPtr) = NOP_OPCODE;
+            printBlockInstr(instructionPtr - 2, reinterpret_cast<uint32_t>(from), 2);
+            return;
+        }
+
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits - 2);
+        printInstr(*instructionPtr, reinterpret_cast<uint32_t>(from));
+    }
+
+    // Linking & patching
+
+    void linkJump(JmpSrc from, JmpDst to)
+    {
+        ASSERT(to.m_offset != -1);
+        ASSERT(from.m_offset != -1);
+
+        uint16_t* instructionPtr = getInstructionPtr(data(), from.m_offset);
+        uint16_t instruction = *instructionPtr;
+        int offsetBits;
+
+        if (((instruction & 0xff00) == BT_OPCODE) || ((instruction & 0xff00) == BF_OPCODE)) {
+            /* BT label => BF 2
+               nop        LDR reg
+               nop        braf @reg
+               nop        nop
+            */
+            offsetBits = (to.m_offset - from.m_offset) - 8;
+            instruction ^= 0x0202;
+            *instructionPtr++ = instruction;
+            if ((*instructionPtr & 0xf000) == 0xe000) {
+                uint32_t* addr = getLdrImmAddressOnPool(instructionPtr, m_buffer.poolAddress());
+                *addr = offsetBits;
+            } else
+                changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits);
+            instruction = (BRAF_OPCODE | (*instructionPtr++ & 0xf00));
+            *instructionPtr = instruction;
+            printBlockInstr(instructionPtr - 2, from.m_offset, 3);
+            return;
+        }
+
+        /* MOV # imm, reg => LDR reg
+           braf @reg         braf @reg
+           nop               nop
+        */
+        ASSERT((*(instructionPtr + 1) & BRAF_OPCODE) == BRAF_OPCODE);
+        offsetBits = (to.m_offset - from.m_offset) - 4;
+        if (offsetBits >= -4096 && offsetBits <= 4094) {
+            *instructionPtr = getOpcodeGroup6(BRA_OPCODE, offsetBits >> 1);
+            *(++instructionPtr) = NOP_OPCODE;
+            printBlockInstr(instructionPtr - 1, from.m_offset, 2);
+            return;
+        }
+
+        instruction = *instructionPtr;
+        if ((instruction  & 0xf000) == 0xe000) {
+            uint32_t* addr = getLdrImmAddressOnPool(instructionPtr, m_buffer.poolAddress());
+            *addr = offsetBits - 2;
+            printInstr(*instructionPtr, from.m_offset + 2);
+            return;
+        }
+
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits - 2);
+        printInstr(*instructionPtr, from.m_offset + 2);
+    }
+
+    static void* getRelocatedAddress(void* code, JmpSrc jump)
+    {
+        return reinterpret_cast<void*>(reinterpret_cast<uint32_t>(code) + jump.m_offset);
+    }
+
+    static void* getRelocatedAddress(void* code, JmpDst destination)
+    {
+        ASSERT(destination.m_offset != -1);
+        return reinterpret_cast<void*>(reinterpret_cast<uint32_t>(code) + destination.m_offset);
+    }
+
+    static int getDifferenceBetweenLabels(JmpDst src, JmpDst dst)
+    {
+        return dst.m_offset - src.m_offset;
+    }
+
+    static int getDifferenceBetweenLabels(JmpDst src, JmpSrc dst)
+    {
+        return dst.m_offset - src.m_offset;
+    }
+
+    static int getDifferenceBetweenLabels(JmpSrc src, JmpDst dst)
+    {
+        return dst.m_offset - src.m_offset;
+    }
+
+    static void patchPointer(void* code, JmpDst where, void* value)
+    {
+        patchPointer(reinterpret_cast<uint32_t*>(code) + where.m_offset, value);
+    }
+
+    static void patchPointer(void* code, void* value)
+    {
+        patchInt32(code, reinterpret_cast<uint32_t>(value));
+    }
+
+    static void patchInt32(void* code, uint32_t value)
+    {
+        changePCrelativeAddress((*(reinterpret_cast<uint16_t*>(code)) & 0xff), reinterpret_cast<uint16_t*>(code), value);
+    }
+
+    void* executableCopy(ExecutablePool* allocator)
+    {
+        void* copy = m_buffer.executableCopy(allocator);
+        ASSERT(copy);
+        return copy;
+    }
+
+    void prefix(uint16_t pre)
+    {
+        m_buffer.putByte(pre);
+    }
+
+    void oneShortOp(uint16_t opcode, bool checksize = true, bool isDouble = true)
+    {
+        printInstr(opcode, m_buffer.uncheckedSize(), isDouble);
+        if (checksize)
+            m_buffer.ensureSpace(maxInstructionSize);
+        m_buffer.putShortUnchecked(opcode);
+    }
+
+    void ensureSpace(int space)
+    {
+        m_buffer.ensureSpace(space);
+    }
+
+    void ensureSpace(int insnSpace, int constSpace)
+    {
+        m_buffer.ensureSpace(insnSpace, constSpace);
+    }
+
+    // Administrative methods
+
+    void* data() const { return m_buffer.data(); }
+    int size()
+    {
+        return m_buffer.size();
+    }
+
+#ifdef SH4_ASSEMBLER_TRACING
+    static void printInstr(uint16_t opc, unsigned int size, bool isdoubleInst = true)
+    {
+        if (!getenv("JavaScriptCoreDumpJIT"))
+            return;
+
+        const char *format = 0;
+        printfStdoutInstr("offset: 0x%8.8x\t", size);
+        switch (opc) {
+        case BRK_OPCODE:
+            format = "    BRK\n";
+            break;
+        case NOP_OPCODE:
+            format = "    NOP\n";
+            break;
+        case RTS_OPCODE:
+            format ="    *RTS\n";
+            break;
+        case SETS_OPCODE:
+            format = "    SETS\n";
+            break;
+        case SETT_OPCODE:
+            format = "    SETT\n";
+            break;
+        case CLRT_OPCODE:
+            format = "    CLRT\n";
+            break;
+        case FSCHG_OPCODE:
+            format = "    FSCHG\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format);
+            return;
+        }
+        switch (opc & 0xf0ff) {
+        case BRAF_OPCODE:
+            format = "    *BRAF R%d\n";
+            break;
+        case DT_OPCODE:
+            format = "    DT R%d\n";
+            break;
+        case CMPPL_OPCODE:
+            format = "    CMP/PL R%d\n";
+            break;
+        case CMPPZ_OPCODE:
+            format = "    CMP/PZ R%d\n";
+            break;
+        case JMP_OPCODE:
+            format = "    *JMP @R%d\n";
+            break;
+        case JSR_OPCODE:
+            format = "    *JSR @R%d\n";
+            break;
+        case LDSPR_OPCODE:
+            format = "    LDS R%d, PR\n";
+            break;
+        case LDSLPR_OPCODE:
+            format = "    LDS.L @R%d+, PR\n";
+            break;
+        case MOVT_OPCODE:
+            format = "    MOVT R%d\n";
+            break;
+        case SHAL_OPCODE:
+            format = "    SHAL R%d\n";
+            break;
+        case SHAR_OPCODE:
+            format = "    SHAR R%d\n";
+            break;
+        case SHLL_OPCODE:
+            format = "    SHLL R%d\n";
+            break;
+        case SHLL2_OPCODE:
+            format = "    SHLL2 R%d\n";
+            break;
+        case SHLL8_OPCODE:
+            format = "    SHLL8 R%d\n";
+            break;
+        case SHLL16_OPCODE:
+            format = "    SHLL16 R%d\n";
+            break;
+        case SHLR_OPCODE:
+            format = "    SHLR R%d\n";
+            break;
+        case SHLR2_OPCODE:
+            format = "    SHLR2 R%d\n";
+            break;
+        case SHLR8_OPCODE:
+            format = "    SHLR8 R%d\n";
+            break;
+        case SHLR16_OPCODE:
+            format = "    SHLR16 R%d\n";
+            break;
+        case STSPR_OPCODE:
+            format = "    STS PR, R%d\n";
+            break;
+        case STSLPR_OPCODE:
+            format = "    STS.L PR, @-R%d\n";
+            break;
+        case LDS_RM_FPUL_OPCODE:
+            format = "    LDS R%d, FPUL\n";
+            break;
+        case STS_FPUL_RN_OPCODE:
+            format = "    STS FPUL, R%d \n";
+            break;
+        case FLDS_FRM_FPUL_OPCODE:
+            format = "    FLDS FR%d, FPUL\n";
+            break;
+        case FSTS_FPUL_FRN_OPCODE:
+            format = "    FSTS FPUL, R%d \n";
+            break;
+        case LDSFPSCR_OPCODE:
+            format = "    LDS R%d, FPSCR \n";
+            break;
+        case STSFPSCR_OPCODE:
+            format = "    STS FPSCR, R%d \n";
+            break;
+        case STSMACL_OPCODE:
+            format = "    STS MACL, R%d \n";
+            break;
+        case STSMACH_OPCODE:
+            format = "    STS MACH, R%d \n";
+            break;
+        case BSRF_OPCODE:
+            format = "    *BSRF R%d";
+            break;
+        case FTRC_OPCODE:
+            format = "    FTRC FR%d, FPUL\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getRn(opc));
+            return;
+        }
+        switch (opc & 0xf0ff) {
+        case FNEG_OPCODE:
+            format = "    FNEG DR%d\n";
+            break;
+        case FLOAT_OPCODE:
+            format = "    FLOAT DR%d\n";
+            break;
+        case FTRC_OPCODE:
+            format = "    FTRC FR%d, FPUL\n";
+            break;
+        case FSQRT_OPCODE:
+            format = "    FSQRT FR%d\n";
+            break;
+        case FCNVDS_DRM_FPUL_OPCODE:
+            format = "    FCNVDS FR%d, FPUL\n";
+            break;
+        }
+        if (format) {
+            if (isdoubleInst)
+                printfStdoutInstr(format, getDRn(opc) << 1);
+            else
+                printfStdoutInstr(format, getRn(opc));
+            return;
+        }
+        switch (opc & 0xf00f) {
+        case ADD_OPCODE:
+            format = "    ADD R%d, R%d\n";
+            break;
+        case ADDC_OPCODE:
+            format = "    ADDC R%d, R%d\n";
+            break;
+        case ADDV_OPCODE:
+            format = "    ADDV R%d, R%d\n";
+            break;
+        case AND_OPCODE:
+            format = "    AND R%d, R%d\n";
+            break;
+        case DIV1_OPCODE:
+            format = "    DIV1 R%d, R%d\n";
+            break;
+        case CMPEQ_OPCODE:
+            format = "    CMP/EQ R%d, R%d\n";
+            break;
+        case CMPGE_OPCODE:
+            format = "    CMP/GE R%d, R%d\n";
+            break;
+        case CMPGT_OPCODE:
+            format = "    CMP/GT R%d, R%d\n";
+            break;
+        case CMPHI_OPCODE:
+            format = "    CMP/HI R%d, R%d\n";
+            break;
+        case CMPHS_OPCODE:
+            format = "    CMP/HS R%d, R%d\n";
+            break;
+        case MOV_OPCODE:
+            format = "    MOV R%d, R%d\n";
+            break;
+        case MOVB_WRITE_RN_OPCODE:
+            format = "    MOV.B R%d, @R%d\n";
+            break;
+        case MOVB_WRITE_RNDEC_OPCODE:
+            format = "    MOV.B R%d, @-R%d\n";
+            break;
+        case MOVB_WRITE_R0RN_OPCODE:
+            format = "    MOV.B R%d, @(R0, R%d)\n";
+            break;
+        case MOVB_READ_RM_OPCODE:
+            format = "    MOV.B @R%d, R%d\n";
+            break;
+        case MOVB_READ_RMINC_OPCODE:
+            format = "    MOV.B @R%d+, R%d\n";
+            break;
+        case MOVB_READ_R0RM_OPCODE:
+            format = "    MOV.B @(R0, R%d), R%d\n";
+            break;
+        case MOVL_WRITE_RN_OPCODE:
+            format = "    MOV.L R%d, @R%d\n";
+            break;
+        case MOVL_WRITE_RNDEC_OPCODE:
+            format = "    MOV.L R%d, @-R%d\n";
+            break;
+        case MOVL_WRITE_R0RN_OPCODE:
+            format = "    MOV.L R%d, @(R0, R%d)\n";
+            break;
+        case MOVL_READ_RM_OPCODE:
+            format = "    MOV.L @R%d, R%d\n";
+            break;
+        case MOVL_READ_RMINC_OPCODE:
+            format = "    MOV.L @R%d+, R%d\n";
+            break;
+        case MOVL_READ_R0RM_OPCODE:
+            format = "    MOV.L @(R0, R%d), R%d\n";
+            break;
+        case MULL_OPCODE:
+            format = "    MUL.L R%d, R%d\n";
+            break;
+        case DMULL_L_OPCODE:
+            format = "    DMULU.L R%d, R%d\n";
+            break;
+        case DMULSL_OPCODE:
+            format = "    DMULS.L R%d, R%d\n";
+            break;
+        case NEG_OPCODE:
+            format = "    NEG R%d, R%d\n";
+            break;
+        case NEGC_OPCODE:
+            format = "    NEGC R%d, R%d\n";
+            break;
+        case NOT_OPCODE:
+            format = "    NOT R%d, R%d\n";
+            break;
+        case OR_OPCODE:
+            format = "    OR R%d, R%d\n";
+            break;
+        case SHAD_OPCODE:
+            format = "    SHAD R%d, R%d\n";
+            break;
+        case SHLD_OPCODE:
+            format = "    SHLD R%d, R%d\n";
+            break;
+        case SUB_OPCODE:
+            format = "    SUB R%d, R%d\n";
+            break;
+        case SUBC_OPCODE:
+            format = "    SUBC R%d, R%d\n";
+            break;
+        case SUBV_OPCODE:
+            format = "    SUBV R%d, R%d\n";
+            break;
+        case TST_OPCODE:
+            format = "    TST R%d, R%d\n";
+            break;
+        case XOR_OPCODE:
+            format = "    XOR R%d, R%d\n";break;
+        case MOVW_WRITE_RN_OPCODE:
+            format = "    MOV.W R%d, @R%d\n";
+            break;
+        case MOVW_READ_RM_OPCODE:
+            format = "    MOV.W @R%d, R%d\n";
+            break;
+        case MOVW_READ_R0RM_OPCODE:
+            format = "    MOV.W @(R0, R%d), R%d\n";
+            break;
+        case EXTUW_OPCODE:
+            format = "    EXTU.W R%d, R%d\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getRm(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xf00f) {
+        case FSUB_OPCODE:
+            format = "    FSUB FR%d, FR%d\n";
+            break;
+        case FADD_OPCODE:
+            format = "    FADD FR%d, FR%d\n";
+            break;
+        case FDIV_OPCODE:
+            format = "    FDIV FR%d, FR%d\n";
+            break;
+        case FMUL_OPCODE:
+            format = "    DMULL FR%d, FR%d\n";
+            break;
+        case FMOV_OPCODE:
+            format = "    FMOV FR%d, FR%d\n";
+            break;
+        case FCMPEQ_OPCODE:
+            format = "    FCMP/EQ FR%d, FR%d\n";
+            break;
+        case FCMPGT_OPCODE:
+            format = "    FCMP/GT FR%d, FR%d\n";
+            break;
+        }
+        if (format) {
+            if (isdoubleInst)
+                printfStdoutInstr(format, getDRm(opc) << 1, getDRn(opc) << 1);
+            else
+                printfStdoutInstr(format, getRm(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xf00f) {
+        case FMOVS_WRITE_RN_DEC_OPCODE:
+            format = "    %s FR%d, @-R%d\n";
+            break;
+        case FMOVS_WRITE_RN_OPCODE:
+            format = "    %s FR%d, @R%d\n";
+            break;
+        case FMOVS_WRITE_R0RN_OPCODE:
+            format = "    %s FR%d, @(R0, R%d)\n";
+            break;
+        }
+        if (format) {
+            if (isdoubleInst)
+                printfStdoutInstr(format, "FMOV", getDRm(opc) << 1, getDRn(opc));
+            else
+                printfStdoutInstr(format, "FMOV.S", getRm(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xf00f) {
+        case FMOVS_READ_RM_OPCODE:
+            format = "    %s @R%d, FR%d\n";
+            break;
+        case FMOVS_READ_RM_INC_OPCODE:
+            format = "    %s @R%d+, FR%d\n";
+            break;
+        case FMOVS_READ_R0RM_OPCODE:
+            format = "    %s @(R0, R%d), FR%d\n";
+            break;
+        }
+        if (format) {
+            if (isdoubleInst)
+                printfStdoutInstr(format, "FMOV", getDRm(opc), getDRn(opc) << 1);
+            else
+                printfStdoutInstr(format, "FMOV.S", getRm(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xff00) {
+        case BF_OPCODE:
+            format = "    BF %d\n";
+            break;
+        case BFS_OPCODE:
+            format = "    *BF/S %d\n";
+            break;
+        case ANDIMM_OPCODE:
+            format = "    AND #%d, R0\n";
+            break;
+        case BT_OPCODE:
+            format = "    BT %d\n";
+            break;
+        case BTS_OPCODE:
+            format = "    *BT/S %d\n";
+            break;
+        case CMPEQIMM_OPCODE:
+            format = "    CMP/EQ #%d, R0\n";
+            break;
+        case MOVB_WRITE_OFFGBR_OPCODE:
+            format = "    MOV.B R0, @(%d, GBR)\n";
+            break;
+        case MOVB_READ_OFFGBR_OPCODE:
+            format = "    MOV.B @(%d, GBR), R0\n";
+            break;
+        case MOVL_WRITE_OFFGBR_OPCODE:
+            format = "    MOV.L R0, @(%d, GBR)\n";
+            break;
+        case MOVL_READ_OFFGBR_OPCODE:
+            format = "    MOV.L @(%d, GBR), R0\n";
+            break;
+        case MOVA_READ_OFFPC_OPCODE:
+            format = "    MOVA @(%d, PC), R0\n";
+            break;
+        case ORIMM_OPCODE:
+            format = "    OR #%d, R0\n";
+            break;
+        case ORBIMM_OPCODE:
+            format = "    OR.B #%d, @(R0, GBR)\n";
+            break;
+        case TSTIMM_OPCODE:
+            format = "    TST #%d, R0\n";
+            break;
+        case TSTB_OPCODE:
+            format = "    TST.B %d, @(R0, GBR)\n";
+            break;
+        case XORIMM_OPCODE:
+            format = "    XOR #%d, R0\n";
+            break;
+        case XORB_OPCODE:
+            format = "    XOR.B %d, @(R0, GBR)\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getImm8(opc));
+            return;
+        }
+        switch (opc & 0xff00) {
+        case MOVB_WRITE_OFFRN_OPCODE:
+            format = "    MOV.B R0, @(%d, R%d)\n";
+            break;
+        case MOVB_READ_OFFRM_OPCODE:
+            format = "    MOV.B @(%d, R%d), R0\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getDisp(opc), getRm(opc));
+            return;
+        }
+        switch (opc & 0xf000) {
+        case BRA_OPCODE:
+            format = "    *BRA %d\n";
+            break;
+        case BSR_OPCODE:
+            format = "    *BSR %d\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getImm12(opc));
+            return;
+        }
+        switch (opc & 0xf000) {
+        case MOVL_READ_OFFPC_OPCODE:
+            format = "    MOV.L @(%d, PC), R%d\n";
+            break;
+        case ADDIMM_OPCODE:
+            format = "    ADD #%d, R%d\n";
+            break;
+        case MOVIMM_OPCODE:
+            format = "    MOV #%d, R%d\n";
+            break;
+        case MOVW_READ_OFFPC_OPCODE:
+            format = "    MOV.W @(%d, PC), R%d\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getImm8(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xf000) {
+        case MOVL_WRITE_OFFRN_OPCODE:
+            format = "    MOV.L R%d, @(%d, R%d)\n";
+            printfStdoutInstr(format, getRm(opc), getDisp(opc), getRn(opc));
+            break;
+        case MOVL_READ_OFFRM_OPCODE:
+            format = "    MOV.L @(%d, R%d), R%d\n";
+            printfStdoutInstr(format, getDisp(opc), getRm(opc), getRn(opc));
+            break;
+        }
+    }
+
+    static void printfStdoutInstr(const char* format, ...)
+    {
+        if (getenv("JavaScriptCoreDumpJIT")) {
+            va_list args;
+            va_start(args, format);
+            vprintfStdoutInstr(format, args);
+            va_end(args);
+        }
+    }
+
+    static void vprintfStdoutInstr(const char* format, va_list args)
+    {
+        if (getenv("JavaScriptCoreDumpJIT"))
+            vfprintf(stdout, format, args);
+    }
+
+    static void printBlockInstr(uint16_t* first, unsigned int offset, int nbInstr)
+    {
+        printfStdoutInstr(">> repatch instructions after link\n");
+        for (int i = 0; i <= nbInstr; i++)
+           printInstr(*(first + i), offset + i);
+        printfStdoutInstr(">> end repatch\n");
+    }
+#else
+    static void printInstr(uint16_t opc, unsigned int size, bool isdoubleInst = true) {};
+    static void printBlockInstr(uint16_t* first, unsigned int offset, int nbInstr) {};
+#endif
+
+private:
+    SH4Buffer m_buffer;
+    int m_claimscratchReg;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(SH4)
+
+#endif // SH4Assembler_h
diff --git a/Source/JavaScriptCore/assembler/X86Assembler.h b/Source/JavaScriptCore/assembler/X86Assembler.h
index b352ad4..1fcfc93 100644
--- a/Source/JavaScriptCore/assembler/X86Assembler.h
+++ b/Source/JavaScriptCore/assembler/X86Assembler.h
@@ -131,6 +131,7 @@ private:
         OP_GROUP1_EbIb                  = 0x80,
         OP_GROUP1_EvIz                  = 0x81,
         OP_GROUP1_EvIb                  = 0x83,
+        OP_TEST_EbGb                    = 0x84,
         OP_TEST_EvGv                    = 0x85,
         OP_XCHG_EvGv                    = 0x87,
         OP_MOV_EvGv                     = 0x89,
@@ -228,6 +229,8 @@ public:
         {
         }
 
+        bool isSet() const { return (m_offset != -1); }
+
     private:
         JmpSrc(int offset)
             : m_offset(offset)
@@ -299,7 +302,7 @@ public:
     // Arithmetic operations:
 
 #if !CPU(X86_64)
-    void adcl_im(int imm, void* addr)
+    void adcl_im(int imm, const void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADC, addr);
@@ -376,7 +379,7 @@ public:
         }
     }
 #else
-    void addl_im(int imm, void* addr)
+    void addl_im(int imm, const void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADD, addr);
@@ -442,7 +445,7 @@ public:
         }
     }
 #else
-    void andl_im(int imm, void* addr)
+    void andl_im(int imm, const void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_AND, addr);
@@ -528,7 +531,7 @@ public:
         }
     }
 #else
-    void orl_im(int imm, void* addr)
+    void orl_im(int imm, const void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_OR, addr);
@@ -594,7 +597,7 @@ public:
         }
     }
 #else
-    void subl_im(int imm, void* addr)
+    void subl_im(int imm, const void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_SUB, addr);
@@ -867,12 +870,12 @@ public:
         }
     }
 #else
-    void cmpl_rm(RegisterID reg, void* addr)
+    void cmpl_rm(RegisterID reg, const void* addr)
     {
         m_formatter.oneByteOp(OP_CMP_EvGv, reg, addr);
     }
 
-    void cmpl_im(int imm, void* addr)
+    void cmpl_im(int imm, const void* addr)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, addr);
@@ -919,7 +922,12 @@ public:
         m_formatter.oneByteOp(OP_GROUP3_EvIz, GROUP3_OP_TEST, base, offset);
         m_formatter.immediate32(imm);
     }
-    
+
+    void testb_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_TEST_EbGb, src, dst);
+    }
+
     void testb_im(int imm, int offset, RegisterID base)
     {
         m_formatter.oneByteOp(OP_GROUP3_EbIb, GROUP3_OP_TEST, base, offset);
@@ -1039,7 +1047,7 @@ public:
         m_formatter.oneByteOp(OP_MOV_EvGv, src, base, index, scale, offset);
     }
     
-    void movl_mEAX(void* addr)
+    void movl_mEAX(const void* addr)
     {
         m_formatter.oneByteOp(OP_MOV_EAXOv);
 #if CPU(X86_64)
@@ -1076,7 +1084,7 @@ public:
         m_formatter.immediate32(imm);
     }
 
-    void movl_EAXm(void* addr)
+    void movl_EAXm(const void* addr)
     {
         m_formatter.oneByteOp(OP_MOV_OvEAX);
 #if CPU(X86_64)
@@ -1107,13 +1115,13 @@ public:
         m_formatter.oneByteOp64(OP_MOV_EvGv, src, base, index, scale, offset);
     }
 
-    void movq_mEAX(void* addr)
+    void movq_mEAX(const void* addr)
     {
         m_formatter.oneByteOp64(OP_MOV_EAXOv);
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
     }
 
-    void movq_EAXm(void* addr)
+    void movq_EAXm(const void* addr)
     {
         m_formatter.oneByteOp64(OP_MOV_OvEAX);
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
@@ -1153,7 +1161,7 @@ public:
     
     
 #else
-    void movl_rm(RegisterID src, void* addr)
+    void movl_rm(RegisterID src, const void* addr)
     {
         if (src == X86Registers::eax)
             movl_EAXm(addr);
@@ -1161,7 +1169,7 @@ public:
             m_formatter.oneByteOp(OP_MOV_EvGv, src, addr);
     }
     
-    void movl_mr(void* addr, RegisterID dst)
+    void movl_mr(const void* addr, RegisterID dst)
     {
         if (dst == X86Registers::eax)
             movl_mEAX(addr);
@@ -1169,7 +1177,7 @@ public:
             m_formatter.oneByteOp(OP_MOV_GvEv, dst, addr);
     }
 
-    void movl_i32m(int imm, void* addr)
+    void movl_i32m(int imm, const void* addr)
     {
         m_formatter.oneByteOp(OP_GROUP11_EvIz, GROUP11_MOV, addr);
         m_formatter.immediate32(imm);
@@ -1365,7 +1373,7 @@ public:
     }
 
 #if !CPU(X86_64)
-    void cvtsi2sd_mr(void* address, XMMRegisterID dst)
+    void cvtsi2sd_mr(const void* address, XMMRegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_F2);
         m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, address);
@@ -1398,6 +1406,12 @@ public:
     }
 #endif
 
+    void movsd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
     void movsd_rm(XMMRegisterID src, int offset, RegisterID base)
     {
         m_formatter.prefix(PRE_SSE_F2);
@@ -1536,6 +1550,7 @@ public:
         ASSERT(to.m_offset != -1);
 
         char* code = reinterpret_cast<char*>(m_formatter.data());
+        ASSERT(!reinterpret_cast<int32_t*>(code + from.m_offset)[-1]);
         setRel32(code + from.m_offset, code + to.m_offset);
     }
     
@@ -1580,16 +1595,6 @@ public:
         setPointer(where, value);
     }
 
-    static void repatchLoadPtrToLEA(void* where)
-    {
-#if CPU(X86_64)
-        // On x86-64 pointer memory accesses require a 64-bit operand, and as such a REX prefix.
-        // Skip over the prefix byte.
-        where = reinterpret_cast<char*>(where) + 1;
-#endif
-        *reinterpret_cast<unsigned char*>(where) = static_cast<unsigned char>(OP_LEA);
-    }
-    
     static unsigned getCallReturnOffset(JmpSrc call)
     {
         ASSERT(call.m_offset >= 0);
@@ -1632,6 +1637,12 @@ public:
         return copy;
     }
 
+    void rewindToLabel(JmpDst rewindTo) { m_formatter.rewindToLabel(rewindTo); }
+
+#ifndef NDEBUG
+    unsigned debugOffset() { return m_formatter.debugOffset(); }
+#endif
+
 private:
 
     static void setPointer(void* where, void* value)
@@ -1727,7 +1738,7 @@ private:
         }
 
 #if !CPU(X86_64)
-        void oneByteOp(OneByteOpcodeID opcode, int reg, void* address)
+        void oneByteOp(OneByteOpcodeID opcode, int reg, const void* address)
         {
             m_buffer.ensureSpace(maxInstructionSize);
             m_buffer.putByteUnchecked(opcode);
@@ -1931,6 +1942,12 @@ private:
         void* data() const { return m_buffer.data(); }
         void* executableCopy(ExecutablePool* allocator) { return m_buffer.executableCopy(allocator); }
 
+        void rewindToLabel(JmpDst rewindTo) { m_buffer.rewindToOffset(rewindTo.m_offset); }
+
+#ifndef NDEBUG
+        unsigned debugOffset() { return m_buffer.debugOffset(); }
+#endif
+
     private:
 
         // Internals; ModRm and REX formatters.
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 5fba8bb..0e648ba 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -364,7 +364,7 @@ void CodeBlock::dump(ExecState* exec) const
         unsigned registerIndex = m_numVars;
         size_t i = 0;
         do {
-            printf("   k%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).utf8().data());
+            printf("   k%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].get()).utf8().data());
             ++i;
             ++registerIndex;
         } while (i < m_constantRegisters.size());
@@ -731,7 +731,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_resolve_global_dynamic: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            JSValue scope = JSValue((++it)->u.jsCell);
+            JSValue scope = JSValue((++it)->u.jsCell.get());
             ++it;
             int depth = (++it)->u.operand;
             printf("[%4d] resolve_global_dynamic\t %s, %s, %s, %d\n", location, registerName(exec, r0).data(), valueToSourceString(exec, scope).utf8().data(), idName(id0, m_identifiers[id0]).data(), depth);
@@ -1360,13 +1360,13 @@ void CodeBlock::dumpStatistics()
 }
 
 CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlobalObject *globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, SymbolTable* symTab, bool isConstructor)
-    : m_globalObject(globalObject)
+    : m_globalObject(globalObject->globalData(), ownerExecutable, globalObject)
     , m_heap(&m_globalObject->globalData().heap)
     , m_numCalleeRegisters(0)
     , m_numVars(0)
     , m_numParameters(0)
     , m_isConstructor(isConstructor)
-    , m_ownerExecutable(ownerExecutable)
+    , m_ownerExecutable(globalObject->globalData(), ownerExecutable, ownerExecutable)
     , m_globalData(0)
 #ifndef NDEBUG
     , m_instructionCount(0)
@@ -1390,41 +1390,9 @@ CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlo
 
 CodeBlock::~CodeBlock()
 {
-#if ENABLE(INTERPRETER)
-    for (size_t size = m_globalResolveInstructions.size(), i = 0; i < size; ++i)
-        derefStructures(&m_instructions[m_globalResolveInstructions[i]]);
-
-    for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i)
-        derefStructures(&m_instructions[m_propertyAccessInstructions[i]]);
-#endif
 #if ENABLE(JIT)
-    for (size_t size = m_globalResolveInfos.size(), i = 0; i < size; ++i) {
-        if (m_globalResolveInfos[i].structure)
-            m_globalResolveInfos[i].structure->deref();
-    }
-
     for (size_t size = m_structureStubInfos.size(), i = 0; i < size; ++i)
         m_structureStubInfos[i].deref();
-
-    for (size_t size = m_callLinkInfos.size(), i = 0; i < size; ++i) {
-        CallLinkInfo* callLinkInfo = &m_callLinkInfos[i];
-        if (callLinkInfo->isLinked())
-            callLinkInfo->callee->removeCaller(callLinkInfo);
-    }
-
-    for (size_t size = m_methodCallLinkInfos.size(), i = 0; i < size; ++i) {
-        if (Structure* structure = m_methodCallLinkInfos[i].cachedStructure) {
-            structure->deref();
-            // Both members must be filled at the same time
-            ASSERT(!!m_methodCallLinkInfos[i].cachedPrototypeStructure);
-            m_methodCallLinkInfos[i].cachedPrototypeStructure->deref();
-        }
-    }
-
-#if ENABLE(JIT_OPTIMIZE_CALL)
-    unlinkCallers();
-#endif
-
 #endif // ENABLE(JIT)
 
 #if DUMP_CODE_BLOCK_STATISTICS
@@ -1432,50 +1400,37 @@ CodeBlock::~CodeBlock()
 #endif
 }
 
-#if ENABLE(JIT_OPTIMIZE_CALL)
-void CodeBlock::unlinkCallers()
-{
-    size_t size = m_linkedCallerList.size();
-    for (size_t i = 0; i < size; ++i) {
-        CallLinkInfo* currentCaller = m_linkedCallerList[i];
-        JIT::unlinkCallOrConstruct(currentCaller);
-        currentCaller->setUnlinked();
-    }
-    m_linkedCallerList.clear();
-}
-#endif
-
-void CodeBlock::derefStructures(Instruction* vPC) const
+void CodeBlock::markStructures(MarkStack& markStack, Instruction* vPC) const
 {
     Interpreter* interpreter = m_globalData->interpreter;
 
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
-        vPC[4].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_proto)) {
-        vPC[4].u.structure->deref();
-        vPC[5].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
+        markStack.append(&vPC[5].u.structure);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_chain)) {
-        vPC[4].u.structure->deref();
-        vPC[5].u.structureChain->deref();
+        markStack.append(&vPC[4].u.structure);
+        markStack.append(&vPC[5].u.structureChain);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition)) {
-        vPC[4].u.structure->deref();
-        vPC[5].u.structure->deref();
-        vPC[6].u.structureChain->deref();
+        markStack.append(&vPC[4].u.structure);
+        markStack.append(&vPC[5].u.structure);
+        markStack.append(&vPC[6].u.structureChain);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_replace)) {
-        vPC[4].u.structure->deref();
+        markStack.append(&vPC[4].u.structure);
         return;
     }
     if (vPC[0].u.opcode == interpreter->getOpcode(op_resolve_global) || vPC[0].u.opcode == interpreter->getOpcode(op_resolve_global_dynamic)) {
         if (vPC[3].u.structure)
-            vPC[3].u.structure->deref();
+            markStack.append(&vPC[3].u.structure);
         return;
     }
     if ((vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto_list))
@@ -1485,7 +1440,7 @@ void CodeBlock::derefStructures(Instruction* vPC) const
         || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_proto_list))
         || (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self_list))) {
         PolymorphicAccessStructureList* polymorphicStructures = vPC[4].u.polymorphicStructures;
-        polymorphicStructures->derefStructures(vPC[5].u.operand);
+        polymorphicStructures->markAggregate(markStack, vPC[5].u.operand);
         delete polymorphicStructures;
         return;
     }
@@ -1494,47 +1449,51 @@ void CodeBlock::derefStructures(Instruction* vPC) const
     ASSERT(vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_generic) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_generic) || vPC[0].u.opcode == interpreter->getOpcode(op_get_array_length) || vPC[0].u.opcode == interpreter->getOpcode(op_get_string_length));
 }
 
-void CodeBlock::refStructures(Instruction* vPC) const
+void EvalCodeCache::markAggregate(MarkStack& markStack)
 {
-    Interpreter* interpreter = m_globalData->interpreter;
-
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_self) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_self)) {
-        vPC[4].u.structure->ref();
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_proto) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_proto)) {
-        vPC[4].u.structure->ref();
-        vPC[5].u.structure->ref();
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_getter_chain) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_custom_chain)) {
-        vPC[4].u.structure->ref();
-        vPC[5].u.structureChain->ref();
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_transition)) {
-        vPC[4].u.structure->ref();
-        vPC[5].u.structure->ref();
-        vPC[6].u.structureChain->ref();
-        return;
-    }
-    if (vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_replace)) {
-        vPC[4].u.structure->ref();
-        return;
-    }
-    
-    // These instructions don't ref their Structures.
-    ASSERT(vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id) || vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_generic) || vPC[0].u.opcode == interpreter->getOpcode(op_put_by_id_generic));
+    EvalCacheMap::iterator end = m_cacheMap.end();
+    for (EvalCacheMap::iterator ptr = m_cacheMap.begin(); ptr != end; ++ptr)
+        markStack.append(&ptr->second);
 }
 
 void CodeBlock::markAggregate(MarkStack& markStack)
 {
-    for (size_t i = 0; i < m_constantRegisters.size(); ++i)
-        markStack.deprecatedAppend(&m_constantRegisters[i]);
+    markStack.append(&m_globalObject);
+    markStack.append(&m_ownerExecutable);
+    if (m_rareData)
+        m_rareData->m_evalCodeCache.markAggregate(markStack);
+    markStack.appendValues(m_constantRegisters.data(), m_constantRegisters.size());
     for (size_t i = 0; i < m_functionExprs.size(); ++i)
-        m_functionExprs[i]->markAggregate(markStack);
+        markStack.append(&m_functionExprs[i]);
     for (size_t i = 0; i < m_functionDecls.size(); ++i)
-        m_functionDecls[i]->markAggregate(markStack);
+        markStack.append(&m_functionDecls[i]);
+#if ENABLE(JIT_OPTIMIZE_CALL)
+    for (unsigned i = 0; i < numberOfCallLinkInfos(); ++i)
+        if (callLinkInfo(i).isLinked())
+            markStack.append(&callLinkInfo(i).callee);
+#endif
+#if ENABLE(INTERPRETER)
+    for (size_t size = m_propertyAccessInstructions.size(), i = 0; i < size; ++i)
+        markStructures(markStack, &m_instructions[m_propertyAccessInstructions[i]]);
+#endif
+#if ENABLE(JIT)
+    for (size_t size = m_globalResolveInfos.size(), i = 0; i < size; ++i) {
+        if (m_globalResolveInfos[i].structure)
+            markStack.append(&m_globalResolveInfos[i].structure);
+    }
+
+    for (size_t size = m_structureStubInfos.size(), i = 0; i < size; ++i)
+        m_structureStubInfos[i].markAggregate(markStack);
+
+    for (size_t size = m_methodCallLinkInfos.size(), i = 0; i < size; ++i) {
+        if (m_methodCallLinkInfos[i].cachedStructure) {
+            // Both members must be filled at the same time
+            markStack.append(&m_methodCallLinkInfos[i].cachedStructure);
+            ASSERT(!!m_methodCallLinkInfos[i].cachedPrototypeStructure);
+            markStack.append(&m_methodCallLinkInfos[i].cachedPrototypeStructure);
+        }
+    }
+#endif
 }
 
 HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
@@ -1671,7 +1630,6 @@ void CodeBlock::shrinkToFit()
     m_structureStubInfos.shrinkToFit();
     m_globalResolveInfos.shrinkToFit();
     m_callLinkInfos.shrinkToFit();
-    m_linkedCallerList.shrinkToFit();
 #endif
 
     m_identifiers.shrinkToFit();
@@ -1697,7 +1655,7 @@ void CodeBlock::createActivation(CallFrame* callFrame)
     ASSERT(!callFrame->uncheckedR(activationRegister()).jsValue());
     JSActivation* activation = new (callFrame) JSActivation(callFrame, static_cast<FunctionExecutable*>(ownerExecutable()));
     callFrame->uncheckedR(activationRegister()) = JSValue(activation);
-    callFrame->setScopeChain(callFrame->scopeChain()->copy()->push(activation));
+    callFrame->setScopeChain(callFrame->scopeChain()->push(activation));
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index f8498b4..af68eb5 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -96,21 +96,17 @@ namespace JSC {
 #if ENABLE(JIT)
     struct CallLinkInfo {
         CallLinkInfo()
-            : callee(0)
-            , position(0)
-            , hasSeenShouldRepatch(0)
+            : hasSeenShouldRepatch(false)
         {
         }
 
         CodeLocationNearCall callReturnLocation;
         CodeLocationDataLabelPtr hotPathBegin;
         CodeLocationNearCall hotPathOther;
-        CodeBlock* ownerCodeBlock;
-        CodeBlock* callee;
-        unsigned position : 31;
-        unsigned hasSeenShouldRepatch : 1;
+        WriteBarrier<JSFunction> callee;
+        bool hasSeenShouldRepatch;
         
-        void setUnlinked() { callee = 0; }
+        void setUnlinked() { callee.clear(); }
         bool isLinked() { return callee; }
 
         bool seenOnce()
@@ -126,8 +122,6 @@ namespace JSC {
 
     struct MethodCallLinkInfo {
         MethodCallLinkInfo()
-            : cachedStructure(0)
-            , cachedPrototypeStructure(0)
         {
         }
 
@@ -146,24 +140,23 @@ namespace JSC {
             //     - Once this transition has been taken once, cachedStructure is
             //       null and cachedPrototypeStructure is set to a nun-null value.
             //     - Once the call is linked both structures are set to non-null values.
-            cachedPrototypeStructure = (Structure*)1;
+            cachedPrototypeStructure.setWithoutWriteBarrier((Structure*)1);
         }
 
         CodeLocationCall callReturnLocation;
         CodeLocationDataLabelPtr structureLabel;
-        Structure* cachedStructure;
-        Structure* cachedPrototypeStructure;
+        WriteBarrier<Structure> cachedStructure;
+        WriteBarrier<Structure> cachedPrototypeStructure;
     };
 
     struct GlobalResolveInfo {
         GlobalResolveInfo(unsigned bytecodeOffset)
-            : structure(0)
-            , offset(0)
+            : offset(0)
             , bytecodeOffset(bytecodeOffset)
         {
         }
 
-        Structure* structure;
+        WriteBarrier<Structure> structure;
         unsigned offset;
         unsigned bytecodeOffset;
     };
@@ -183,7 +176,7 @@ namespace JSC {
         unsigned bytecodeOffset;
     };
 
-    // valueAtPosition helpers for the binaryChop algorithm below.
+    // valueAtPosition helpers for the binarySearch algorithm.
 
     inline void* getStructureStubInfoReturnLocation(StructureStubInfo* structureStubInfo)
     {
@@ -204,42 +197,6 @@ namespace JSC {
     {
         return pc->callReturnOffset;
     }
-
-    // Binary chop algorithm, calls valueAtPosition on pre-sorted elements in array,
-    // compares result with key (KeyTypes should be comparable with '--', '<', '>').
-    // Optimized for cases where the array contains the key, checked by assertions.
-    template<typename ArrayType, typename KeyType, KeyType(*valueAtPosition)(ArrayType*)>
-    inline ArrayType* binaryChop(ArrayType* array, size_t size, KeyType key)
-    {
-        // The array must contain at least one element (pre-condition, array does conatin key).
-        // If the array only contains one element, no need to do the comparison.
-        while (size > 1) {
-            // Pick an element to check, half way through the array, and read the value.
-            int pos = (size - 1) >> 1;
-            KeyType val = valueAtPosition(&array[pos]);
-            
-            // If the key matches, success!
-            if (val == key)
-                return &array[pos];
-            // The item we are looking for is smaller than the item being check; reduce the value of 'size',
-            // chopping off the right hand half of the array.
-            else if (key < val)
-                size = pos;
-            // Discard all values in the left hand half of the array, up to and including the item at pos.
-            else {
-                size -= (pos + 1);
-                array += (pos + 1);
-            }
-
-            // 'size' should never reach zero.
-            ASSERT(size);
-        }
-        
-        // If we reach this point we've chopped down to one element, no need to check it matches
-        ASSERT(size == 1);
-        ASSERT(key == valueAtPosition(&array[0]));
-        return &array[0];
-    }
 #endif
 
     class CodeBlock {
@@ -248,18 +205,13 @@ namespace JSC {
     protected:
         CodeBlock(ScriptExecutable* ownerExecutable, CodeType, JSGlobalObject*, PassRefPtr<SourceProvider>, unsigned sourceOffset, SymbolTable* symbolTable, bool isConstructor);
 
-        DeprecatedPtr<JSGlobalObject> m_globalObject;
+        WriteBarrier<JSGlobalObject> m_globalObject;
         Heap* m_heap;
 
     public:
         virtual ~CodeBlock();
 
         void markAggregate(MarkStack&);
-        void refStructures(Instruction* vPC) const;
-        void derefStructures(Instruction* vPC) const;
-#if ENABLE(JIT_OPTIMIZE_CALL)
-        void unlinkCallers();
-#endif
 
         static void dumpStatistics();
 
@@ -292,38 +244,20 @@ namespace JSC {
         void expressionRangeForBytecodeOffset(unsigned bytecodeOffset, int& divot, int& startOffset, int& endOffset);
 
 #if ENABLE(JIT)
-        void addCaller(CallLinkInfo* caller)
-        {
-            caller->callee = this;
-            caller->position = m_linkedCallerList.size();
-            m_linkedCallerList.append(caller);
-        }
-
-        void removeCaller(CallLinkInfo* caller)
-        {
-            unsigned pos = caller->position;
-            unsigned lastPos = m_linkedCallerList.size() - 1;
-
-            if (pos != lastPos) {
-                m_linkedCallerList[pos] = m_linkedCallerList[lastPos];
-                m_linkedCallerList[pos]->position = pos;
-            }
-            m_linkedCallerList.shrink(lastPos);
-        }
 
         StructureStubInfo& getStubInfo(ReturnAddressPtr returnAddress)
         {
-            return *(binaryChop<StructureStubInfo, void*, getStructureStubInfoReturnLocation>(m_structureStubInfos.begin(), m_structureStubInfos.size(), returnAddress.value()));
+            return *(binarySearch<StructureStubInfo, void*, getStructureStubInfoReturnLocation>(m_structureStubInfos.begin(), m_structureStubInfos.size(), returnAddress.value()));
         }
 
         CallLinkInfo& getCallLinkInfo(ReturnAddressPtr returnAddress)
         {
-            return *(binaryChop<CallLinkInfo, void*, getCallLinkInfoReturnLocation>(m_callLinkInfos.begin(), m_callLinkInfos.size(), returnAddress.value()));
+            return *(binarySearch<CallLinkInfo, void*, getCallLinkInfoReturnLocation>(m_callLinkInfos.begin(), m_callLinkInfos.size(), returnAddress.value()));
         }
 
         MethodCallLinkInfo& getMethodCallLinkInfo(ReturnAddressPtr returnAddress)
         {
-            return *(binaryChop<MethodCallLinkInfo, void*, getMethodCallLinkInfoReturnLocation>(m_methodCallLinkInfos.begin(), m_methodCallLinkInfos.size(), returnAddress.value()));
+            return *(binarySearch<MethodCallLinkInfo, void*, getMethodCallLinkInfoReturnLocation>(m_methodCallLinkInfos.begin(), m_methodCallLinkInfos.size(), returnAddress.value()));
         }
 
         unsigned bytecodeOffset(ReturnAddressPtr returnAddress)
@@ -333,7 +267,7 @@ namespace JSC {
             Vector<CallReturnOffsetToBytecodeOffset>& callIndices = m_rareData->m_callReturnIndexVector;
             if (!callIndices.size())
                 return 1;
-            return binaryChop<CallReturnOffsetToBytecodeOffset, unsigned, getCallReturnOffset>(callIndices.begin(), callIndices.size(), getJITCode().offsetOf(returnAddress.value()))->bytecodeOffset;
+            return binarySearch<CallReturnOffsetToBytecodeOffset, unsigned, getCallReturnOffset>(callIndices.begin(), callIndices.size(), getJITCode().offsetOf(returnAddress.value()))->bytecodeOffset;
         }
 #endif
 #if ENABLE(INTERPRETER)
@@ -359,7 +293,7 @@ namespace JSC {
         ExecutablePool* executablePool() { return getJITCode().getExecutablePool(); }
 #endif
 
-        ScriptExecutable* ownerExecutable() const { return m_ownerExecutable; }
+        ScriptExecutable* ownerExecutable() const { return m_ownerExecutable.get(); }
 
         void setGlobalData(JSGlobalData* globalData) { m_globalData = globalData; }
 
@@ -451,6 +385,8 @@ namespace JSC {
 
         bool hasExpressionInfo() { return m_rareData && m_rareData->m_expressionInfo.size(); }
         bool hasLineInfo() { return m_rareData && m_rareData->m_lineInfo.size(); }
+        //  We only generate exception handling info if the user is debugging
+        // (and may want line number info), or if the function contains exception handler.
         bool needsCallReturnIndices()
         {
             return m_rareData &&
@@ -472,18 +408,34 @@ namespace JSC {
         Identifier& identifier(int index) { return m_identifiers[index]; }
 
         size_t numberOfConstantRegisters() const { return m_constantRegisters.size(); }
-        void addConstantRegister(const Register& r) { return m_constantRegisters.append(r); }
-        Register& constantRegister(int index) { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
+        void addConstant(JSValue v)
+        {
+            m_constantRegisters.append(WriteBarrier<Unknown>());
+            m_constantRegisters.last().set(m_globalObject->globalData(), m_ownerExecutable.get(), v);
+        }
+        WriteBarrier<Unknown>& constantRegister(int index) { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
         ALWAYS_INLINE bool isConstantRegisterIndex(int index) const { return index >= FirstConstantRegisterIndex; }
-        ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].jsValue(); }
+        ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].get(); }
 
-        unsigned addFunctionDecl(NonNullPassRefPtr<FunctionExecutable> n) { unsigned size = m_functionDecls.size(); m_functionDecls.append(n); return size; }
+        unsigned addFunctionDecl(FunctionExecutable* n)
+        {
+            unsigned size = m_functionDecls.size();
+            m_functionDecls.append(WriteBarrier<FunctionExecutable>());
+            m_functionDecls.last().set(m_globalObject->globalData(), m_ownerExecutable.get(), n);
+            return size;
+        }
         FunctionExecutable* functionDecl(int index) { return m_functionDecls[index].get(); }
         int numberOfFunctionDecls() { return m_functionDecls.size(); }
-        unsigned addFunctionExpr(NonNullPassRefPtr<FunctionExecutable> n) { unsigned size = m_functionExprs.size(); m_functionExprs.append(n); return size; }
+        unsigned addFunctionExpr(FunctionExecutable* n)
+        {
+            unsigned size = m_functionExprs.size();
+            m_functionExprs.append(WriteBarrier<FunctionExecutable>());
+            m_functionExprs.last().set(m_globalObject->globalData(), m_ownerExecutable.get(), n);
+            return size;
+        }
         FunctionExecutable* functionExpr(int index) { return m_functionExprs[index].get(); }
 
-        unsigned addRegExp(RegExp* r) { createRareDataIfNecessary(); unsigned size = m_rareData->m_regexps.size(); m_rareData->m_regexps.append(r); return size; }
+        unsigned addRegExp(PassRefPtr<RegExp> r) { createRareDataIfNecessary(); unsigned size = m_rareData->m_regexps.size(); m_rareData->m_regexps.append(r); return size; }
         RegExp* regexp(int index) const { ASSERT(m_rareData); return m_rareData->m_regexps[index].get(); }
 
         JSGlobalObject* globalObject() { return m_globalObject.get(); }
@@ -529,6 +481,7 @@ namespace JSC {
         void printGetByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
         void printPutByIdOp(ExecState*, int location, Vector<Instruction>::const_iterator&, const char* op) const;
 #endif
+        void markStructures(MarkStack&, Instruction* vPC) const;
 
         void createRareDataIfNecessary()
         {
@@ -536,7 +489,7 @@ namespace JSC {
                 m_rareData = adoptPtr(new RareData);
         }
 
-        ScriptExecutable* m_ownerExecutable;
+        WriteBarrier<ScriptExecutable> m_ownerExecutable;
         JSGlobalData* m_globalData;
 
         Vector<Instruction> m_instructions;
@@ -567,16 +520,16 @@ namespace JSC {
         Vector<GlobalResolveInfo> m_globalResolveInfos;
         Vector<CallLinkInfo> m_callLinkInfos;
         Vector<MethodCallLinkInfo> m_methodCallLinkInfos;
-        Vector<CallLinkInfo*> m_linkedCallerList;
 #endif
 
         Vector<unsigned> m_jumpTargets;
 
         // Constant Pool
         Vector<Identifier> m_identifiers;
-        Vector<Register> m_constantRegisters;
-        Vector<RefPtr<FunctionExecutable> > m_functionDecls;
-        Vector<RefPtr<FunctionExecutable> > m_functionExprs;
+        COMPILE_ASSERT(sizeof(Register) == sizeof(WriteBarrier<Unknown>), Register_must_be_same_size_as_WriteBarrier_Unknown);
+        Vector<WriteBarrier<Unknown> > m_constantRegisters;
+        Vector<WriteBarrier<FunctionExecutable> > m_functionDecls;
+        Vector<WriteBarrier<FunctionExecutable> > m_functionExprs;
 
         SymbolTable* m_symbolTable;
 
@@ -603,7 +556,7 @@ namespace JSC {
             Vector<CallReturnOffsetToBytecodeOffset> m_callReturnIndexVector;
 #endif
         };
-#if PLATFORM(WIN)
+#if COMPILER(MSVC)
         friend void WTF::deleteOwnedPtr<RareData>(RareData*);
 #endif
         OwnPtr<RareData> m_rareData;
@@ -617,12 +570,6 @@ namespace JSC {
         GlobalCodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset)
             : CodeBlock(ownerExecutable, codeType, globalObject, sourceProvider, sourceOffset, &m_unsharedSymbolTable, false)
         {
-            m_heap->codeBlocks().add(this);
-        }
-
-        ~GlobalCodeBlock()
-        {
-            m_heap->codeBlocks().remove(this);
         }
 
     private:
@@ -680,7 +627,7 @@ namespace JSC {
     {
         CodeBlock* codeBlock = this->codeBlock();
         if (codeBlock->isConstantRegisterIndex(index))
-            return codeBlock->constantRegister(index);
+            return *reinterpret_cast<Register*>(&codeBlock->constantRegister(index));
         return this[index];
     }
 
diff --git a/Source/JavaScriptCore/bytecode/EvalCodeCache.h b/Source/JavaScriptCore/bytecode/EvalCodeCache.h
index edd575f..3e450b1 100644
--- a/Source/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/Source/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -41,14 +41,16 @@
 
 namespace JSC {
 
+    class MarkStack;
+
     class EvalCodeCache {
     public:
-        PassRefPtr<EvalExecutable> get(ExecState* exec, bool inStrictContext, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
+        EvalExecutable* get(ExecState* exec, ScriptExecutable* owner, bool inStrictContext, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
         {
-            RefPtr<EvalExecutable> evalExecutable;
+            EvalExecutable* evalExecutable = 0;
 
             if (!inStrictContext && evalSource.length() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject())
-                evalExecutable = m_cacheMap.get(evalSource.impl());
+                evalExecutable = m_cacheMap.get(evalSource.impl()).get();
 
             if (!evalExecutable) {
                 evalExecutable = EvalExecutable::create(exec, makeSource(evalSource), inStrictContext);
@@ -57,19 +59,21 @@ namespace JSC {
                     return 0;
 
                 if (!inStrictContext && evalSource.length() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject() && m_cacheMap.size() < maxCacheEntries)
-                    m_cacheMap.set(evalSource.impl(), evalExecutable);
+                    m_cacheMap.set(evalSource.impl(), WriteBarrier<EvalExecutable>(exec->globalData(), owner, evalExecutable));
             }
 
-            return evalExecutable.release();
+            return evalExecutable;
         }
 
         bool isEmpty() const { return m_cacheMap.isEmpty(); }
 
+        void markAggregate(MarkStack&);
+
     private:
         static const unsigned maxCacheableSourceLength = 256;
         static const int maxCacheEntries = 64;
 
-        typedef HashMap<RefPtr<StringImpl>, RefPtr<EvalExecutable> > EvalCacheMap;
+        typedef HashMap<RefPtr<StringImpl>, WriteBarrier<EvalExecutable> > EvalCacheMap;
         EvalCacheMap m_cacheMap;
     };
 
diff --git a/Source/JavaScriptCore/bytecode/Instruction.h b/Source/JavaScriptCore/bytecode/Instruction.h
index f077cbf..d9cbb11 100644
--- a/Source/JavaScriptCore/bytecode/Instruction.h
+++ b/Source/JavaScriptCore/bytecode/Instruction.h
@@ -33,6 +33,7 @@
 #include "Opcode.h"
 #include "PropertySlot.h"
 #include "Structure.h"
+#include "StructureChain.h"
 #include <wtf/VectorTraits.h>
 
 #define POLYMORPHIC_LIST_CACHE_SIZE 8
@@ -60,66 +61,63 @@ namespace JSC {
         struct PolymorphicStubInfo {
             bool isChain;
             PolymorphicAccessStructureListStubRoutineType stubRoutine;
-            Structure* base;
+            WriteBarrier<Structure> base;
             union {
-                Structure* proto;
-                StructureChain* chain;
+                WriteBarrierBase<Structure> proto;
+                WriteBarrierBase<StructureChain> chain;
             } u;
 
-            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base)
+            void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base)
             {
                 stubRoutine = _stubRoutine;
-                base = _base;
-                u.proto = 0;
+                base.set(globalData, owner, _base);
+                u.proto.clear();
                 isChain = false;
             }
             
-            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, Structure* _proto)
+            void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, Structure* _proto)
             {
                 stubRoutine = _stubRoutine;
-                base = _base;
-                u.proto = _proto;
+                base.set(globalData, owner, _base);
+                u.proto.set(globalData, owner, _proto);
                 isChain = false;
             }
             
-            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, StructureChain* _chain)
+            void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, StructureChain* _chain)
             {
                 stubRoutine = _stubRoutine;
-                base = _base;
-                u.chain = _chain;
+                base.set(globalData, owner, _base);
+                u.chain.set(globalData, owner, _chain);
                 isChain = true;
             }
         } list[POLYMORPHIC_LIST_CACHE_SIZE];
         
-        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase)
+        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase)
         {
-            list[0].set(stubRoutine, firstBase);
+            list[0].set(globalData, owner, stubRoutine, firstBase);
         }
 
-        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, Structure* firstProto)
+        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, Structure* firstProto)
         {
-            list[0].set(stubRoutine, firstBase, firstProto);
+            list[0].set(globalData, owner, stubRoutine, firstBase, firstProto);
         }
 
-        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, StructureChain* firstChain)
+        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, StructureChain* firstChain)
         {
-            list[0].set(stubRoutine, firstBase, firstChain);
+            list[0].set(globalData, owner, stubRoutine, firstBase, firstChain);
         }
 
-        void derefStructures(int count)
+        void markAggregate(MarkStack& markStack, int count)
         {
             for (int i = 0; i < count; ++i) {
                 PolymorphicStubInfo& info = list[i];
-
                 ASSERT(info.base);
-                info.base->deref();
-
-                if (info.u.proto) {
-                    if (info.isChain)
-                        info.u.chain->deref();
-                    else
-                        info.u.proto->deref();
-                }
+                
+                markStack.append(&info.base);
+                if (info.u.proto && !info.isChain)
+                    markStack.append(&info.u.proto);
+                if (info.u.chain && info.isChain)
+                    markStack.append(&info.u.chain);
             }
         }
     };
@@ -130,7 +128,7 @@ namespace JSC {
 #if !ENABLE(COMPUTED_GOTO_INTERPRETER)
             // We have to initialize one of the pointer members to ensure that
             // the entire struct is initialized, when opcode is not a pointer.
-            u.jsCell = 0;
+            u.jsCell.clear();
 #endif
             u.opcode = opcode;
         }
@@ -139,25 +137,41 @@ namespace JSC {
         {
             // We have to initialize one of the pointer members to ensure that
             // the entire struct is initialized in 64-bit.
-            u.jsCell = 0;
+            u.jsCell.clear();
             u.operand = operand;
         }
 
-        Instruction(Structure* structure) { u.structure = structure; }
-        Instruction(StructureChain* structureChain) { u.structureChain = structureChain; }
-        Instruction(JSCell* jsCell) { u.jsCell = jsCell; }
+        Instruction(JSGlobalData& globalData, JSCell* owner, Structure* structure)
+        {
+            u.structure.clear();
+            u.structure.set(globalData, owner, structure);
+        }
+        Instruction(JSGlobalData& globalData, JSCell* owner, StructureChain* structureChain)
+        {
+            u.structureChain.clear();
+            u.structureChain.set(globalData, owner, structureChain);
+        }
+        Instruction(JSGlobalData& globalData, JSCell* owner, JSCell* jsCell)
+        {
+            u.jsCell.clear();
+            u.jsCell.set(globalData, owner, jsCell);
+        }
         Instruction(PolymorphicAccessStructureList* polymorphicStructures) { u.polymorphicStructures = polymorphicStructures; }
         Instruction(PropertySlot::GetValueFunc getterFunc) { u.getterFunc = getterFunc; }
 
         union {
             Opcode opcode;
             int operand;
-            Structure* structure;
-            StructureChain* structureChain;
-            JSCell* jsCell;
+            WriteBarrierBase<Structure> structure;
+            WriteBarrierBase<StructureChain> structureChain;
+            WriteBarrierBase<JSCell> jsCell;
             PolymorphicAccessStructureList* polymorphicStructures;
             PropertySlot::GetValueFunc getterFunc;
         } u;
+        
+    private:
+        Instruction(StructureChain*);
+        Instruction(Structure*);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/bytecode/SamplingTool.h b/Source/JavaScriptCore/bytecode/SamplingTool.h
index 9ca54da..74b4852 100644
--- a/Source/JavaScriptCore/bytecode/SamplingTool.h
+++ b/Source/JavaScriptCore/bytecode/SamplingTool.h
@@ -29,13 +29,13 @@
 #ifndef SamplingTool_h
 #define SamplingTool_h
 
+#include "Strong.h"
+#include "Nodes.h"
+#include "Opcode.h"
 #include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
 #include <wtf/Threading.h>
 
-#include "Nodes.h"
-#include "Opcode.h"
-
 namespace JSC {
 
     class ScriptExecutable;
@@ -95,8 +95,8 @@ namespace JSC {
     struct Instruction;
 
     struct ScriptSampleRecord {
-        ScriptSampleRecord(ScriptExecutable* executable)
-            : m_executable(executable)
+        ScriptSampleRecord(JSGlobalData& globalData, ScriptExecutable* executable)
+            : m_executable(globalData, executable)
             , m_codeBlock(0)
             , m_sampleCount(0)
             , m_opcodeSampleCount(0)
@@ -113,7 +113,7 @@ namespace JSC {
         
         void sample(CodeBlock*, Instruction*);
 
-        RefPtr<ScriptExecutable> m_executable;
+        Strong<ScriptExecutable> m_executable;
         CodeBlock* m_codeBlock;
         int m_sampleCount;
         int m_opcodeSampleCount;
@@ -280,7 +280,6 @@ namespace JSC {
     // Implements a named set of counters, printed on exit if ENABLE(SAMPLING_COUNTERS).
     // See subclasses below, SamplingCounter, GlobalSamplingCounter and DeletableSamplingCounter.
     class AbstractSamplingCounter {
-        friend class JIT;
         friend class DeletableSamplingCounter;
     public:
         void count(uint32_t count = 1)
@@ -290,6 +289,8 @@ namespace JSC {
 
         static void dump();
 
+        int64_t* addressOfCounter() { return &m_counter; }
+
     protected:
         // Effectively the contructor, however called lazily in the case of GlobalSamplingCounter.
         void init(const char* name)
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp b/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
index 018d832..be5760a 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
@@ -26,42 +26,74 @@
 #include "config.h"
 #include "StructureStubInfo.h"
 
+#include "JSObject.h"
+#include "ScopeChain.h"
+
 namespace JSC {
 
 #if ENABLE(JIT)
 void StructureStubInfo::deref()
 {
     switch (accessType) {
+    case access_get_by_id_self_list: {
+        PolymorphicAccessStructureList* polymorphicStructures = u.getByIdSelfList.structureList;
+        delete polymorphicStructures;
+        return;
+    }
+    case access_get_by_id_proto_list: {
+        PolymorphicAccessStructureList* polymorphicStructures = u.getByIdProtoList.structureList;
+        delete polymorphicStructures;
+        return;
+    }
+    case access_get_by_id_self:
+    case access_get_by_id_proto:
+    case access_get_by_id_chain:
+    case access_put_by_id_transition:
+    case access_put_by_id_replace:
+    case access_get_by_id:
+    case access_put_by_id:
+    case access_get_by_id_generic:
+    case access_put_by_id_generic:
+    case access_get_array_length:
+    case access_get_string_length:
+        // These instructions don't have to release any allocated memory
+        return;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+}
+
+void StructureStubInfo::markAggregate(MarkStack& markStack)
+{
+    switch (accessType) {
     case access_get_by_id_self:
-        u.getByIdSelf.baseObjectStructure->deref();
+        markStack.append(&u.getByIdSelf.baseObjectStructure);
         return;
     case access_get_by_id_proto:
-        u.getByIdProto.baseObjectStructure->deref();
-        u.getByIdProto.prototypeStructure->deref();
+        markStack.append(&u.getByIdProto.baseObjectStructure);
+        markStack.append(&u.getByIdProto.prototypeStructure);
         return;
     case access_get_by_id_chain:
-        u.getByIdChain.baseObjectStructure->deref();
-        u.getByIdChain.chain->deref();
+        markStack.append(&u.getByIdChain.baseObjectStructure);
+        markStack.append(&u.getByIdChain.chain);
         return;
     case access_get_by_id_self_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdSelfList.structureList;
-        polymorphicStructures->derefStructures(u.getByIdSelfList.listSize);
-        delete polymorphicStructures;
+        polymorphicStructures->markAggregate(markStack, u.getByIdSelfList.listSize);
         return;
     }
     case access_get_by_id_proto_list: {
         PolymorphicAccessStructureList* polymorphicStructures = u.getByIdProtoList.structureList;
-        polymorphicStructures->derefStructures(u.getByIdProtoList.listSize);
-        delete polymorphicStructures;
+        polymorphicStructures->markAggregate(markStack, u.getByIdProtoList.listSize);
         return;
     }
     case access_put_by_id_transition:
-        u.putByIdTransition.previousStructure->deref();
-        u.putByIdTransition.structure->deref();
-        u.putByIdTransition.chain->deref();
+        markStack.append(&u.putByIdTransition.previousStructure);
+        markStack.append(&u.putByIdTransition.structure);
+        markStack.append(&u.putByIdTransition.chain);
         return;
     case access_put_by_id_replace:
-        u.putByIdReplace.baseObjectStructure->deref();
+        markStack.append(&u.putByIdReplace.baseObjectStructure);
         return;
     case access_get_by_id:
     case access_put_by_id:
@@ -69,7 +101,7 @@ void StructureStubInfo::deref()
     case access_put_by_id_generic:
     case access_get_array_length:
     case access_get_string_length:
-        // These instructions don't ref their Structures.
+        // These instructions don't need to mark anything
         return;
     default:
         ASSERT_NOT_REACHED();
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.h b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
index 8e2c489..bfeeb1e 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.h
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
@@ -58,34 +58,27 @@ namespace JSC {
         {
         }
 
-        void initGetByIdSelf(Structure* baseObjectStructure)
+        void initGetByIdSelf(JSGlobalData& globalData, JSCell* owner, Structure* baseObjectStructure)
         {
             accessType = access_get_by_id_self;
 
-            u.getByIdSelf.baseObjectStructure = baseObjectStructure;
-            baseObjectStructure->ref();
+            u.getByIdSelf.baseObjectStructure.set(globalData, owner, baseObjectStructure);
         }
 
-        void initGetByIdProto(Structure* baseObjectStructure, Structure* prototypeStructure)
+        void initGetByIdProto(JSGlobalData& globalData, JSCell* owner, Structure* baseObjectStructure, Structure* prototypeStructure)
         {
             accessType = access_get_by_id_proto;
 
-            u.getByIdProto.baseObjectStructure = baseObjectStructure;
-            baseObjectStructure->ref();
-
-            u.getByIdProto.prototypeStructure = prototypeStructure;
-            prototypeStructure->ref();
+            u.getByIdProto.baseObjectStructure.set(globalData, owner, baseObjectStructure);
+            u.getByIdProto.prototypeStructure.set(globalData, owner, prototypeStructure);
         }
 
-        void initGetByIdChain(Structure* baseObjectStructure, StructureChain* chain)
+        void initGetByIdChain(JSGlobalData& globalData, JSCell* owner, Structure* baseObjectStructure, StructureChain* chain)
         {
             accessType = access_get_by_id_chain;
 
-            u.getByIdChain.baseObjectStructure = baseObjectStructure;
-            baseObjectStructure->ref();
-
-            u.getByIdChain.chain = chain;
-            chain->ref();
+            u.getByIdChain.baseObjectStructure.set(globalData, owner, baseObjectStructure);
+            u.getByIdChain.chain.set(globalData, owner, chain);
         }
 
         void initGetByIdSelfList(PolymorphicAccessStructureList* structureList, int listSize)
@@ -106,29 +99,24 @@ namespace JSC {
 
         // PutById*
 
-        void initPutByIdTransition(Structure* previousStructure, Structure* structure, StructureChain* chain)
+        void initPutByIdTransition(JSGlobalData& globalData, JSCell* owner, Structure* previousStructure, Structure* structure, StructureChain* chain)
         {
             accessType = access_put_by_id_transition;
 
-            u.putByIdTransition.previousStructure = previousStructure;
-            previousStructure->ref();
-
-            u.putByIdTransition.structure = structure;
-            structure->ref();
-
-            u.putByIdTransition.chain = chain;
-            chain->ref();
+            u.putByIdTransition.previousStructure.set(globalData, owner, previousStructure);
+            u.putByIdTransition.structure.set(globalData, owner, structure);
+            u.putByIdTransition.chain.set(globalData, owner, chain);
         }
 
-        void initPutByIdReplace(Structure* baseObjectStructure)
+        void initPutByIdReplace(JSGlobalData& globalData, JSCell* owner, Structure* baseObjectStructure)
         {
             accessType = access_put_by_id_replace;
     
-            u.putByIdReplace.baseObjectStructure = baseObjectStructure;
-            baseObjectStructure->ref();
+            u.putByIdReplace.baseObjectStructure.set(globalData, owner, baseObjectStructure);
         }
 
         void deref();
+        void markAggregate(MarkStack&);
 
         bool seenOnce()
         {
@@ -145,15 +133,15 @@ namespace JSC {
 
         union {
             struct {
-                Structure* baseObjectStructure;
+                WriteBarrierBase<Structure> baseObjectStructure;
             } getByIdSelf;
             struct {
-                Structure* baseObjectStructure;
-                Structure* prototypeStructure;
+                WriteBarrierBase<Structure> baseObjectStructure;
+                WriteBarrierBase<Structure> prototypeStructure;
             } getByIdProto;
             struct {
-                Structure* baseObjectStructure;
-                StructureChain* chain;
+                WriteBarrierBase<Structure> baseObjectStructure;
+                WriteBarrierBase<StructureChain> chain;
             } getByIdChain;
             struct {
                 PolymorphicAccessStructureList* structureList;
@@ -164,12 +152,12 @@ namespace JSC {
                 int listSize;
             } getByIdProtoList;
             struct {
-                Structure* previousStructure;
-                Structure* structure;
-                StructureChain* chain;
+                WriteBarrierBase<Structure> previousStructure;
+                WriteBarrierBase<Structure> structure;
+                WriteBarrierBase<StructureChain> chain;
             } putByIdTransition;
             struct {
-                Structure* baseObjectStructure;
+                WriteBarrierBase<Structure> baseObjectStructure;
             } putByIdReplace;
         } u;
 
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 0964344..83e4592 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -31,9 +31,9 @@
 #include "BytecodeGenerator.h"
 
 #include "BatchedTransitionOptimizer.h"
-#include "PrototypeFunction.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
+#include "ScopeChain.h"
 #include "UString.h"
 
 using namespace std;
@@ -147,7 +147,7 @@ JSObject* BytecodeGenerator::generate()
     m_codeBlock->setInstructionCount(m_codeBlock->instructions().size());
 
     if (s_dumpsGeneratedCode)
-        m_codeBlock->dump(m_scopeChain->globalObject()->globalExec());
+        m_codeBlock->dump(m_scopeChain->globalObject->globalExec());
 #endif
 
     if ((m_codeType == FunctionCode && !m_codeBlock->needsFullScopeChain() && !m_codeBlock->usesArguments()) || m_codeType == EvalCode)
@@ -156,7 +156,7 @@ JSObject* BytecodeGenerator::generate()
     m_codeBlock->shrinkToFit();
 
     if (m_expressionTooDeep)
-        return createOutOfMemoryError(m_scopeChain->globalObject());
+        return createOutOfMemoryError(m_scopeChain->globalObject.get());
     return 0;
 }
 
@@ -198,11 +198,11 @@ void BytecodeGenerator::preserveLastVar()
         m_lastVar = &m_calleeRegisters.last();
 }
 
-BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const ScopeChain& scopeChain, SymbolTable* symbolTable, ProgramCodeBlock* codeBlock)
-    : m_shouldEmitDebugHooks(scopeChain.globalObject()->debugger())
-    , m_shouldEmitProfileHooks(scopeChain.globalObject()->supportsProfiling())
-    , m_shouldEmitRichSourceInfo(scopeChain.globalObject()->supportsRichSourceInfo())
-    , m_scopeChain(&scopeChain)
+BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, ScopeChainNode* scopeChain, SymbolTable* symbolTable, ProgramCodeBlock* codeBlock)
+    : m_shouldEmitDebugHooks(scopeChain->globalObject->debugger())
+    , m_shouldEmitProfileHooks(scopeChain->globalObject->supportsProfiling())
+    , m_shouldEmitRichSourceInfo(scopeChain->globalObject->supportsRichSourceInfo())
+    , m_scopeChain(*scopeChain->globalData, scopeChain)
     , m_symbolTable(symbolTable)
     , m_scopeNode(programNode)
     , m_codeBlock(codeBlock)
@@ -217,15 +217,13 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const ScopeChain&
     , m_hasCreatedActivation(true)
     , m_firstLazyFunction(0)
     , m_lastLazyFunction(0)
-    , m_globalData(&scopeChain.globalObject()->globalData())
+    , m_globalData(scopeChain->globalData)
     , m_lastOpcodeID(op_end)
 #ifndef NDEBUG
     , m_lastOpcodePosition(0)
 #endif
     , m_stack(m_globalData->stack())
     , m_usesExceptions(false)
-    , m_regeneratingForExceptionInfo(false)
-    , m_codeBlockBeingRegeneratedFrom(0)
     , m_expressionTooDeep(false)
 {
     if (m_shouldEmitDebugHooks)
@@ -238,7 +236,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const ScopeChain&
     
     m_codeBlock->m_numParameters = 1; // Allocate space for "this"
 
-    JSGlobalObject* globalObject = scopeChain.globalObject();
+    JSGlobalObject* globalObject = scopeChain->globalObject.get();
     ExecState* exec = globalObject->globalExec();
     RegisterFile* registerFile = &exec->globalData().interpreter->registerFile();
     
@@ -250,7 +248,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const ScopeChain&
     SymbolTable::iterator end = symbolTable->end();
     for (SymbolTable::iterator it = symbolTable->begin(); it != end; ++it)
         registerFor(it->second.getIndex()).setIndex(it->second.getIndex() + m_globalVarStorageOffset);
-        
+
     BatchedTransitionOptimizer optimizer(*m_globalData, globalObject);
 
     const VarStack& varStack = programNode->varStack();
@@ -260,28 +258,56 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const ScopeChain&
         // Shift new symbols so they get stored prior to existing symbols.
         m_nextGlobalIndex -= symbolTable->size();
 
+        HashSet<StringImpl*, IdentifierRepHash> newGlobals;
+        Vector<std::pair<int, bool>, 16> functionInfo(functionStack.size());
         for (size_t i = 0; i < functionStack.size(); ++i) {
             FunctionBodyNode* function = functionStack[i];
-            globalObject->removeDirect(function->ident()); // Make sure our new function is not shadowed by an old property.
-            emitNewFunction(addGlobalVar(function->ident(), false), function);
+            globalObject->removeDirect(*m_globalData, function->ident()); // Make sure our new function is not shadowed by an old property.
+            SymbolTableEntry entry = symbolTable->inlineGet(function->ident().impl());
+            
+            if (entry.isNull())
+                newGlobals.add(function->ident().impl());
+            functionInfo[i] = make_pair(entry.getIndex(), entry.isReadOnly());
+        }
+        
+        Vector<bool, 16> shouldCreateVar(varStack.size());
+        for (size_t i = 0; i < varStack.size(); ++i) {
+            if (newGlobals.contains(varStack[i].first->impl()) || globalObject->hasProperty(exec, *varStack[i].first)) {
+                shouldCreateVar[i] = false;
+                continue;
+            }
+            shouldCreateVar[i] = true;
+            newGlobals.add(varStack[i].first->impl());
         }
 
-        Vector<RegisterID*, 32> newVars;
-        for (size_t i = 0; i < varStack.size(); ++i)
-            if (!globalObject->hasProperty(exec, *varStack[i].first))
-                newVars.append(addGlobalVar(*varStack[i].first, varStack[i].second & DeclarationStacks::IsConstant));
+        int expectedSize = symbolTable->size() + newGlobals.size();
+        globalObject->resizeRegisters(symbolTable->size(), expectedSize);
+    
+        for (size_t i = 0; i < functionStack.size(); ++i) {
+            FunctionBodyNode* function = functionStack[i];
+            if (functionInfo[i].second)
+                continue;
+            RegisterID* dst = addGlobalVar(function->ident(), false);
+            JSValue value = new (exec) JSFunction(exec, makeFunction(exec, function), scopeChain);
+            globalObject->registerAt(dst->index() - m_globalVarStorageOffset).set(*m_globalData, globalObject, value);
+        }
 
-        preserveLastVar();
+        for (size_t i = 0; i < varStack.size(); ++i) {
+            if (!shouldCreateVar[i])
+                continue;
+            addGlobalVar(*varStack[i].first, varStack[i].second & DeclarationStacks::IsConstant);
+        }
+        if (symbolTable->size() != expectedSize)
+            CRASH();
 
-        for (size_t i = 0; i < newVars.size(); ++i)
-            emitLoad(newVars[i], jsUndefined());
+        preserveLastVar();
     } else {
         for (size_t i = 0; i < functionStack.size(); ++i) {
             FunctionBodyNode* function = functionStack[i];
-            globalObject->putWithAttributes(exec, function->ident(), new (exec) JSFunction(exec, makeFunction(exec, function), scopeChain.node()), DontDelete);
+            globalObject->putWithAttributes(exec, function->ident(), new (exec) JSFunction(exec, makeFunction(exec, function), scopeChain), DontDelete);
         }
         for (size_t i = 0; i < varStack.size(); ++i) {
-            if (globalObject->hasProperty(exec, *varStack[i].first))
+            if (globalObject->symbolTableHasProperty(*varStack[i].first) || globalObject->hasProperty(exec, *varStack[i].first))
                 continue;
             int attributes = DontDelete;
             if (varStack[i].second & DeclarationStacks::IsConstant)
@@ -294,11 +320,11 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const ScopeChain&
     codeBlock->m_numCapturedVars = codeBlock->m_numVars;
 }
 
-BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const ScopeChain& scopeChain, SymbolTable* symbolTable, CodeBlock* codeBlock)
-    : m_shouldEmitDebugHooks(scopeChain.globalObject()->debugger())
-    , m_shouldEmitProfileHooks(scopeChain.globalObject()->supportsProfiling())
-    , m_shouldEmitRichSourceInfo(scopeChain.globalObject()->supportsRichSourceInfo())
-    , m_scopeChain(&scopeChain)
+BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainNode* scopeChain, SymbolTable* symbolTable, CodeBlock* codeBlock)
+    : m_shouldEmitDebugHooks(scopeChain->globalObject->debugger())
+    , m_shouldEmitProfileHooks(scopeChain->globalObject->supportsProfiling())
+    , m_shouldEmitRichSourceInfo(scopeChain->globalObject->supportsRichSourceInfo())
+    , m_scopeChain(*scopeChain->globalData, scopeChain)
     , m_symbolTable(symbolTable)
     , m_scopeNode(functionBody)
     , m_codeBlock(codeBlock)
@@ -312,15 +338,13 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Scope
     , m_hasCreatedActivation(false)
     , m_firstLazyFunction(0)
     , m_lastLazyFunction(0)
-    , m_globalData(&scopeChain.globalObject()->globalData())
+    , m_globalData(scopeChain->globalData)
     , m_lastOpcodeID(op_end)
 #ifndef NDEBUG
     , m_lastOpcodePosition(0)
 #endif
     , m_stack(m_globalData->stack())
     , m_usesExceptions(false)
-    , m_regeneratingForExceptionInfo(false)
-    , m_codeBlockBeingRegeneratedFrom(0)
     , m_expressionTooDeep(false)
 {
     if (m_shouldEmitDebugHooks)
@@ -460,11 +484,11 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Scope
     }
 }
 
-BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, const ScopeChain& scopeChain, SymbolTable* symbolTable, EvalCodeBlock* codeBlock)
-    : m_shouldEmitDebugHooks(scopeChain.globalObject()->debugger())
-    , m_shouldEmitProfileHooks(scopeChain.globalObject()->supportsProfiling())
-    , m_shouldEmitRichSourceInfo(scopeChain.globalObject()->supportsRichSourceInfo())
-    , m_scopeChain(&scopeChain)
+BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, ScopeChainNode* scopeChain, SymbolTable* symbolTable, EvalCodeBlock* codeBlock)
+    : m_shouldEmitDebugHooks(scopeChain->globalObject->debugger())
+    , m_shouldEmitProfileHooks(scopeChain->globalObject->supportsProfiling())
+    , m_shouldEmitRichSourceInfo(scopeChain->globalObject->supportsRichSourceInfo())
+    , m_scopeChain(*scopeChain->globalData, scopeChain)
     , m_symbolTable(symbolTable)
     , m_scopeNode(evalNode)
     , m_codeBlock(codeBlock)
@@ -478,15 +502,13 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, const ScopeChain& scope
     , m_hasCreatedActivation(true)
     , m_firstLazyFunction(0)
     , m_lastLazyFunction(0)
-    , m_globalData(&scopeChain.globalObject()->globalData())
+    , m_globalData(scopeChain->globalData)
     , m_lastOpcodeID(op_end)
 #ifndef NDEBUG
     , m_lastOpcodePosition(0)
 #endif
     , m_stack(m_globalData->stack())
     , m_usesExceptions(false)
-    , m_regeneratingForExceptionInfo(false)
-    , m_codeBlockBeingRegeneratedFrom(0)
     , m_expressionTooDeep(false)
 {
     if (m_shouldEmitDebugHooks || m_baseScopeDepth)
@@ -903,7 +925,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionCall(RegisterID* cond,
 
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
-    instructions().append(m_scopeChain->globalObject()->d()->callFunction.get());
+    instructions().append(Instruction(*m_globalData, m_codeBlock->ownerExecutable(), m_scopeChain->globalObject->callFunction()));
     instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
@@ -914,7 +936,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond
 
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
-    instructions().append(m_scopeChain->globalObject()->d()->applyFunction.get());
+    instructions().append(Instruction(*m_globalData, m_codeBlock->ownerExecutable(), m_scopeChain->globalObject->applyFunction()));
     instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
@@ -937,14 +959,14 @@ RegisterID* BytecodeGenerator::addConstantValue(JSValue v)
     if (result.second) {
         m_constantPoolRegisters.append(FirstConstantRegisterIndex + m_nextConstantOffset);
         ++m_nextConstantOffset;
-        m_codeBlock->addConstantRegister(JSValue(v));
+        m_codeBlock->addConstant(JSValue(v));
     } else
         index = result.first->second;
 
     return &m_constantPoolRegisters[index];
 }
 
-unsigned BytecodeGenerator::addRegExp(RegExp* r)
+unsigned BytecodeGenerator::addRegExp(PassRefPtr<RegExp> r)
 {
     return m_codeBlock->addRegExp(r);
 }
@@ -1020,8 +1042,8 @@ RegisterID* BytecodeGenerator::emitEqualityOp(OpcodeID opcodeID, RegisterID* dst
         if (src1->index() == dstIndex
             && src1->isTemporary()
             && m_codeBlock->isConstantRegisterIndex(src2->index())
-            && m_codeBlock->constantRegister(src2->index()).jsValue().isString()) {
-            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).jsValue())->tryGetValue();
+            && m_codeBlock->constantRegister(src2->index()).get().isString()) {
+            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).get())->tryGetValue();
             if (value == "undefined") {
                 rewindUnaryOp();
                 emitOpcode(op_is_undefined);
@@ -1081,7 +1103,7 @@ RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, bool b)
 
 RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, double number)
 {
-    // FIXME: Our hash tables won't hold infinity, so we make a new JSNumberCell each time.
+    // FIXME: Our hash tables won't hold infinity, so we make a new JSValue each time.
     // Later we can do the extra work to handle that like the other cases.  They also don't
     // work correctly with NaN as a key.
     if (isnan(number) || number == HashTraits<double>::emptyValue() || HashTraits<double>::isDeletedValue(number))
@@ -1195,13 +1217,6 @@ RegisterID* BytecodeGenerator::emitResolve(RegisterID* dst, const Identifier& pr
 
     if (globalObject) {
         bool forceGlobalResolve = false;
-        if (m_regeneratingForExceptionInfo) {
-#if ENABLE(JIT)
-            forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInfoAtBytecodeOffset(instructions().size());
-#else
-            forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInstructionAtBytecodeOffset(instructions().size());
-#endif
-        }
 
         if (index != missingSymbolMarker() && !forceGlobalResolve && !requiresDynamicChecks) {
             // Directly index the property lookup across multiple scopes.
@@ -1338,13 +1353,6 @@ RegisterID* BytecodeGenerator::emitResolveWithBase(RegisterID* baseDst, Register
     }
 
     bool forceGlobalResolve = false;
-    if (m_regeneratingForExceptionInfo) {
-#if ENABLE(JIT)
-        forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInfoAtBytecodeOffset(instructions().size());
-#else
-        forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInstructionAtBytecodeOffset(instructions().size());
-#endif
-    }
 
     // Global object is the base
     emitLoad(baseDst, JSValue(globalObject));
@@ -1578,7 +1586,7 @@ RegisterID* BytecodeGenerator::emitNewFunctionInternal(RegisterID* dst, unsigned
     return dst;
 }
 
-RegisterID* BytecodeGenerator::emitNewRegExp(RegisterID* dst, RegExp* regExp)
+RegisterID* BytecodeGenerator::emitNewRegExp(RegisterID* dst, PassRefPtr<RegExp> regExp)
 {
     emitOpcode(op_new_regexp);
     instructions().append(dst->index());
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index de16f8e..05a955b 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -47,8 +47,7 @@
 namespace JSC {
 
     class Identifier;
-    class ScopeChain;
-    class ScopeNode;
+    class ScopeChainNode;
 
     class CallArguments {
     public:
@@ -93,9 +92,9 @@ namespace JSC {
         static void setDumpsGeneratedCode(bool dumpsGeneratedCode);
         static bool dumpsGeneratedCode();
 
-        BytecodeGenerator(ProgramNode*, const ScopeChain&, SymbolTable*, ProgramCodeBlock*);
-        BytecodeGenerator(FunctionBodyNode*, const ScopeChain&, SymbolTable*, CodeBlock*);
-        BytecodeGenerator(EvalNode*, const ScopeChain&, SymbolTable*, EvalCodeBlock*);
+        BytecodeGenerator(ProgramNode*, ScopeChainNode*, SymbolTable*, ProgramCodeBlock*);
+        BytecodeGenerator(FunctionBodyNode*, ScopeChainNode*, SymbolTable*, CodeBlock*);
+        BytecodeGenerator(EvalNode*, ScopeChainNode*, SymbolTable*, EvalCodeBlock*);
 
         JSGlobalData* globalData() const { return m_globalData; }
         const CommonIdentifiers& propertyNames() const { return *m_globalData->propertyNames; }
@@ -292,7 +291,7 @@ namespace JSC {
         RegisterID* emitLazyNewFunction(RegisterID* dst, FunctionBodyNode* body);
         RegisterID* emitNewFunctionInternal(RegisterID* dst, unsigned index, bool shouldNullCheck);
         RegisterID* emitNewFunctionExpression(RegisterID* dst, FuncExprNode* func);
-        RegisterID* emitNewRegExp(RegisterID* dst, RegExp* regExp);
+        RegisterID* emitNewRegExp(RegisterID* dst, PassRefPtr<RegExp> regExp);
 
         RegisterID* emitMove(RegisterID* dst, RegisterID* src);
 
@@ -397,12 +396,6 @@ namespace JSC {
 
         CodeType codeType() const { return m_codeType; }
 
-        void setRegeneratingForExceptionInfo(CodeBlock* originalCodeBlock)
-        {
-            m_regeneratingForExceptionInfo = true;
-            m_codeBlockBeingRegeneratedFrom = originalCodeBlock;
-        }
-
         bool shouldEmitProfileHooks() { return m_shouldEmitProfileHooks; }
         
         bool isStrictMode() const { return m_codeBlock->isStrictMode(); }
@@ -482,14 +475,14 @@ namespace JSC {
 
         unsigned addConstant(const Identifier&);
         RegisterID* addConstantValue(JSValue);
-        unsigned addRegExp(RegExp*);
+        unsigned addRegExp(PassRefPtr<RegExp>);
 
-        PassRefPtr<FunctionExecutable> makeFunction(ExecState* exec, FunctionBodyNode* body)
+        FunctionExecutable* makeFunction(ExecState* exec, FunctionBodyNode* body)
         {
             return FunctionExecutable::create(exec, body->ident(), body->source(), body->usesArguments(), body->parameters(), body->isStrictMode(), body->lineNo(), body->lastLine());
         }
 
-        PassRefPtr<FunctionExecutable> makeFunction(JSGlobalData* globalData, FunctionBodyNode* body)
+        FunctionExecutable* makeFunction(JSGlobalData* globalData, FunctionBodyNode* body)
         {
             return FunctionExecutable::create(globalData, body->ident(), body->source(), body->usesArguments(), body->parameters(), body->isStrictMode(), body->lineNo(), body->lastLine());
         }
@@ -520,7 +513,7 @@ namespace JSC {
         bool m_shouldEmitProfileHooks;
         bool m_shouldEmitRichSourceInfo;
 
-        const ScopeChain* m_scopeChain;
+        Strong<ScopeChainNode> m_scopeChain;
         SymbolTable* m_symbolTable;
 
         ScopeNode* m_scopeNode;
@@ -578,8 +571,6 @@ namespace JSC {
         StackBounds m_stack;
 
         bool m_usesExceptions;
-        bool m_regeneratingForExceptionInfo;
-        CodeBlock* m_codeBlockBeingRegeneratedFrom;
         bool m_expressionTooDeep;
     };
 
diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index 2875434..03578cf 100644
--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -125,9 +125,8 @@ RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 {
     if (dst == generator.ignoredResult())
         return 0;
-    RefPtr<RegExp> regExp = generator.globalData()->regExpCache()->lookupOrCreate(m_pattern.ustring(), m_flags.ustring());
-    ASSERT(regExp->isValid());
-    return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
+    return generator.emitNewRegExp(generator.finalDestination(dst),
+        generator.globalData()->regExpCache()->lookupOrCreate(m_pattern.ustring(), regExpFlags(m_flags.ustring())));
 }
 
 // ------------------------------ ThisNode -------------------------------------
diff --git a/Source/JavaScriptCore/config.h b/Source/JavaScriptCore/config.h
index 1c14917..394bba5 100644
--- a/Source/JavaScriptCore/config.h
+++ b/Source/JavaScriptCore/config.h
@@ -29,6 +29,24 @@
 
 #include <wtf/Platform.h>
 
+/* See note in wtf/Platform.h for more info on EXPORT_MACROS. */
+#if USE(EXPORT_MACROS)
+
+#include <wtf/ExportMacros.h>
+
+#if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+#define WTF_EXPORT_PRIVATE WTF_EXPORT
+#define JS_EXPORT_PRIVATE WTF_EXPORT
+#else
+#define WTF_EXPORT_PRIVATE WTF_IMPORT
+#define JS_EXPORT_PRIVATE WTF_IMPORT
+#endif
+
+#define JS_EXPORTDATA JS_EXPORT_PRIVATE
+#define JS_EXPORTCLASS JS_EXPORT_PRIVATE
+
+#else /* !USE(EXPORT_MACROS) */
+
 #if !PLATFORM(CHROMIUM) && OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
 #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
 #define JS_EXPORTDATA __declspec(dllexport)
@@ -41,6 +59,11 @@
 #define JS_EXPORTCLASS
 #endif
 
+#define WTF_EXPORT_PRIVATE
+#define JS_EXPORT_PRIVATE
+
+#endif /* USE(EXPORT_MACROS) */
+
 #if OS(WINDOWS)
 
 // If we don't define these, they get defined in windef.h. 
diff --git a/Source/JavaScriptCore/create_regex_tables b/Source/JavaScriptCore/create_regex_tables
index c6ce995..bd799ba 100644
--- a/Source/JavaScriptCore/create_regex_tables
+++ b/Source/JavaScriptCore/create_regex_tables
@@ -35,6 +35,7 @@ types = {
 entriesPerLine = 50
 arrays = "";
 functions = "";
+emitTables = (len(sys.argv) < 2 or sys.argv[1] != "--no-tables")
 
 for name, classes in types.items():
     ranges = [];
@@ -56,7 +57,7 @@ for name, classes in types.items():
             ranges.append((min,max))
     ranges.sort();
     
-    if classes["UseTable"] and (not "Inverse" in classes):
+    if emitTables and classes["UseTable"] and (not "Inverse" in classes):
         array = ("static const char _%sData[65536] = {\n" % name);
         i = 0
         for (min,max) in ranges:
@@ -87,7 +88,7 @@ for name, classes in types.items():
     function = "";
     function += ("CharacterClass* %sCreate()\n" % name)
     function += ("{\n")
-    if classes["UseTable"]:
+    if emitTables and classes["UseTable"]:
         if "Inverse" in classes:
             function += ("    CharacterClass* characterClass = new CharacterClass(CharacterClassTable::create(_%sData, true));\n" % (classes["Inverse"]))
         else:
diff --git a/Source/JavaScriptCore/debugger/Debugger.cpp b/Source/JavaScriptCore/debugger/Debugger.cpp
index 20a8485..64f6002 100644
--- a/Source/JavaScriptCore/debugger/Debugger.cpp
+++ b/Source/JavaScriptCore/debugger/Debugger.cpp
@@ -29,7 +29,9 @@
 #include "Parser.h"
 #include "Protect.h"
 
-namespace JSC {
+namespace {
+
+using namespace JSC;
 
 class Recompiler {
 public:
@@ -62,7 +64,7 @@ inline Recompiler::~Recompiler()
 
 inline void Recompiler::operator()(JSCell* cell)
 {
-    if (!cell->inherits(&JSFunction::info))
+    if (!cell->inherits(&JSFunction::s_info))
         return;
 
     JSFunction* function = asFunction(cell);
@@ -76,12 +78,16 @@ inline void Recompiler::operator()(JSCell* cell)
     if (!m_functionExecutables.add(executable).second)
         return;
 
-    ExecState* exec = function->scope().globalObject()->JSGlobalObject::globalExec();
+    ExecState* exec = function->scope()->globalObject->JSGlobalObject::globalExec();
     executable->discardCode();
-    if (m_debugger == function->scope().globalObject()->debugger())
+    if (m_debugger == function->scope()->globalObject->debugger())
         m_sourceProviders.add(executable->source().provider(), exec);
 }
 
+} // namespace
+
+namespace JSC {
+
 Debugger::~Debugger()
 {
     HashSet<JSGlobalObject*>::iterator end = m_globalObjects.end();
@@ -118,16 +124,18 @@ void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
 JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
 {
     CallFrame* globalCallFrame = globalObject->globalExec();
+    JSGlobalData& globalData = globalObject->globalData();
 
-    RefPtr<EvalExecutable> eval = EvalExecutable::create(globalCallFrame, makeSource(script), false);
-    JSObject* error = eval->compile(globalCallFrame, globalCallFrame->scopeChain());
-    if (error)
-        return error;
+    EvalExecutable* eval = EvalExecutable::create(globalCallFrame, makeSource(script), false);
+    if (!eval) {
+        exception = globalData.exception;
+        globalData.exception = JSValue();
+        return exception;
+    }
 
-    JSGlobalData& globalData = globalObject->globalData();
-    JSValue result = globalData.interpreter->execute(eval.get(), globalCallFrame, globalObject, globalCallFrame->scopeChain());
+    JSValue result = globalData.interpreter->execute(eval, globalCallFrame, globalObject, globalCallFrame->scopeChain());
     if (globalData.exception) {
-        exception = globalData.exception.get();
+        exception = globalData.exception;
         globalData.exception = JSValue();
     }
     ASSERT(result);
diff --git a/Source/JavaScriptCore/debugger/DebuggerActivation.cpp b/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
index fcd257c..67a796a 100644
--- a/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -31,7 +31,7 @@
 namespace JSC {
 
 DebuggerActivation::DebuggerActivation(JSGlobalData& globalData, JSObject* activation)
-    : JSObject(DebuggerActivation::createStructure(jsNull()))
+    : JSNonFinalObject(globalData, DebuggerActivation::createStructure(globalData, jsNull()))
 {
     ASSERT(activation);
     ASSERT(activation->isActivationObject());
diff --git a/Source/JavaScriptCore/debugger/DebuggerActivation.h b/Source/JavaScriptCore/debugger/DebuggerActivation.h
index b64060d..bfb36db 100644
--- a/Source/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/Source/JavaScriptCore/debugger/DebuggerActivation.h
@@ -32,7 +32,7 @@ namespace JSC {
 
     class JSActivation;
 
-    class DebuggerActivation : public JSObject {
+    class DebuggerActivation : public JSNonFinalObject {
     public:
         DebuggerActivation(JSGlobalData&, JSObject*);
 
@@ -49,9 +49,9 @@ namespace JSC {
         virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
         virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype) 
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
     protected:
diff --git a/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index cb4592c..08fba4a 100644
--- a/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -45,7 +45,7 @@ const UString* DebuggerCallFrame::functionName() const
         return 0;
 
     JSObject* function = m_callFrame->callee();
-    if (!function || !function->inherits(&JSFunction::info))
+    if (!function || !function->inherits(&JSFunction::s_info))
         return 0;
     return &asFunction(function)->name(m_callFrame);
 }
@@ -56,7 +56,7 @@ UString DebuggerCallFrame::calculatedFunctionName() const
         return UString();
 
     JSObject* function = m_callFrame->callee();
-    if (!function || !function->inherits(&JSFunction::info))
+    if (!function || !function->inherits(&JSFunction::s_info))
         return UString();
 
     return asFunction(function)->calculatedDisplayName(m_callFrame);
@@ -87,16 +87,17 @@ JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) c
 {
     if (!m_callFrame->codeBlock())
         return JSValue();
-
-    RefPtr<EvalExecutable> eval = EvalExecutable::create(m_callFrame, makeSource(script), m_callFrame->codeBlock()->isStrictMode());
-    JSObject* error = eval->compile(m_callFrame, m_callFrame->scopeChain());
-    if (error)
-        return error;
-
+    
     JSGlobalData& globalData = m_callFrame->globalData();
-    JSValue result = globalData.interpreter->execute(eval.get(), m_callFrame, thisObject(), m_callFrame->scopeChain());
+    EvalExecutable* eval = EvalExecutable::create(m_callFrame, makeSource(script), m_callFrame->codeBlock()->isStrictMode());
+    if (globalData.exception) {
+        exception = globalData.exception;
+        globalData.exception = JSValue();
+    }
+
+    JSValue result = globalData.interpreter->execute(eval, m_callFrame, thisObject(), m_callFrame->scopeChain());
     if (globalData.exception) {
-        exception = globalData.exception.get();
+        exception = globalData.exception;
         globalData.exception = JSValue();
     }
     ASSERT(result);
diff --git a/Source/JavaScriptCore/debugger/DebuggerCallFrame.h b/Source/JavaScriptCore/debugger/DebuggerCallFrame.h
index 9d377ef..f6b415c 100644
--- a/Source/JavaScriptCore/debugger/DebuggerCallFrame.h
+++ b/Source/JavaScriptCore/debugger/DebuggerCallFrame.h
@@ -49,7 +49,7 @@ namespace JSC {
         }
 
         JSGlobalObject* dynamicGlobalObject() const { return m_callFrame->dynamicGlobalObject(); }
-        const ScopeChainNode* scopeChain() const { return m_callFrame->scopeChain(); }
+        ScopeChainNode* scopeChain() const { return m_callFrame->scopeChain(); }
         const UString* functionName() const;
         UString calculatedFunctionName() const;
         Type type() const;
diff --git a/Source/JavaScriptCore/dfg/DFGAliasTracker.h b/Source/JavaScriptCore/dfg/DFGAliasTracker.h
new file mode 100644
index 0000000..8710169
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGAliasTracker.h
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGAliasTracker_h
+#define DFGAliasTracker_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGGraph.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+// === AliasTracker ===
+//
+// This class id used to detect aliasing property accesses, which we may
+// be able to speculatively optimize (for example removing redundant loads
+// where we know a getter will not be called, or optimizing puts to arrays
+// where we know the value being written to in within length and is not a
+// hole value). In time, this should be more than a 1-deep buffer!
+class AliasTracker {
+public:
+    AliasTracker(Graph& graph)
+        : m_graph(graph)
+        , m_candidateAliasGetByVal(NoNode)
+    {
+    }
+
+    NodeIndex lookupGetByVal(NodeIndex base, NodeIndex property)
+    {
+        // Try to detect situations where a GetByVal follows another GetByVal to the same
+        // property; in these cases, we may be able to omit the subsequent get on the
+        // speculative path, where we know conditions hold to make this safe (for example,
+        // on the speculative path we will not have allowed getter access).
+        if (m_candidateAliasGetByVal != NoNode) {
+            Node& possibleAlias = m_graph[m_candidateAliasGetByVal];
+            ASSERT(possibleAlias.op == GetByVal);
+            // This check ensures the accesses alias, provided that the subscript is an
+            // integer index (this is good enough; the speculative path will only generate
+            // optimized accesses to handle integer subscripts).
+            if (possibleAlias.child1 == base && equalIgnoringLaterNumericConversion(possibleAlias.child2, property))
+                return m_candidateAliasGetByVal;
+        }
+        return NoNode;
+    }
+
+    void recordGetByVal(NodeIndex getByVal)
+    {
+        m_candidateAliasGetByVal = getByVal;
+    }
+
+    void recordPutByVal(NodeIndex putByVal)
+    {
+        ASSERT_UNUSED(putByVal, m_graph[putByVal].op == PutByVal || m_graph[putByVal].op == PutByValAlias);
+        m_candidateAliasGetByVal = NoNode;
+    }
+
+    void recordGetById(NodeIndex getById)
+    {
+        ASSERT_UNUSED(getById, m_graph[getById].op == GetById);
+        m_candidateAliasGetByVal = NoNode;
+    }
+
+    void recordPutById(NodeIndex putById)
+    {
+        ASSERT_UNUSED(putById, m_graph[putById].op == PutById);
+        m_candidateAliasGetByVal = NoNode;
+    }
+
+    void recordPutByIdDirect(NodeIndex putByVal)
+    {
+        ASSERT_UNUSED(putByVal, m_graph[putByVal].op == PutByIdDirect);
+        m_candidateAliasGetByVal = NoNode;
+    }
+
+private:
+    // This method returns true for arguments:
+    //   - (X, X)
+    //   - (X, ValueToNumber(X))
+    //   - (X, ValueToInt32(X))
+    //   - (X, NumberToInt32(X))
+    bool equalIgnoringLaterNumericConversion(NodeIndex op1, NodeIndex op2)
+    {
+        if (op1 == op2)
+            return true;
+        Node& node2 = m_graph[op2];
+        return (node2.op == ValueToNumber || node2.op == ValueToInt32 || node2.op == NumberToInt32) && op1 == node2.child1;
+    }
+
+    // The graph, to look up potentially aliasing nodes.
+    Graph& m_graph;
+    // Currently a 1-deep buffer!
+    NodeIndex m_candidateAliasGetByVal;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
new file mode 100644
index 0000000..1d4c36a
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -0,0 +1,1082 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGByteCodeParser.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAliasTracker.h"
+#include "DFGScoreBoard.h"
+#include "CodeBlock.h"
+
+namespace JSC { namespace DFG {
+
+#if ENABLE(DFG_JIT_RESTRICTIONS)
+// FIXME: Temporarily disable arithmetic, until we fix associated performance regressions.
+#define ARITHMETIC_OP() m_parseFailed = true
+#else
+#define ARITHMETIC_OP() ((void)0)
+#endif
+
+// === ByteCodeParser ===
+//
+// This class is used to compile the dataflow graph from a CodeBlock.
+class ByteCodeParser {
+public:
+    ByteCodeParser(JSGlobalData* globalData, CodeBlock* codeBlock, Graph& graph)
+        : m_globalData(globalData)
+        , m_codeBlock(codeBlock)
+        , m_graph(graph)
+        , m_currentIndex(0)
+        , m_parseFailed(false)
+        , m_constantUndefined(UINT_MAX)
+        , m_constantNull(UINT_MAX)
+        , m_constant1(UINT_MAX)
+        , m_constants(codeBlock->numberOfConstantRegisters())
+        , m_arguments(codeBlock->m_numParameters)
+        , m_variables(codeBlock->m_numVars)
+        , m_temporaries(codeBlock->m_numCalleeRegisters - codeBlock->m_numVars)
+    {
+        for (unsigned i = 0; i < m_temporaries.size(); ++i)
+            m_temporaries[i] = NoNode;
+    }
+
+    // Parse a full CodeBlock of bytecode.
+    bool parse();
+
+private:
+    // Parse a single basic block of bytecode instructions.
+    bool parseBlock(unsigned limit);
+
+    // Get/Set the operands/result of a bytecode instruction.
+    NodeIndex get(int operand)
+    {
+        // Is this a constant?
+        if (operand >= FirstConstantRegisterIndex) {
+            unsigned constant = operand - FirstConstantRegisterIndex;
+            ASSERT(constant < m_constants.size());
+            return getJSConstant(constant);
+        }
+
+        // Is this an argument?
+        if (operand < 0)
+            return getArgument(operand);
+
+        // Is this a variable?
+        unsigned numVariables = m_variables.size();
+        if ((unsigned)operand < numVariables)
+            return getVariable((unsigned)operand);
+        
+        // Must be a temporary.
+        unsigned temporary = (unsigned)operand - numVariables;
+        ASSERT(temporary < m_temporaries.size());
+        return getTemporary(temporary);
+    }
+    void set(int operand, NodeIndex value)
+    {
+        // Is this an argument?
+        if (operand < 0) {
+            setArgument(operand, value);
+            return;
+        }
+
+        // Is this a variable?
+        unsigned numVariables = m_variables.size();
+        if ((unsigned)operand < numVariables) {
+            setVariable((unsigned)operand, value);
+            return;
+        }
+        
+        // Must be a temporary.
+        unsigned temporary = (unsigned)operand - numVariables;
+        ASSERT(temporary < m_temporaries.size());
+        setTemporary(temporary, value);
+    }
+
+    // Used in implementing get/set, above, where the operand is a local variable.
+    NodeIndex getVariable(unsigned operand)
+    {
+        NodeIndex setNode = m_variables[operand].set;
+        if (setNode != NoNode)
+            return m_graph[setNode].child1;
+
+        NodeIndex getNode = m_variables[operand].get;
+        if (getNode != NoNode)
+            return getNode;
+
+        getNode = addToGraph(GetLocal, OpInfo(operand));
+        m_variables[operand].get = getNode;
+        return getNode;
+    }
+    void setVariable(unsigned operand, NodeIndex value)
+    {
+        NodeIndex priorSet = m_variables[operand].set;
+        m_variables[operand].set = addToGraph(SetLocal, OpInfo(operand), value);
+        if (priorSet != NoNode)
+            m_graph.deref(priorSet);
+    }
+
+    // Used in implementing get/set, above, where the operand is a temporary.
+    NodeIndex getTemporary(unsigned operand)
+    {
+        NodeIndex index = m_temporaries[operand];
+        if (index != NoNode)
+            return index;
+        
+        // Detect a read of an temporary that is not a yet defined within this block (e.g. use of ?:).
+        m_parseFailed = true;
+        return constantUndefined();
+    }
+    void setTemporary(unsigned operand, NodeIndex value)
+    {
+        m_temporaries[operand] = value;
+    }
+
+    // Used in implementing get/set, above, where the operand is an argument.
+    NodeIndex getArgument(unsigned operand)
+    {
+        unsigned argument = operand + m_codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize;
+        ASSERT(argument < m_arguments.size());
+
+        NodeIndex setNode = m_arguments[argument].set;
+        if (setNode != NoNode)
+            return m_graph[setNode].child1;
+
+        NodeIndex getNode = m_arguments[argument].get;
+        if (getNode != NoNode)
+            return getNode;
+
+        getNode = addToGraph(GetLocal, OpInfo(operand));
+        m_arguments[argument].get = getNode;
+        return getNode;
+    }
+    void setArgument(int operand, NodeIndex value)
+    {
+        unsigned argument = operand + m_codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize;
+        ASSERT(argument < m_arguments.size());
+
+        NodeIndex priorSet = m_arguments[argument].set;
+        m_arguments[argument].set = addToGraph(SetLocal, OpInfo(operand), value);
+        if (priorSet != NoNode)
+            m_graph.deref(priorSet);
+    }
+
+    // Get an operand, and perform a ToInt32/ToNumber conversion on it.
+    NodeIndex getToInt32(int operand)
+    {
+        // Avoid wastefully adding a JSConstant node to the graph, only to
+        // replace it with a Int32Constant (which is what would happen if
+        // we called 'toInt32(get(operand))' in this case).
+        if (operand >= FirstConstantRegisterIndex) {
+            JSValue v = m_codeBlock->getConstant(operand);
+            if (v.isInt32())
+                return getInt32Constant(v.asInt32(), operand - FirstConstantRegisterIndex);
+        }
+        return toInt32(get(operand));
+    }
+    NodeIndex getToNumber(int operand)
+    {
+        // Avoid wastefully adding a JSConstant node to the graph, only to
+        // replace it with a DoubleConstant (which is what would happen if
+        // we called 'toNumber(get(operand))' in this case).
+        if (operand >= FirstConstantRegisterIndex) {
+            JSValue v = m_codeBlock->getConstant(operand);
+            if (v.isNumber())
+                return getDoubleConstant(v.uncheckedGetNumber(), operand - FirstConstantRegisterIndex);
+        }
+        return toNumber(get(operand));
+    }
+
+    // Perform an ES5 ToInt32 operation - returns a node of type NodeResultInt32.
+    NodeIndex toInt32(NodeIndex index)
+    {
+        Node& node = m_graph[index];
+
+        if (node.hasInt32Result())
+            return index;
+
+        if (node.hasDoubleResult()) {
+            if (node.op == DoubleConstant)
+                return getInt32Constant(JSC::toInt32(valueOfDoubleConstant(index)), node.constantNumber());
+            // 'NumberToInt32(Int32ToNumber(X))' == X, and 'NumberToInt32(UInt32ToNumber(X)) == X'
+            if (node.op == Int32ToNumber || node.op == UInt32ToNumber)
+                return node.child1;
+
+            // We unique NumberToInt32 nodes in a map to prevent duplicate conversions.
+            pair<UnaryOpMap::iterator, bool> result = m_numberToInt32Nodes.add(index, NoNode);
+            // Either we added a new value, or the existing value in the map is non-zero.
+            ASSERT(result.second == (result.first->second == NoNode));
+            if (result.second)
+                result.first->second = addToGraph(NumberToInt32, index);
+            return result.first->second;
+        }
+
+        // Check for numeric constants boxed as JSValues.
+        if (node.op == JSConstant) {
+            JSValue v = valueOfJSConstant(index);
+            if (v.isInt32())
+                return getInt32Constant(v.asInt32(), node.constantNumber());
+            if (v.isNumber())
+                return getInt32Constant(JSC::toInt32(v.uncheckedGetNumber()), node.constantNumber());
+        }
+
+        return addToGraph(ValueToInt32, index);
+    }
+
+    // Perform an ES5 ToNumber operation - returns a node of type NodeResultDouble.
+    NodeIndex toNumber(NodeIndex index)
+    {
+        Node& node = m_graph[index];
+
+        if (node.hasDoubleResult())
+            return index;
+
+        if (node.hasInt32Result()) {
+            if (node.op == Int32Constant)
+                return getDoubleConstant(valueOfInt32Constant(index), node.constantNumber());
+
+            // We unique Int32ToNumber nodes in a map to prevent duplicate conversions.
+            pair<UnaryOpMap::iterator, bool> result = m_int32ToNumberNodes.add(index, NoNode);
+            // Either we added a new value, or the existing value in the map is non-zero.
+            ASSERT(result.second == (result.first->second == NoNode));
+            if (result.second)
+                result.first->second = addToGraph(Int32ToNumber, index);
+            return result.first->second;
+        }
+
+        if (node.op == JSConstant) {
+            JSValue v = valueOfJSConstant(index);
+            if (v.isNumber())
+                return getDoubleConstant(v.uncheckedGetNumber(), node.constantNumber());
+        }
+
+        return addToGraph(ValueToNumber, index);
+    }
+
+
+    // Used in implementing get, above, where the operand is a constant.
+    NodeIndex getInt32Constant(int32_t value, unsigned constant)
+    {
+        NodeIndex index = m_constants[constant].asInt32;
+        if (index != NoNode)
+            return index;
+        NodeIndex resultIndex = addToGraph(Int32Constant, OpInfo(constant));
+        m_graph[resultIndex].setInt32Constant(value);
+        m_constants[constant].asInt32 = resultIndex;
+        return resultIndex;
+    }
+    NodeIndex getDoubleConstant(double value, unsigned constant)
+    {
+        NodeIndex index = m_constants[constant].asNumeric;
+        if (index != NoNode)
+            return index;
+        NodeIndex resultIndex = addToGraph(DoubleConstant, OpInfo(constant));
+        m_graph[resultIndex].setDoubleConstant(value);
+        m_constants[constant].asNumeric = resultIndex;
+        return resultIndex;
+    }
+    NodeIndex getJSConstant(unsigned constant)
+    {
+        NodeIndex index = m_constants[constant].asJSValue;
+        if (index != NoNode)
+            return index;
+
+        NodeIndex resultIndex = addToGraph(JSConstant, OpInfo(constant));
+        m_constants[constant].asJSValue = resultIndex;
+        return resultIndex;
+    }
+
+    // Helper functions to get/set the this value.
+    NodeIndex getThis()
+    {
+        return getArgument(m_codeBlock->thisRegister());
+    }
+    void setThis(NodeIndex value)
+    {
+        setArgument(m_codeBlock->thisRegister(), value);
+    }
+
+    // Convenience methods for checking nodes for constants.
+    bool isInt32Constant(NodeIndex index)
+    {
+        return m_graph[index].op == Int32Constant;
+    }
+    bool isDoubleConstant(NodeIndex index)
+    {
+        return m_graph[index].op == DoubleConstant;
+    }
+    bool isJSConstant(NodeIndex index)
+    {
+        return m_graph[index].op == JSConstant;
+    }
+
+    // Convenience methods for getting constant values.
+    int32_t valueOfInt32Constant(NodeIndex index)
+    {
+        ASSERT(isInt32Constant(index));
+        return m_graph[index].int32Constant();
+    }
+    double valueOfDoubleConstant(NodeIndex index)
+    {
+        ASSERT(isDoubleConstant(index));
+        return m_graph[index].numericConstant();
+    }
+    JSValue valueOfJSConstant(NodeIndex index)
+    {
+        ASSERT(isJSConstant(index));
+        return m_codeBlock->getConstant(FirstConstantRegisterIndex + m_graph[index].constantNumber());
+    }
+
+    // This method returns a JSConstant with the value 'undefined'.
+    NodeIndex constantUndefined()
+    {
+        // Has m_constantUndefined been set up yet?
+        if (m_constantUndefined == UINT_MAX) {
+            // Search the constant pool for undefined, if we find it, we can just reuse this!
+            unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();
+            for (m_constantUndefined = 0; m_constantUndefined < numberOfConstants; ++m_constantUndefined) {
+                JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantUndefined);
+                if (testMe.isUndefined())
+                    return getJSConstant(m_constantUndefined);
+            }
+
+            // Add undefined to the CodeBlock's constants, and add a corresponding slot in m_constants.
+            ASSERT(m_constants.size() == numberOfConstants);
+            m_codeBlock->addConstant(jsUndefined());
+            m_constants.append(ConstantRecord());
+            ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());
+        }
+
+        // m_constantUndefined must refer to an entry in the CodeBlock's constant pool that has the value 'undefined'.
+        ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantUndefined).isUndefined());
+        return getJSConstant(m_constantUndefined);
+    }
+
+    // This method returns a JSConstant with the value 'null'.
+    NodeIndex constantNull()
+    {
+        // Has m_constantNull been set up yet?
+        if (m_constantNull == UINT_MAX) {
+            // Search the constant pool for null, if we find it, we can just reuse this!
+            unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();
+            for (m_constantNull = 0; m_constantNull < numberOfConstants; ++m_constantNull) {
+                JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNull);
+                if (testMe.isNull())
+                    return getJSConstant(m_constantNull);
+            }
+
+            // Add null to the CodeBlock's constants, and add a corresponding slot in m_constants.
+            ASSERT(m_constants.size() == numberOfConstants);
+            m_codeBlock->addConstant(jsNull());
+            m_constants.append(ConstantRecord());
+            ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());
+        }
+
+        // m_constantNull must refer to an entry in the CodeBlock's constant pool that has the value 'null'.
+        ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNull).isNull());
+        return getJSConstant(m_constantNull);
+    }
+
+    // This method returns a DoubleConstant with the value 1.
+    NodeIndex one()
+    {
+        // Has m_constant1 been set up yet?
+        if (m_constant1 == UINT_MAX) {
+            // Search the constant pool for the value 1, if we find it, we can just reuse this!
+            unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();
+            for (m_constant1 = 0; m_constant1 < numberOfConstants; ++m_constant1) {
+                JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constant1);
+                if (testMe.isInt32() && testMe.asInt32() == 1)
+                    return getDoubleConstant(1, m_constant1);
+            }
+
+            // Add the value 1 to the CodeBlock's constants, and add a corresponding slot in m_constants.
+            ASSERT(m_constants.size() == numberOfConstants);
+            m_codeBlock->addConstant(jsNumber(1));
+            m_constants.append(ConstantRecord());
+            ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());
+        }
+
+        // m_constant1 must refer to an entry in the CodeBlock's constant pool that has the integer value 1.
+        ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constant1).isInt32());
+        ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constant1).asInt32() == 1);
+        return getDoubleConstant(1, m_constant1);
+    }
+
+
+    // These methods create a node and add it to the graph. If nodes of this type are
+    // 'mustGenerate' then the node  will implicitly be ref'ed to ensure generation.
+    NodeIndex addToGraph(NodeType op, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+    {
+        NodeIndex resultIndex = (NodeIndex)m_graph.size();
+        m_graph.append(Node(op, m_currentIndex, child1, child2, child3));
+
+        if (op & NodeMustGenerate)
+            m_graph.ref(resultIndex);
+        return resultIndex;
+    }
+    NodeIndex addToGraph(NodeType op, OpInfo info, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+    {
+        NodeIndex resultIndex = (NodeIndex)m_graph.size();
+        m_graph.append(Node(op, m_currentIndex, info, child1, child2, child3));
+
+        if (op & NodeMustGenerate)
+            m_graph.ref(resultIndex);
+        return resultIndex;
+    }
+    NodeIndex addToGraph(NodeType op, OpInfo info1, OpInfo info2, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+    {
+        NodeIndex resultIndex = (NodeIndex)m_graph.size();
+        m_graph.append(Node(op, m_currentIndex, info1, info2, child1, child2, child3));
+
+        if (op & NodeMustGenerate)
+            m_graph.ref(resultIndex);
+        return resultIndex;
+    }
+
+    JSGlobalData* m_globalData;
+    CodeBlock* m_codeBlock;
+    Graph& m_graph;
+
+    // The bytecode index of the current instruction being generated.
+    unsigned m_currentIndex;
+
+    // Record failures due to unimplemented functionality or regressions.
+    bool m_parseFailed;
+
+    // We use these values during code generation, and to avoid the need for
+    // special handling we make sure they are available as constants in the
+    // CodeBlock's constant pool. These variables are initialized to
+    // UINT_MAX, and lazily updated to hold an index into the CodeBlock's
+    // constant pool, as necessary.
+    unsigned m_constantUndefined;
+    unsigned m_constantNull;
+    unsigned m_constant1;
+
+    // A constant in the constant pool may be represented by more than one
+    // node in the graph, depending on the context in which it is being used.
+    struct ConstantRecord {
+        ConstantRecord()
+            : asInt32(NoNode)
+            , asNumeric(NoNode)
+            , asJSValue(NoNode)
+        {
+        }
+
+        NodeIndex asInt32;
+        NodeIndex asNumeric;
+        NodeIndex asJSValue;
+    };
+
+    // For every local variable we track any existing get or set of the value.
+    // We track the get so that these may be shared, and we track the set to
+    // retrieve the current value, and to reference the final definition.
+    struct VariableRecord {
+        VariableRecord()
+            : get(NoNode)
+            , set(NoNode)
+        {
+        }
+
+        NodeIndex get;
+        NodeIndex set;
+    };
+
+    // Track the index of the node whose result is the current value for every
+    // register value in the bytecode - argument, local, and temporary.
+    Vector <ConstantRecord, 32> m_constants;
+    Vector <VariableRecord, 32> m_arguments;
+    Vector <VariableRecord, 32> m_variables;
+    Vector <NodeIndex, 32> m_temporaries;
+
+    // These maps are used to unique ToNumber and ToInt32 operations.
+    typedef HashMap<NodeIndex, NodeIndex> UnaryOpMap;
+    UnaryOpMap m_int32ToNumberNodes;
+    UnaryOpMap m_numberToInt32Nodes;
+};
+
+#define NEXT_OPCODE(name) \
+    m_currentIndex += OPCODE_LENGTH(name); \
+    continue
+
+#define LAST_OPCODE(name) \
+    m_currentIndex += OPCODE_LENGTH(name); \
+    return !m_parseFailed
+
+bool ByteCodeParser::parseBlock(unsigned limit)
+{
+    // No need to reset state initially, since it has been set by the constructor.
+    if (m_currentIndex) {
+        for (unsigned i = 0; i < m_constants.size(); ++i)
+            m_constants[i] = ConstantRecord();
+        for (unsigned i = 0; i < m_variables.size(); ++i)
+            m_variables[i] = VariableRecord();
+        for (unsigned i = 0; i < m_arguments.size(); ++i)
+            m_arguments[i] = VariableRecord();
+        for (unsigned i = 0; i < m_temporaries.size(); ++i)
+            m_temporaries[i] = NoNode;
+    }
+
+    AliasTracker aliases(m_graph);
+
+    Interpreter* interpreter = m_globalData->interpreter;
+    Instruction* instructionsBegin = m_codeBlock->instructions().begin();
+    while (true) {
+        // Don't extend over jump destinations.
+        if (m_currentIndex == limit) {
+            addToGraph(Jump, OpInfo(m_currentIndex));
+            return !m_parseFailed;
+        }
+
+        // Switch on the current bytecode opcode.
+        Instruction* currentInstruction = instructionsBegin + m_currentIndex;
+        switch (interpreter->getOpcodeID(currentInstruction->u.opcode)) {
+
+        // === Function entry opcodes ===
+
+        case op_enter:
+            // Initialize all locals to undefined.
+            for (int i = 0; i < m_codeBlock->m_numVars; ++i)
+                set(i, constantUndefined());
+            NEXT_OPCODE(op_enter);
+
+        case op_convert_this: {
+            NodeIndex op1 = getThis();
+            setThis(addToGraph(ConvertThis, op1));
+            NEXT_OPCODE(op_convert_this);
+        }
+
+        // === Bitwise operations ===
+
+        case op_bitand: {
+            NodeIndex op1 = getToInt32(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToInt32(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(BitAnd, op1, op2));
+            NEXT_OPCODE(op_bitand);
+        }
+
+        case op_bitor: {
+            NodeIndex op1 = getToInt32(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToInt32(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(BitOr, op1, op2));
+            NEXT_OPCODE(op_bitor);
+        }
+
+        case op_bitxor: {
+            NodeIndex op1 = getToInt32(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToInt32(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(BitXor, op1, op2));
+            NEXT_OPCODE(op_bitxor);
+        }
+
+        case op_rshift: {
+            NodeIndex op1 = getToInt32(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToInt32(currentInstruction[3].u.operand);
+            NodeIndex result;
+            // Optimize out shifts by zero.
+            if (isInt32Constant(op2) && !(valueOfInt32Constant(op2) & 0x1f))
+                result = op1;
+            else
+                result = addToGraph(BitRShift, op1, op2);
+            set(currentInstruction[1].u.operand, result);
+            NEXT_OPCODE(op_rshift);
+        }
+
+        case op_lshift: {
+            NodeIndex op1 = getToInt32(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToInt32(currentInstruction[3].u.operand);
+            NodeIndex result;
+            // Optimize out shifts by zero.
+            if (isInt32Constant(op2) && !(valueOfInt32Constant(op2) & 0x1f))
+                result = op1;
+            else
+                result = addToGraph(BitLShift, op1, op2);
+            set(currentInstruction[1].u.operand, result);
+            NEXT_OPCODE(op_lshift);
+        }
+
+        case op_urshift: {
+            NodeIndex op1 = getToInt32(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToInt32(currentInstruction[3].u.operand);
+            NodeIndex result;
+            // The result of a zero-extending right shift is treated as an unsigned value.
+            // This means that if the top bit is set, the result is not in the int32 range,
+            // and as such must be stored as a double. If the shift amount is a constant,
+            // we may be able to optimize.
+            if (isInt32Constant(op2)) {
+                // If we know we are shifting by a non-zero amount, then since the operation
+                // zero fills we know the top bit of the result must be zero, and as such the
+                // result must be within the int32 range. Conversely, if this is a shift by
+                // zero, then the result may be changed by the conversion to unsigned, but it
+                // is not necessary to perform the shift!
+                if (valueOfInt32Constant(op2) & 0x1f)
+                    result = addToGraph(BitURShift, op1, op2);
+                else
+                    result = addToGraph(UInt32ToNumber, op1);
+            }  else {
+                // Cannot optimize at this stage; shift & potentially rebox as a double.
+                result = addToGraph(BitURShift, op1, op2);
+                result = addToGraph(UInt32ToNumber, result);
+            }
+            set(currentInstruction[1].u.operand, result);
+            NEXT_OPCODE(op_urshift);
+        }
+
+        // === Increment/Decrement opcodes ===
+
+        case op_pre_inc: {
+            unsigned srcDst = currentInstruction[1].u.operand;
+            NodeIndex op = getToNumber(srcDst);
+            set(srcDst, addToGraph(ArithAdd, op, one()));
+            NEXT_OPCODE(op_pre_inc);
+        }
+
+        case op_post_inc: {
+            unsigned result = currentInstruction[1].u.operand;
+            unsigned srcDst = currentInstruction[2].u.operand;
+            NodeIndex op = getToNumber(srcDst);
+            set(result, op);
+            set(srcDst, addToGraph(ArithAdd, op, one()));
+            NEXT_OPCODE(op_post_inc);
+        }
+
+        case op_pre_dec: {
+            unsigned srcDst = currentInstruction[1].u.operand;
+            NodeIndex op = getToNumber(srcDst);
+            set(srcDst, addToGraph(ArithSub, op, one()));
+            NEXT_OPCODE(op_pre_dec);
+        }
+
+        case op_post_dec: {
+            unsigned result = currentInstruction[1].u.operand;
+            unsigned srcDst = currentInstruction[2].u.operand;
+            NodeIndex op = getToNumber(srcDst);
+            set(result, op);
+            set(srcDst, addToGraph(ArithSub, op, one()));
+            NEXT_OPCODE(op_post_dec);
+        }
+
+        // === Arithmetic operations ===
+
+        case op_add: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            // If both operands can statically be determined to the numbers, then this is an arithmetic add.
+            // Otherwise, we must assume this may be performing a concatenation to a string.
+            if (m_graph[op1].hasNumericResult() && m_graph[op2].hasNumericResult())
+                set(currentInstruction[1].u.operand, addToGraph(ArithAdd, toNumber(op1), toNumber(op2)));
+            else
+                set(currentInstruction[1].u.operand, addToGraph(ValueAdd, op1, op2));
+            NEXT_OPCODE(op_add);
+        }
+
+        case op_sub: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(ArithSub, op1, op2));
+            NEXT_OPCODE(op_sub);
+        }
+
+        case op_mul: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(ArithMul, op1, op2));
+            NEXT_OPCODE(op_mul);
+        }
+
+        case op_mod: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(ArithMod, op1, op2));
+            NEXT_OPCODE(op_mod);
+        }
+
+        case op_div: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = getToNumber(currentInstruction[2].u.operand);
+            NodeIndex op2 = getToNumber(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(ArithDiv, op1, op2));
+            NEXT_OPCODE(op_div);
+        }
+
+        // === Misc operations ===
+
+        case op_mov: {
+            NodeIndex op = get(currentInstruction[2].u.operand);
+            set(currentInstruction[1].u.operand, op);
+            NEXT_OPCODE(op_mov);
+        }
+
+        case op_not: {
+            ARITHMETIC_OP();
+            NodeIndex value = get(currentInstruction[2].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(LogicalNot, value));
+            NEXT_OPCODE(op_not);
+        }
+
+        case op_less: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(CompareLess, op1, op2));
+            NEXT_OPCODE(op_less);
+        }
+
+        case op_lesseq: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(CompareLessEq, op1, op2));
+            NEXT_OPCODE(op_lesseq);
+        }
+
+        case op_eq: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(CompareEq, op1, op2));
+            NEXT_OPCODE(op_eq);
+        }
+
+        case op_eq_null: {
+            ARITHMETIC_OP();
+            NodeIndex value = get(currentInstruction[2].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(CompareEq, value, constantNull()));
+            NEXT_OPCODE(op_eq_null);
+        }
+
+        case op_stricteq: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(CompareStrictEq, op1, op2));
+            NEXT_OPCODE(op_stricteq);
+        }
+
+        case op_neq: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(LogicalNot, addToGraph(CompareEq, op1, op2)));
+            NEXT_OPCODE(op_neq);
+        }
+
+        case op_neq_null: {
+            ARITHMETIC_OP();
+            NodeIndex value = get(currentInstruction[2].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(LogicalNot, addToGraph(CompareEq, value, constantNull())));
+            NEXT_OPCODE(op_neq_null);
+        }
+
+        case op_nstricteq: {
+            ARITHMETIC_OP();
+            NodeIndex op1 = get(currentInstruction[2].u.operand);
+            NodeIndex op2 = get(currentInstruction[3].u.operand);
+            set(currentInstruction[1].u.operand, addToGraph(LogicalNot, addToGraph(CompareStrictEq, op1, op2)));
+            NEXT_OPCODE(op_nstricteq);
+        }
+
+        // === Property access operations ===
+
+        case op_get_by_val: {
+            NodeIndex base = get(currentInstruction[2].u.operand);
+            NodeIndex property = get(currentInstruction[3].u.operand);
+
+            NodeIndex getByVal = addToGraph(GetByVal, base, property, aliases.lookupGetByVal(base, property));
+            set(currentInstruction[1].u.operand, getByVal);
+            aliases.recordGetByVal(getByVal);
+
+            NEXT_OPCODE(op_get_by_val);
+        }
+
+        case op_put_by_val: {
+            NodeIndex base = get(currentInstruction[1].u.operand);
+            NodeIndex property = get(currentInstruction[2].u.operand);
+            NodeIndex value = get(currentInstruction[3].u.operand);
+
+            NodeIndex aliasedGet = aliases.lookupGetByVal(base, property);
+            NodeIndex putByVal = addToGraph(aliasedGet != NoNode ? PutByValAlias : PutByVal, base, property, value);
+            aliases.recordPutByVal(putByVal);
+
+            NEXT_OPCODE(op_put_by_val);
+        }
+
+        case op_get_by_id: {
+            NodeIndex base = get(currentInstruction[2].u.operand);
+            unsigned identifier = currentInstruction[3].u.operand;
+
+            NodeIndex getById = addToGraph(GetById, OpInfo(identifier), base);
+            set(currentInstruction[1].u.operand, getById);
+            aliases.recordGetById(getById);
+
+            NEXT_OPCODE(op_get_by_id);
+        }
+
+        case op_put_by_id: {
+            NodeIndex value = get(currentInstruction[3].u.operand);
+            NodeIndex base = get(currentInstruction[1].u.operand);
+            unsigned identifier = currentInstruction[2].u.operand;
+            bool direct = currentInstruction[8].u.operand;
+
+            if (direct) {
+                NodeIndex putByIdDirect = addToGraph(PutByIdDirect, OpInfo(identifier), base, value);
+                aliases.recordPutByIdDirect(putByIdDirect);
+            } else {
+                NodeIndex putById = addToGraph(PutById, OpInfo(identifier), base, value);
+                aliases.recordPutById(putById);
+            }
+
+            NEXT_OPCODE(op_put_by_id);
+        }
+
+        case op_get_global_var: {
+            NodeIndex getGlobalVar = addToGraph(GetGlobalVar, OpInfo(currentInstruction[2].u.operand));
+            set(currentInstruction[1].u.operand, getGlobalVar);
+            NEXT_OPCODE(op_get_global_var);
+        }
+
+        case op_put_global_var: {
+            NodeIndex value = get(currentInstruction[2].u.operand);
+            addToGraph(PutGlobalVar, OpInfo(currentInstruction[1].u.operand), value);
+            NEXT_OPCODE(op_put_global_var);
+        }
+
+        // === Block terminators. ===
+
+        case op_jmp: {
+            unsigned relativeOffset = currentInstruction[1].u.operand;
+            addToGraph(Jump, OpInfo(m_currentIndex + relativeOffset));
+            LAST_OPCODE(op_jmp);
+        }
+
+        case op_loop: {
+            unsigned relativeOffset = currentInstruction[1].u.operand;
+            addToGraph(Jump, OpInfo(m_currentIndex + relativeOffset));
+            LAST_OPCODE(op_loop);
+        }
+
+        case op_jtrue: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            NodeIndex condition = get(currentInstruction[1].u.operand);
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_jtrue)), condition);
+            LAST_OPCODE(op_jtrue);
+        }
+
+        case op_jfalse: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            NodeIndex condition = get(currentInstruction[1].u.operand);
+            addToGraph(Branch, OpInfo(m_currentIndex + OPCODE_LENGTH(op_jfalse)), OpInfo(m_currentIndex + relativeOffset), condition);
+            LAST_OPCODE(op_jfalse);
+        }
+
+        case op_loop_if_true: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            NodeIndex condition = get(currentInstruction[1].u.operand);
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_loop_if_true)), condition);
+            LAST_OPCODE(op_loop_if_true);
+        }
+
+        case op_loop_if_false: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            NodeIndex condition = get(currentInstruction[1].u.operand);
+            addToGraph(Branch, OpInfo(m_currentIndex + OPCODE_LENGTH(op_loop_if_false)), OpInfo(m_currentIndex + relativeOffset), condition);
+            LAST_OPCODE(op_loop_if_false);
+        }
+
+        case op_jeq_null: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            NodeIndex value = get(currentInstruction[1].u.operand);
+            NodeIndex condition = addToGraph(CompareEq, value, constantNull());
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_jeq_null)), condition);
+            LAST_OPCODE(op_jeq_null);
+        }
+
+        case op_jneq_null: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            NodeIndex value = get(currentInstruction[1].u.operand);
+            NodeIndex condition = addToGraph(CompareEq, value, constantNull());
+            addToGraph(Branch, OpInfo(m_currentIndex + OPCODE_LENGTH(op_jneq_null)), OpInfo(m_currentIndex + relativeOffset), condition);
+            LAST_OPCODE(op_jneq_null);
+        }
+
+        case op_jnless: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            NodeIndex op1 = get(currentInstruction[1].u.operand);
+            NodeIndex op2 = get(currentInstruction[2].u.operand);
+            NodeIndex condition = addToGraph(CompareLess, op1, op2);
+            addToGraph(Branch, OpInfo(m_currentIndex + OPCODE_LENGTH(op_jnless)), OpInfo(m_currentIndex + relativeOffset), condition);
+            LAST_OPCODE(op_jnless);
+        }
+
+        case op_jnlesseq: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            NodeIndex op1 = get(currentInstruction[1].u.operand);
+            NodeIndex op2 = get(currentInstruction[2].u.operand);
+            NodeIndex condition = addToGraph(CompareLessEq, op1, op2);
+            addToGraph(Branch, OpInfo(m_currentIndex + OPCODE_LENGTH(op_jnlesseq)), OpInfo(m_currentIndex + relativeOffset), condition);
+            LAST_OPCODE(op_jnlesseq);
+        }
+
+        case op_jless: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            NodeIndex op1 = get(currentInstruction[1].u.operand);
+            NodeIndex op2 = get(currentInstruction[2].u.operand);
+            NodeIndex condition = addToGraph(CompareLess, op1, op2);
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_jless)), condition);
+            LAST_OPCODE(op_jless);
+        }
+
+        case op_jlesseq: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            NodeIndex op1 = get(currentInstruction[1].u.operand);
+            NodeIndex op2 = get(currentInstruction[2].u.operand);
+            NodeIndex condition = addToGraph(CompareLessEq, op1, op2);
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_jlesseq)), condition);
+            LAST_OPCODE(op_jlesseq);
+        }
+
+        case op_loop_if_less: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            NodeIndex op1 = get(currentInstruction[1].u.operand);
+            NodeIndex op2 = get(currentInstruction[2].u.operand);
+            NodeIndex condition = addToGraph(CompareLess, op1, op2);
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_loop_if_less)), condition);
+            LAST_OPCODE(op_loop_if_less);
+        }
+
+        case op_loop_if_lesseq: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            NodeIndex op1 = get(currentInstruction[1].u.operand);
+            NodeIndex op2 = get(currentInstruction[2].u.operand);
+            NodeIndex condition = addToGraph(CompareLessEq, op1, op2);
+            addToGraph(Branch, OpInfo(m_currentIndex + relativeOffset), OpInfo(m_currentIndex + OPCODE_LENGTH(op_loop_if_lesseq)), condition);
+            LAST_OPCODE(op_loop_if_lesseq);
+        }
+
+        case op_ret: {
+            addToGraph(Return, get(currentInstruction[1].u.operand));
+
+            // FIXME: throw away terminal definitions of variables;
+            // should not be necessary once we have proper DCE!
+            for (unsigned i = 0; i < m_variables.size(); ++i) {
+                NodeIndex priorSet = m_variables[i].set;
+                if (priorSet != NoNode)
+                    m_graph.deref(priorSet);
+            }
+
+            LAST_OPCODE(op_ret);
+        }
+
+        default:
+            // Parse failed!
+            return false;
+        }
+    }
+}
+
+bool ByteCodeParser::parse()
+{
+    // Set during construction.
+    ASSERT(!m_currentIndex);
+
+    for (unsigned jumpTargetIndex = 0; jumpTargetIndex <= m_codeBlock->numberOfJumpTargets(); ++jumpTargetIndex) {
+        // The maximum bytecode offset to go into the current basicblock is either the next jump target, or the end of the instructions.
+        unsigned limit = jumpTargetIndex < m_codeBlock->numberOfJumpTargets() ? m_codeBlock->jumpTarget(jumpTargetIndex) : m_codeBlock->instructions().size();
+        ASSERT(m_currentIndex < limit);
+
+        // Loop until we reach the current limit (i.e. next jump target).
+        do {
+            unsigned bytecodeBegin = m_currentIndex;
+            NodeIndex begin = m_graph.size();
+
+            if (!parseBlock(limit))
+                return false;
+            // We should not have gone beyond the limit.
+            ASSERT(m_currentIndex <= limit);
+
+            NodeIndex end = m_graph.size();
+            m_graph.m_blocks.append(BasicBlock(bytecodeBegin, begin, end));
+        } while (m_currentIndex < limit);
+    }
+
+    // Should have reached the end of the instructions.
+    ASSERT(m_currentIndex == m_codeBlock->instructions().size());
+
+    // Assign VirtualRegisters.
+    ScoreBoard scoreBoard(m_graph, m_variables.size());
+    Node* nodes = m_graph.begin();
+    size_t size = m_graph.size();
+    for (size_t i = 0; i < size; ++i) {
+        Node& node = nodes[i];
+        if (node.refCount) {
+            // First, call use on all of the current node's children, then
+            // allocate a VirtualRegister for this node. We do so in this
+            // order so that if a child is on its last use, and a
+            // VirtualRegister is freed, then it may be reused for node.
+            scoreBoard.use(node.child1);
+            scoreBoard.use(node.child2);
+            scoreBoard.use(node.child3);
+            node.virtualRegister = scoreBoard.allocate();
+            // 'mustGenerate' nodes have their useCount artificially elevated,
+            // call use now to account for this.
+            if (node.mustGenerate())
+                scoreBoard.use(i);
+        }
+    }
+
+    // 'm_numCalleeRegisters' is the number of locals and temporaries allocated
+    // for the function (and checked for on entry). Since we perform a new and
+    // different allocation of temporaries, more registers may now be required.
+    unsigned calleeRegisters = scoreBoard.allocatedCount() + m_variables.size();
+    if ((unsigned)m_codeBlock->m_numCalleeRegisters < calleeRegisters)
+        m_codeBlock->m_numCalleeRegisters = calleeRegisters;
+
+#if DFG_DEBUG_VERBOSE
+    m_graph.dump(m_codeBlock);
+#endif
+
+    return true;
+}
+
+bool parse(Graph& graph, JSGlobalData* globalData, CodeBlock* codeBlock)
+{
+#if DFG_DEBUG_LOCAL_DISBALE
+    UNUSED_PARAM(graph);
+    UNUSED_PARAM(globalData);
+    UNUSED_PARAM(codeBlock);
+    return false;
+#else
+    return ByteCodeParser(globalData, codeBlock, graph).parse();
+#endif
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/runtime/NativeFunctionWrapper.h b/Source/JavaScriptCore/dfg/DFGByteCodeParser.h
index d4eeb3b..d4efe61 100644
--- a/Source/JavaScriptCore/runtime/NativeFunctionWrapper.h
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,17 +23,25 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef NativeFunctionWrapper_h
-#define NativeFunctionWrapper_h
+#ifndef DFGByteCodeParser_h
+#define DFGByteCodeParser_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGGraph.h>
 
 namespace JSC {
-#if ENABLE(JIT) && ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
-    class JSFunction;
-    typedef JSFunction NativeFunctionWrapper;
-#else
-    class PrototypeFunction;
-    typedef PrototypeFunction NativeFunctionWrapper;
-#endif
-}
 
+class CodeBlock;
+class JSGlobalData;
+
+namespace DFG {
+
+// Populate the Graph with a basic block of code from the CodeBlock,
+// starting at the provided bytecode index.
+bool parse(Graph&, JSGlobalData*, CodeBlock*);
+
+} } // namespace JSC::DFG
+
+#endif
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGGenerationInfo.h b/Source/JavaScriptCore/dfg/DFGGenerationInfo.h
new file mode 100644
index 0000000..1c72e09
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGGenerationInfo.h
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGGenerationInfo_h
+#define DFGGenerationInfo_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGJITCompiler.h>
+
+namespace JSC { namespace DFG {
+
+// === DataFormat ===
+//
+// This enum tracks the current representation in which a value is being held.
+// Values may be unboxed primitives (int32, double, or cell), or boxed as a JSValue.
+// For boxed values, we may know the type of boxing that has taken place.
+// (May also need bool, array, object, string types!)
+enum DataFormat {
+    DataFormatNone = 0,
+    DataFormatInteger = 1,
+    DataFormatDouble = 2,
+    DataFormatCell = 3,
+    DataFormatJS = 8,
+    DataFormatJSInteger = DataFormatJS | DataFormatInteger,
+    DataFormatJSDouble = DataFormatJS | DataFormatDouble,
+    DataFormatJSCell = DataFormatJS | DataFormatCell,
+};
+
+// === GenerationInfo ===
+//
+// This class is used to track the current status of a live values during code generation.
+// Can provide information as to whether a value is in machine registers, and if so which,
+// whether a value has been spilled to the RegsiterFile, and if so may be able to provide
+// details of the format in memory (all values are spilled in a boxed form, but we may be
+// able to track the type of box), and tracks how many outstanding uses of a value remain,
+// so that we know when the value is dead and the machine registers associated with it
+// may be released.
+class GenerationInfo {
+public:
+    GenerationInfo()
+        : m_nodeIndex(NoNode)
+        , m_useCount(0)
+        , m_registerFormat(DataFormatNone)
+        , m_spillFormat(DataFormatNone)
+        , m_canFill(false)
+    {
+    }
+
+    void initConstant(NodeIndex nodeIndex, uint32_t useCount)
+    {
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatNone;
+        m_spillFormat = DataFormatNone;
+        m_canFill = true;
+    }
+    void initInteger(NodeIndex nodeIndex, uint32_t useCount, GPRReg gpr)
+    {
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatInteger;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+        u.gpr = gpr;
+    }
+    void initJSValue(NodeIndex nodeIndex, uint32_t useCount, GPRReg gpr, DataFormat format = DataFormatJS)
+    {
+        ASSERT(format & DataFormatJS);
+
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = format;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+        u.gpr = gpr;
+    }
+    void initCell(NodeIndex nodeIndex, uint32_t useCount, GPRReg gpr)
+    {
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatCell;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+        u.gpr = gpr;
+    }
+    void initDouble(NodeIndex nodeIndex, uint32_t useCount, FPRReg fpr)
+    {
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatDouble;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+        u.fpr = fpr;
+    }
+    void initNone(NodeIndex nodeIndex, uint32_t useCount)
+    {
+        m_nodeIndex = nodeIndex;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatNone;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+    }
+
+    // Get the index of the node that produced this value.
+    NodeIndex nodeIndex() { return m_nodeIndex; }
+
+    // Mark the value as having been used (decrement the useCount).
+    // Returns true if this was the last use of the value, and any
+    // associated machine registers may be freed.
+    bool use()
+    {
+        return !--m_useCount;
+    }
+
+    // Used to check the operands of operations to see if they are on
+    // their last use; in some cases it may be safe to reuse the same
+    // machine register for the result of the operation.
+    bool canReuse()
+    {
+        ASSERT(m_useCount);
+        return m_useCount == 1;
+    }
+
+    // Get the format of the value in machine registers (or 'none').
+    DataFormat registerFormat() { return m_registerFormat; }
+    // Get the format of the value as it is spilled in the RegisterFile (or 'none').
+    DataFormat spillFormat() { return m_spillFormat; }
+
+    // Get the machine resister currently holding the value.
+    GPRReg gpr() { ASSERT(m_registerFormat && m_registerFormat != DataFormatDouble); return u.gpr; }
+    FPRReg fpr() { ASSERT(m_registerFormat == DataFormatDouble); return u.fpr; }
+
+    // Check whether a value needs spilling in order to free up any associated machine registers.
+    bool needsSpill()
+    {
+        // This should only be called on values that are currently in a register.
+        ASSERT(m_registerFormat != DataFormatNone);
+        // Constants do not need spilling, nor do values that have already been
+        // spilled to the RegisterFile.
+        return !m_canFill;
+    }
+
+    // Called when a VirtualRegister is being spilled to the RegisterFile for the first time.
+    void spill(DataFormat spillFormat)
+    {
+        // We shouldn't be spill values that don't need spilling.
+        ASSERT(!m_canFill);
+        ASSERT(m_spillFormat == DataFormatNone);
+        // We should only be spilling values that are currently in machine registers.
+        ASSERT(m_registerFormat != DataFormatNone);
+        // We only spill values that have been boxed as a JSValue; otherwise the GC
+        // would need a way to distinguish cell pointers from numeric primitives.
+        ASSERT(spillFormat & DataFormatJS);
+
+        m_registerFormat = DataFormatNone;
+        m_spillFormat = spillFormat;
+        m_canFill = true;
+    }
+
+    // Called on values that don't need spilling (constants and values that have
+    // already been spilled), to mark them as no longer being in machine registers.
+    void setSpilled()
+    {
+        // Should only be called on values that don't need spilling, and are currently in registers.
+        ASSERT(m_canFill && m_registerFormat != DataFormatNone);
+        m_registerFormat = DataFormatNone;
+    }
+
+    // Record that this value is filled into machine registers,
+    // tracking which registers, and what format the value has.
+    void fillJSValue(GPRReg gpr, DataFormat format = DataFormatJS)
+    {
+        ASSERT(format & DataFormatJS);
+        m_registerFormat = format;
+        u.gpr = gpr;
+    }
+    void fillInteger(GPRReg gpr)
+    {
+        m_registerFormat = DataFormatInteger;
+        u.gpr = gpr;
+    }
+    void fillDouble(FPRReg fpr)
+    {
+        m_registerFormat = DataFormatDouble;
+        u.fpr = fpr;
+    }
+
+#ifndef NDEBUG
+    bool alive()
+    {
+        return m_useCount;
+    }
+#endif
+
+private:
+    // The index of the node whose result is stored in this virtual register.
+    // FIXME: Can we remove this? - this is currently only used when collecting
+    // snapshots of the RegisterBank for SpeculationCheck/EntryLocation. Could
+    // investigate storing NodeIndex as the name in RegsiterBank, instead of
+    // VirtualRegister.
+    NodeIndex m_nodeIndex;
+    uint32_t m_useCount;
+    DataFormat m_registerFormat;
+    DataFormat m_spillFormat;
+    bool m_canFill;
+    union {
+        GPRReg gpr;
+        FPRReg fpr;
+    } u;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
new file mode 100644
index 0000000..84e2d4d
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGGraph.cpp
@@ -0,0 +1,181 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGGraph.h"
+
+#include "CodeBlock.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+#ifndef NDEBUG
+
+// Creates an array of stringized names.
+static const char* dfgOpNames[] = {
+#define STRINGIZE_DFG_OP_ENUM(opcode, flags) #opcode ,
+    FOR_EACH_DFG_OP(STRINGIZE_DFG_OP_ENUM)
+#undef STRINGIZE_DFG_OP_ENUM
+};
+
+void Graph::dump(NodeIndex nodeIndex, CodeBlock* codeBlock)
+{
+    Node& node = at(nodeIndex);
+    NodeType op = node.op;
+
+    unsigned refCount = node.refCount;
+    if (!refCount)
+        return;
+    bool mustGenerate = node.mustGenerate();
+    if (mustGenerate)
+        --refCount;
+
+    // Example/explanation of dataflow dump output
+    //
+    //   14:   <!2:7>  GetByVal(@3, @13)
+    //   ^1     ^2 ^3     ^4       ^5
+    //
+    // (1) The nodeIndex of this operation.
+    // (2) The reference count. The number printed is the 'real' count,
+    //     not including the 'mustGenerate' ref. If the node is
+    //     'mustGenerate' then the count it prefixed with '!'.
+    // (3) The virtual register slot assigned to this node.
+    // (4) The name of the operation.
+    // (5) The arguments to the operation. The may be of the form:
+    //         @#   - a NodeIndex referencing a prior node in the graph.
+    //         arg# - an argument number.
+    //         $#   - the index in the CodeBlock of a constant { for numeric constants the value is displayed | for integers, in both decimal and hex }.
+    //         id#  - the index in the CodeBlock of an identifier { if codeBlock is passed to dump(), the string representation is displayed }.
+    //         var# - the index of a var on the global object, used by GetGlobalVar/PutGlobalVar operations.
+    printf("% 4d:\t<%c%u:%u>\t%s(", (int)nodeIndex, mustGenerate ? '!' : ' ', refCount, node.virtualRegister, dfgOpNames[op & NodeIdMask]);
+    if (node.child1 != NoNode)
+        printf("@%u", node.child1);
+    if (node.child2 != NoNode)
+        printf(", @%u", node.child2);
+    if (node.child3 != NoNode)
+        printf(", @%u", node.child3);
+    bool hasPrinted = node.child1 != NoNode;
+
+    if (node.hasVarNumber()) {
+        printf("%svar%u", hasPrinted ? ", " : "", node.varNumber());
+        hasPrinted = true;
+    }
+    if (node.hasIdentifier()) {
+        if (codeBlock)
+            printf("%sid%u{%s}", hasPrinted ? ", " : "", node.identifierNumber(), codeBlock->identifier(node.identifierNumber()).ustring().utf8().data());
+        else
+            printf("%sid%u", hasPrinted ? ", " : "", node.identifierNumber());
+        hasPrinted = true;
+    }
+    if (node.hasLocal()) {
+        int local = node.local();
+        if (local < 0)
+            printf("%sarg%u", hasPrinted ? ", " : "", local - codeBlock->thisRegister());
+        else
+            printf("%sr%u", hasPrinted ? ", " : "", local);
+        hasPrinted = true;
+    }
+    if (op == Int32Constant) {
+        printf("%s$%u{%d|0x%08x}", hasPrinted ? ", " : "", node.constantNumber(), node.int32Constant(), node.int32Constant());
+        hasPrinted = true;
+    }
+    if (op == DoubleConstant) {
+        printf("%s$%u{%f})", hasPrinted ? ", " : "", node.constantNumber(), node.numericConstant());
+        hasPrinted = true;
+    }
+    if (op == JSConstant) {
+        printf("%s$%u", hasPrinted ? ", " : "", node.constantNumber());
+        hasPrinted = true;
+    }
+    if  (node.isBranch() || node.isJump()) {
+        printf("%sT:#%u", hasPrinted ? ", " : "", blockIndexForBytecodeOffset(node.takenBytecodeOffset()));
+        hasPrinted = true;
+    }
+    if  (node.isBranch()) {
+        printf("%sF:#%u", hasPrinted ? ", " : "", blockIndexForBytecodeOffset(node.notTakenBytecodeOffset()));
+        hasPrinted = true;
+    }
+
+    printf(")\n");
+}
+
+void Graph::dump(CodeBlock* codeBlock)
+{
+    for (size_t b = 0; b < m_blocks.size(); ++b) {
+        printf("Block #%u:\n", (int)b);
+        BasicBlock& block = m_blocks[b];
+        for (size_t i = block.begin; i < block.end; ++i)
+            dump(i, codeBlock);
+    }
+}
+
+#endif
+
+// FIXME: Convert these methods to be iterative, not recursive.
+void Graph::refChildren(NodeIndex op)
+{
+    Node& node = at(op);
+
+    if (node.child1 == NoNode) {
+        ASSERT(node.child2 == NoNode && node.child3 == NoNode);
+        return;
+    }
+    ref(node.child1);
+
+    if (node.child2 == NoNode) {
+        ASSERT(node.child3 == NoNode);
+        return;
+    }
+    ref(node.child2);
+
+    if (node.child3 == NoNode)
+        return;
+    ref(node.child3);
+}
+void Graph::derefChildren(NodeIndex op)
+{
+    Node& node = at(op);
+
+    if (node.child1 == NoNode) {
+        ASSERT(node.child2 == NoNode && node.child3 == NoNode);
+        return;
+    }
+    deref(node.child1);
+
+    if (node.child2 == NoNode) {
+        ASSERT(node.child3 == NoNode);
+        return;
+    }
+    deref(node.child2);
+
+    if (node.child3 == NoNode)
+        return;
+    deref(node.child3);
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
new file mode 100644
index 0000000..c6bc7df
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGGraph_h
+#define DFGGraph_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGNode.h>
+#include <wtf/Vector.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+class CodeBlock;
+
+namespace DFG {
+
+typedef uint32_t BlockIndex;
+
+struct BasicBlock {
+    BasicBlock(unsigned bytecodeBegin, NodeIndex begin, NodeIndex end)
+        : bytecodeBegin(bytecodeBegin)
+        , begin(begin)
+        , end(end)
+    {
+    }
+
+    static inline BlockIndex getBytecodeBegin(BasicBlock* block)
+    {
+        return block->bytecodeBegin;
+    }
+
+    unsigned bytecodeBegin;
+    NodeIndex begin;
+    NodeIndex end;
+};
+
+// 
+// === Graph ===
+//
+// The dataflow graph is an ordered vector of nodes.
+// The order may be significant for nodes with side-effects (property accesses, value conversions).
+// Nodes that are 'dead' remain in the vector with refCount 0.
+class Graph : public Vector<Node, 64> {
+public:
+    // Mark a node as being referenced.
+    void ref(NodeIndex nodeIndex)
+    {
+        Node& node = at(nodeIndex);
+        // If the value (before incrementing) was at refCount zero then we need to ref its children.
+        if (!node.refCount++)
+            refChildren(nodeIndex);
+    }
+    void deref(NodeIndex nodeIndex)
+    {
+        Node& node = at(nodeIndex);
+        ASSERT(node.refCount);
+        // If the value (after decrementing) becomes refCount zero then we need to deref its children.
+        if (!--node.refCount)
+            derefChildren(nodeIndex);
+    }
+
+#ifndef NDEBUG
+    // CodeBlock is optional, but may allow additional information to be dumped (e.g. Identifier names).
+    void dump(CodeBlock* = 0);
+    void dump(NodeIndex, CodeBlock* = 0);
+#endif
+
+    Vector<BasicBlock> m_blocks;
+
+    BlockIndex blockIndexForBytecodeOffset(unsigned bytecodeBegin)
+    {
+        BasicBlock* begin = m_blocks.begin();
+        BasicBlock* block = binarySearch<BasicBlock, unsigned, BasicBlock::getBytecodeBegin>(begin, m_blocks.size(), bytecodeBegin);
+        ASSERT(block >= m_blocks.begin() && block < m_blocks.end());
+        return static_cast<BlockIndex>(block - begin);
+    }
+
+private:
+    // When a node's refCount goes from 0 to 1, it must (logically) recursively ref all of its children, and vice versa.
+    void refChildren(NodeIndex);
+    void derefChildren(NodeIndex);
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp b/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp
new file mode 100644
index 0000000..52e0abe
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp
@@ -0,0 +1,558 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGJITCodeGenerator.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNonSpeculativeJIT.h"
+#include "DFGSpeculativeJIT.h"
+#include "LinkBuffer.h"
+
+namespace JSC { namespace DFG {
+
+GPRReg JITCodeGenerator::fillInteger(NodeIndex nodeIndex, DataFormat& returnFormat)
+{
+    Node& node = m_jit.graph()[nodeIndex];
+    VirtualRegister virtualRegister = node.virtualRegister;
+    GenerationInfo& info = m_generationInfo[virtualRegister];
+
+    if (info.registerFormat() == DataFormatNone) {
+        GPRReg gpr = allocate();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+
+        if (node.isConstant()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            if (isInt32Constant(nodeIndex)) {
+                m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), reg);
+                info.fillInteger(gpr);
+                returnFormat = DataFormatInteger;
+                return gpr;
+            }
+            if (isDoubleConstant(nodeIndex)) {
+                JSValue jsValue = jsNumber(valueOfDoubleConstant(nodeIndex));
+                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
+            } else {
+                ASSERT(isJSConstant(nodeIndex));
+                JSValue jsValue = valueOfJSConstant(nodeIndex);
+                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
+            }
+        } else {
+            ASSERT(info.spillFormat() == DataFormatJS || info.spillFormat() == DataFormatJSInteger);
+            m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
+        }
+
+        // Since we statically know that we're filling an integer, and values
+        // in the RegisterFile are boxed, this must be DataFormatJSInteger.
+        // We will check this with a jitAssert below.
+        info.fillJSValue(gpr, DataFormatJSInteger);
+        unlock(gpr);
+    }
+
+    switch (info.registerFormat()) {
+    case DataFormatNone:
+        // Should have filled, above.
+    case DataFormatJSDouble:
+    case DataFormatDouble:
+    case DataFormatJS:
+    case DataFormatCell:
+    case DataFormatJSCell:
+        // Should only be calling this function if we know this operand to be integer.
+        ASSERT_NOT_REACHED();
+
+    case DataFormatJSInteger: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        m_jit.jitAssertIsJSInt32(gpr);
+        returnFormat = DataFormatJSInteger;
+        return gpr;
+    }
+
+    case DataFormatInteger: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        m_jit.jitAssertIsInt32(gpr);
+        returnFormat = DataFormatInteger;
+        return gpr;
+    }
+    }
+
+    ASSERT_NOT_REACHED();
+    return InvalidGPRReg;
+}
+
+FPRReg JITCodeGenerator::fillDouble(NodeIndex nodeIndex)
+{
+    Node& node = m_jit.graph()[nodeIndex];
+    VirtualRegister virtualRegister = node.virtualRegister;
+    GenerationInfo& info = m_generationInfo[virtualRegister];
+
+    if (info.registerFormat() == DataFormatNone) {
+        GPRReg gpr = allocate();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+
+        if (node.isConstant()) {
+            if (isInt32Constant(nodeIndex)) {
+                // FIXME: should not be reachable?
+                m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), reg);
+                m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+                info.fillInteger(gpr);
+                unlock(gpr);
+            } else if (isDoubleConstant(nodeIndex)) {
+                FPRReg fpr = fprAllocate();
+                m_jit.move(MacroAssembler::ImmPtr(reinterpret_cast<void*>(reinterpretDoubleToIntptr(valueOfDoubleConstant(nodeIndex)))), reg);
+                m_jit.movePtrToDouble(reg, JITCompiler::fprToRegisterID(fpr));
+                unlock(gpr);
+
+                m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
+                info.fillDouble(fpr);
+                return fpr;
+            } else {
+                // FIXME: should not be reachable?
+                ASSERT(isJSConstant(nodeIndex));
+                JSValue jsValue = valueOfJSConstant(nodeIndex);
+                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
+                m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+                info.fillJSValue(gpr, DataFormatJS);
+                unlock(gpr);
+            }
+        } else {
+            DataFormat spillFormat = info.spillFormat();
+            ASSERT(spillFormat & DataFormatJS);
+            m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
+            info.fillJSValue(gpr, m_isSpeculative ? spillFormat : DataFormatJS);
+            unlock(gpr);
+        }
+    }
+
+    switch (info.registerFormat()) {
+    case DataFormatNone:
+        // Should have filled, above.
+    case DataFormatCell:
+    case DataFormatJSCell:
+        // Should only be calling this function if we know this operand to be numeric.
+        ASSERT_NOT_REACHED();
+
+    case DataFormatJS: {
+        GPRReg jsValueGpr = info.gpr();
+        m_gprs.lock(jsValueGpr);
+        FPRReg fpr = fprAllocate();
+        GPRReg tempGpr = allocate(); // FIXME: can we skip this allocation on the last use of the virtual register?
+
+        JITCompiler::RegisterID jsValueReg = JITCompiler::gprToRegisterID(jsValueGpr);
+        JITCompiler::FPRegisterID fpReg = JITCompiler::fprToRegisterID(fpr);
+        JITCompiler::RegisterID tempReg = JITCompiler::gprToRegisterID(tempGpr);
+
+        JITCompiler::Jump isInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, jsValueReg, JITCompiler::tagTypeNumberRegister);
+
+        m_jit.jitAssertIsJSDouble(jsValueGpr);
+
+        // First, if we get here we have a double encoded as a JSValue
+        m_jit.move(jsValueReg, tempReg);
+        m_jit.addPtr(JITCompiler::tagTypeNumberRegister, tempReg);
+        m_jit.movePtrToDouble(tempReg, fpReg);
+        JITCompiler::Jump hasUnboxedDouble = m_jit.jump();
+
+        // Finally, handle integers.
+        isInteger.link(&m_jit);
+        m_jit.convertInt32ToDouble(jsValueReg, fpReg);
+        hasUnboxedDouble.link(&m_jit);
+
+        m_gprs.release(jsValueGpr);
+        m_gprs.unlock(jsValueGpr);
+        m_gprs.unlock(tempGpr);
+        m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
+        info.fillDouble(fpr);
+        return fpr;
+    }
+
+    case DataFormatJSInteger:
+    case DataFormatInteger: {
+        FPRReg fpr = fprAllocate();
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+        JITCompiler::FPRegisterID fpReg = JITCompiler::fprToRegisterID(fpr);
+
+        m_jit.convertInt32ToDouble(reg, fpReg);
+
+        m_gprs.release(gpr);
+        m_gprs.unlock(gpr);
+        m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
+        info.fillDouble(fpr);
+        return fpr;
+    }
+
+    // Unbox the double
+    case DataFormatJSDouble: {
+        GPRReg gpr = info.gpr();
+        FPRReg fpr = unboxDouble(gpr);
+
+        m_gprs.release(gpr);
+        m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
+
+        info.fillDouble(fpr);
+        return fpr;
+    }
+
+    case DataFormatDouble: {
+        FPRReg fpr = info.fpr();
+        m_fprs.lock(fpr);
+        return fpr;
+    }
+    }
+
+    ASSERT_NOT_REACHED();
+    return InvalidFPRReg;
+}
+
+GPRReg JITCodeGenerator::fillJSValue(NodeIndex nodeIndex)
+{
+    Node& node = m_jit.graph()[nodeIndex];
+    VirtualRegister virtualRegister = node.virtualRegister;
+    GenerationInfo& info = m_generationInfo[virtualRegister];
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        GPRReg gpr = allocate();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+
+        if (node.isConstant()) {
+            if (isInt32Constant(nodeIndex)) {
+                info.fillJSValue(gpr, DataFormatJSInteger);
+                JSValue jsValue = jsNumber(valueOfInt32Constant(nodeIndex));
+                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
+            } else if (isDoubleConstant(nodeIndex)) {
+                info.fillJSValue(gpr, DataFormatJSDouble);
+                JSValue jsValue(JSValue::EncodeAsDouble, valueOfDoubleConstant(nodeIndex));
+                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
+            } else {
+                ASSERT(isJSConstant(nodeIndex));
+                JSValue jsValue = valueOfJSConstant(nodeIndex);
+                m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), reg);
+                info.fillJSValue(gpr, DataFormatJS);
+            }
+
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+        } else {
+            DataFormat spillFormat = info.spillFormat();
+            ASSERT(spillFormat & DataFormatJS);
+            m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
+            info.fillJSValue(gpr, m_isSpeculative ? spillFormat : DataFormatJS);
+        }
+        return gpr;
+    }
+
+    case DataFormatInteger: {
+        GPRReg gpr = info.gpr();
+        // If the register has already been locked we need to take a copy.
+        // If not, we'll zero extend in place, so mark on the info that this is now type DataFormatInteger, not DataFormatJSInteger.
+        if (m_gprs.isLocked(gpr)) {
+            GPRReg result = allocate();
+            m_jit.orPtr(JITCompiler::tagTypeNumberRegister, JITCompiler::gprToRegisterID(gpr), JITCompiler::gprToRegisterID(result));
+            return result;
+        }
+        m_gprs.lock(gpr);
+        m_jit.orPtr(JITCompiler::tagTypeNumberRegister, JITCompiler::gprToRegisterID(gpr));
+        info.fillJSValue(gpr, DataFormatJSInteger);
+        return gpr;
+    }
+
+    case DataFormatDouble: {
+        FPRReg fpr = info.fpr();
+        GPRReg gpr = boxDouble(fpr);
+
+        // Update all info
+        info.fillJSValue(gpr, DataFormatJSDouble);
+        m_fprs.release(fpr);
+        m_gprs.retain(gpr, virtualRegister, SpillOrderJS);
+
+        return gpr;
+    }
+
+    case DataFormatCell:
+        // No retag required on JSVALUE64!
+    case DataFormatJS:
+    case DataFormatJSInteger:
+    case DataFormatJSDouble:
+    case DataFormatJSCell: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        return gpr;
+    }
+    }
+
+    ASSERT_NOT_REACHED();
+    return InvalidGPRReg;
+}
+
+void JITCodeGenerator::useChildren(Node& node)
+{
+    NodeIndex child1 = node.child1;
+    if (child1 == NoNode) {
+        ASSERT(node.child2 == NoNode && node.child3 == NoNode);
+        return;
+    }
+    use(child1);
+
+    NodeIndex child2 = node.child2;
+    if (child2 == NoNode) {
+        ASSERT(node.child3 == NoNode);
+        return;
+    }
+    use(child2);
+
+    NodeIndex child3 = node.child3;
+    if (child3 == NoNode)
+        return;
+    use(child3);
+}
+
+#ifndef NDEBUG
+static const char* dataFormatString(DataFormat format)
+{
+    // These values correspond to the DataFormat enum.
+    const char* strings[] = {
+        "[  ]",
+        "[ i]",
+        "[ d]",
+        "[ c]",
+        "Err!",
+        "Err!",
+        "Err!",
+        "Err!",
+        "[J ]",
+        "[Ji]",
+        "[Jd]",
+        "[Jc]",
+        "Err!",
+        "Err!",
+        "Err!",
+        "Err!",
+    };
+    return strings[format];
+}
+
+void JITCodeGenerator::dump(const char* label)
+{
+    if (label)
+        fprintf(stderr, "<%s>\n", label);
+
+    fprintf(stderr, "  gprs:\n");
+    m_gprs.dump();
+    fprintf(stderr, "  fprs:\n");
+    m_fprs.dump();
+    fprintf(stderr, "  VirtualRegisters:\n");
+    for (unsigned i = 0; i < m_generationInfo.size(); ++i) {
+        GenerationInfo& info = m_generationInfo[i];
+        if (info.alive())
+            fprintf(stderr, "    % 3d:%s%s\n", i, dataFormatString(info.registerFormat()), dataFormatString(info.spillFormat()));
+        else
+            fprintf(stderr, "    % 3d:[__][__]\n", i);
+    }
+    if (label)
+        fprintf(stderr, "</%s>\n", label);
+}
+#endif
+
+
+#if DFG_CONSISTENCY_CHECK
+void JITCodeGenerator::checkConsistency()
+{
+    VirtualRegister grpContents[numberOfGPRs];
+    VirtualRegister frpContents[numberOfFPRs];
+
+    for (unsigned i = 0; i < numberOfGPRs; ++i)
+        grpContents[i] = InvalidVirtualRegister;
+    for (unsigned i = 0; i < numberOfFPRs; ++i)
+        frpContents[i] = InvalidVirtualRegister;
+    for (unsigned i = 0; i < m_generationInfo.size(); ++i) {
+        GenerationInfo& info = m_generationInfo[i];
+        if (!info.alive())
+            continue;
+        switch (info.registerFormat()) {
+        case DataFormatNone:
+            break;
+        case DataFormatInteger:
+        case DataFormatCell:
+        case DataFormatJS:
+        case DataFormatJSInteger:
+        case DataFormatJSDouble:
+        case DataFormatJSCell: {
+            GPRReg gpr = info.gpr();
+            ASSERT(gpr != InvalidGPRReg);
+            grpContents[gpr] = (VirtualRegister)i;
+            break;
+        }
+        case DataFormatDouble: {
+            FPRReg fpr = info.fpr();
+            ASSERT(fpr != InvalidFPRReg);
+            frpContents[fpr] = (VirtualRegister)i;
+            break;
+        }
+        }
+    }
+
+    for (GPRReg i = gpr0; i < numberOfGPRs; next(i)) {
+        if (m_gprs.isLocked(i) || m_gprs.name(i) != grpContents[i]) {
+            dump();
+            CRASH();
+        }
+    }
+    for (FPRReg i = fpr0; i < numberOfFPRs; next(i)) {
+        if (m_fprs.isLocked(i) || m_fprs.name(i) != frpContents[i]) {
+            dump();
+            CRASH();
+        }
+    }
+}
+#endif
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit, SpeculateIntegerOperand& op1)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.gpr();
+    if (m_jit->canReuse(op1.index()))
+        m_gpr = m_jit->reuse(op1.gpr());
+    else
+        m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit, SpeculateIntegerOperand& op1, SpeculateIntegerOperand& op2)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.gpr();
+    op2.gpr();
+    if (m_jit->canReuse(op1.index()))
+        m_gpr = m_jit->reuse(op1.gpr());
+    else if (m_jit->canReuse(op2.index()))
+        m_gpr = m_jit->reuse(op2.gpr());
+    else
+        m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit, IntegerOperand& op1)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.gpr();
+    if (m_jit->canReuse(op1.index()))
+        m_gpr = m_jit->reuse(op1.gpr());
+    else
+        m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit, IntegerOperand& op1, IntegerOperand& op2)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.gpr();
+    op2.gpr();
+    if (m_jit->canReuse(op1.index()))
+        m_gpr = m_jit->reuse(op1.gpr());
+    else if (m_jit->canReuse(op2.index()))
+        m_gpr = m_jit->reuse(op2.gpr());
+    else
+        m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit, SpeculateCellOperand& op1)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.gpr();
+    if (m_jit->canReuse(op1.index()))
+        m_gpr = m_jit->reuse(op1.gpr());
+    else
+        m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(JITCodeGenerator* jit, JSValueOperand& op1)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.gpr();
+    if (m_jit->canReuse(op1.index()))
+        m_gpr = m_jit->reuse(op1.gpr());
+    else
+        m_gpr = m_jit->allocate();
+}
+
+FPRTemporary::FPRTemporary(JITCodeGenerator* jit)
+    : m_jit(jit)
+    , m_fpr(InvalidFPRReg)
+{
+    m_fpr = m_jit->fprAllocate();
+}
+
+FPRTemporary::FPRTemporary(JITCodeGenerator* jit, DoubleOperand& op1)
+    : m_jit(jit)
+    , m_fpr(InvalidFPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.fpr();
+    if (m_jit->canReuse(op1.index()))
+        m_fpr = m_jit->reuse(op1.fpr());
+    else
+        m_fpr = m_jit->fprAllocate();
+}
+
+FPRTemporary::FPRTemporary(JITCodeGenerator* jit, DoubleOperand& op1, DoubleOperand& op2)
+    : m_jit(jit)
+    , m_fpr(InvalidFPRReg)
+{
+    // locking into a register may free for reuse!
+    op1.fpr();
+    op2.fpr();
+    if (m_jit->canReuse(op1.index()))
+        m_fpr = m_jit->reuse(op1.fpr());
+    else if (m_jit->canReuse(op2.index()))
+        m_fpr = m_jit->reuse(op2.fpr());
+    else
+        m_fpr = m_jit->fprAllocate();
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h b/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h
new file mode 100644
index 0000000..0abd3c7
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.h
@@ -0,0 +1,998 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGJITCodeGenerator_h
+#define DFGJITCodeGenerator_h
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include <dfg/DFGGenerationInfo.h>
+#include <dfg/DFGGraph.h>
+#include <dfg/DFGJITCompiler.h>
+#include <dfg/DFGOperations.h>
+#include <dfg/DFGRegisterBank.h>
+
+namespace JSC { namespace DFG {
+
+class SpeculateIntegerOperand;
+class SpeculateStrictInt32Operand;
+class SpeculateCellOperand;
+
+
+// === JITCodeGenerator ===
+//
+// This class provides common infrastructure used by the speculative &
+// non-speculative JITs. Provides common mechanisms for virtual and
+// physical register management, calls out from JIT code to helper
+// functions, etc.
+class JITCodeGenerator {
+protected:
+    typedef MacroAssembler::TrustedImm32 TrustedImm32;
+    typedef MacroAssembler::Imm32 Imm32;
+
+    // These constants are used to set priorities for spill order for
+    // the register allocator.
+    enum SpillOrder {
+        SpillOrderNone,
+        SpillOrderConstant = 1, // no spill, and cheap fill
+        SpillOrderSpilled = 2,  // no spill
+        SpillOrderJS = 4,       // needs spill
+        SpillOrderCell = 4,     // needs spill
+        SpillOrderInteger = 5,  // needs spill and box
+        SpillOrderDouble = 6,   // needs spill and convert
+        SpillOrderMax
+    };
+
+
+public:
+    GPRReg fillInteger(NodeIndex, DataFormat& returnFormat);
+    FPRReg fillDouble(NodeIndex);
+    GPRReg fillJSValue(NodeIndex);
+
+    // lock and unlock GPR & FPR registers.
+    void lock(GPRReg reg)
+    {
+        m_gprs.lock(reg);
+    }
+    void lock(FPRReg reg)
+    {
+        m_fprs.lock(reg);
+    }
+    void unlock(GPRReg reg)
+    {
+        m_gprs.unlock(reg);
+    }
+    void unlock(FPRReg reg)
+    {
+        m_fprs.unlock(reg);
+    }
+
+    // Used to check whether a child node is on its last use,
+    // and its machine registers may be reused.
+    bool canReuse(NodeIndex nodeIndex)
+    {
+        VirtualRegister virtualRegister = m_jit.graph()[nodeIndex].virtualRegister;
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        return info.canReuse();
+    }
+    GPRReg reuse(GPRReg reg)
+    {
+        m_gprs.lock(reg);
+        return reg;
+    }
+    FPRReg reuse(FPRReg reg)
+    {
+        m_fprs.lock(reg);
+        return reg;
+    }
+
+    // Allocate a gpr/fpr.
+    GPRReg allocate()
+    {
+        VirtualRegister spillMe;
+        GPRReg gpr = m_gprs.allocate(spillMe);
+        if (spillMe != InvalidVirtualRegister)
+            spill(spillMe);
+        return gpr;
+    }
+    FPRReg fprAllocate()
+    {
+        VirtualRegister spillMe;
+        FPRReg fpr = m_fprs.allocate(spillMe);
+        if (spillMe != InvalidVirtualRegister)
+            spill(spillMe);
+        return fpr;
+    }
+
+    // Check whether a VirtualRegsiter is currently in a machine register.
+    // We use this when filling operands to fill those that are already in
+    // machine registers first (by locking VirtualRegsiters that are already
+    // in machine register before filling those that are not we attempt to
+    // avoid spilling values we will need immediately).
+    bool isFilled(NodeIndex nodeIndex)
+    {
+        VirtualRegister virtualRegister = m_jit.graph()[nodeIndex].virtualRegister;
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        return info.registerFormat() != DataFormatNone;
+    }
+    bool isFilledDouble(NodeIndex nodeIndex)
+    {
+        VirtualRegister virtualRegister = m_jit.graph()[nodeIndex].virtualRegister;
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        return info.registerFormat() == DataFormatDouble;
+    }
+
+protected:
+    JITCodeGenerator(JITCompiler& jit, bool isSpeculative)
+        : m_jit(jit)
+        , m_isSpeculative(isSpeculative)
+        , m_compileIndex(0)
+        , m_generationInfo(m_jit.codeBlock()->m_numCalleeRegisters)
+        , m_blockHeads(jit.graph().m_blocks.size())
+    {
+    }
+
+    // These methods convert between doubles, and doubles boxed and JSValues.
+    GPRReg boxDouble(FPRReg fpr, GPRReg gpr)
+    {
+        JITCompiler::FPRegisterID fpReg = JITCompiler::fprToRegisterID(fpr);
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+        m_jit.moveDoubleToPtr(fpReg, reg);
+        m_jit.subPtr(JITCompiler::tagTypeNumberRegister, reg);
+        return gpr;
+    }
+    FPRReg unboxDouble(GPRReg gpr, FPRReg fpr)
+    {
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+        JITCompiler::FPRegisterID fpReg = JITCompiler::fprToRegisterID(fpr);
+        m_jit.addPtr(JITCompiler::tagTypeNumberRegister, reg);
+        m_jit.movePtrToDouble(reg, fpReg);
+        return fpr;
+    }
+    GPRReg boxDouble(FPRReg fpr)
+    {
+        return boxDouble(fpr, allocate());
+    }
+    FPRReg unboxDouble(GPRReg gpr)
+    {
+        return unboxDouble(gpr, fprAllocate());
+    }
+
+    // Called on an operand once it has been consumed by a parent node.
+    void use(NodeIndex nodeIndex)
+    {
+        VirtualRegister virtualRegister = m_jit.graph()[nodeIndex].virtualRegister;
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+
+        // use() returns true when the value becomes dead, and any
+        // associated resources may be freed.
+        if (!info.use())
+            return;
+
+        // Release the associated machine registers.
+        DataFormat registerFormat = info.registerFormat();
+        if (registerFormat == DataFormatDouble)
+            m_fprs.release(info.fpr());
+        else if (registerFormat != DataFormatNone)
+            m_gprs.release(info.gpr());
+    }
+
+    // Spill a VirtualRegister to the RegisterFile.
+    void spill(VirtualRegister spillMe)
+    {
+        GenerationInfo& info = m_generationInfo[spillMe];
+
+        // Check the GenerationInfo to see if this value need writing
+        // to the RegisterFile - if not, mark it as spilled & return.
+        if (!info.needsSpill()) {
+            info.setSpilled();
+            return;
+        }
+
+        DataFormat spillFormat = info.registerFormat();
+        if (spillFormat == DataFormatDouble) {
+            // All values are spilled as JSValues, so box the double via a temporary gpr.
+            GPRReg gpr = boxDouble(info.fpr());
+            m_jit.storePtr(JITCompiler::gprToRegisterID(gpr), JITCompiler::addressFor(spillMe));
+            unlock(gpr);
+            info.spill(DataFormatJSDouble);
+            return;
+        }
+
+        // The following code handles JSValues, int32s, and cells.
+        ASSERT(spillFormat == DataFormatInteger || spillFormat == DataFormatCell || spillFormat & DataFormatJS);
+
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
+        // We need to box int32 and cell values ...
+        // but on JSVALUE64 boxing a cell is a no-op!
+        if (spillFormat == DataFormatInteger)
+            m_jit.orPtr(JITCompiler::tagTypeNumberRegister, reg);
+
+        // Spill the value, and record it as spilled in its boxed form.
+        m_jit.storePtr(reg, JITCompiler::addressFor(spillMe));
+        info.spill((DataFormat)(spillFormat | DataFormatJS));
+    }
+
+    // Checks/accessors for constant values.
+    bool isConstant(NodeIndex nodeIndex) { return m_jit.isConstant(nodeIndex); }
+    bool isInt32Constant(NodeIndex nodeIndex) { return m_jit.isInt32Constant(nodeIndex); }
+    bool isDoubleConstant(NodeIndex nodeIndex) { return m_jit.isDoubleConstant(nodeIndex); }
+    bool isJSConstant(NodeIndex nodeIndex) { return m_jit.isJSConstant(nodeIndex); }
+    int32_t valueOfInt32Constant(NodeIndex nodeIndex) { return m_jit.valueOfInt32Constant(nodeIndex); }
+    double valueOfDoubleConstant(NodeIndex nodeIndex) { return m_jit.valueOfDoubleConstant(nodeIndex); }
+    JSValue valueOfJSConstant(NodeIndex nodeIndex) { return m_jit.valueOfJSConstant(nodeIndex); }
+
+    Identifier* identifier(unsigned index)
+    {
+        return &m_jit.codeBlock()->identifier(index);
+    }
+
+    // Spill all VirtualRegisters back to the RegisterFile.
+    void flushRegisters()
+    {
+        for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+            VirtualRegister name = m_gprs.name(gpr);
+            if (name != InvalidVirtualRegister) {
+                spill(name);
+                m_gprs.release(gpr);
+            }
+        }
+        for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+            VirtualRegister name = m_fprs.name(fpr);
+            if (name != InvalidVirtualRegister) {
+                spill(name);
+                m_fprs.release(fpr);
+            }
+        }
+    }
+
+#ifndef NDEBUG
+    // Used to ASSERT flushRegisters() has been called prior to
+    // calling out from JIT code to a C helper function.
+    bool isFlushed()
+    {
+        for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+            VirtualRegister name = m_gprs.name(gpr);
+            if (name != InvalidVirtualRegister)
+                return false;
+        }
+        for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+            VirtualRegister name = m_fprs.name(fpr);
+            if (name != InvalidVirtualRegister)
+                return false;
+        }
+        return true;
+    }
+#endif
+
+    // Get the JSValue representation of a constant.
+    JSValue constantAsJSValue(NodeIndex nodeIndex)
+    {
+        Node& node = m_jit.graph()[nodeIndex];
+        if (isInt32Constant(nodeIndex))
+            return jsNumber(node.int32Constant());
+        if (isDoubleConstant(nodeIndex))
+            return JSValue(JSValue::EncodeAsDouble, node.numericConstant());
+        ASSERT(isJSConstant(nodeIndex));
+        return valueOfJSConstant(nodeIndex);
+    }
+    MacroAssembler::ImmPtr constantAsJSValueAsImmPtr(NodeIndex nodeIndex)
+    {
+        return MacroAssembler::ImmPtr(JSValue::encode(constantAsJSValue(nodeIndex)));
+    }
+
+    // Helper functions to enable code sharing in implementations of bit/shift ops.
+    void bitOp(NodeType op, int32_t imm, MacroAssembler::RegisterID op1, MacroAssembler::RegisterID result)
+    {
+        switch (op) {
+        case BitAnd:
+            m_jit.and32(Imm32(imm), op1, result);
+            break;
+        case BitOr:
+            m_jit.or32(Imm32(imm), op1, result);
+            break;
+        case BitXor:
+            m_jit.xor32(Imm32(imm), op1, result);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+    void bitOp(NodeType op, MacroAssembler::RegisterID op1, MacroAssembler::RegisterID op2, MacroAssembler::RegisterID result)
+    {
+        switch (op) {
+        case BitAnd:
+            m_jit.and32(op1, op2, result);
+            break;
+        case BitOr:
+            m_jit.or32(op1, op2, result);
+            break;
+        case BitXor:
+            m_jit.xor32(op1, op2, result);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+    void shiftOp(NodeType op, MacroAssembler::RegisterID op1, int32_t shiftAmount, MacroAssembler::RegisterID result)
+    {
+        switch (op) {
+        case BitRShift:
+            m_jit.rshift32(op1, Imm32(shiftAmount), result);
+            break;
+        case BitLShift:
+            m_jit.lshift32(op1, Imm32(shiftAmount), result);
+            break;
+        case BitURShift:
+            m_jit.urshift32(op1, Imm32(shiftAmount), result);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+    void shiftOp(NodeType op, MacroAssembler::RegisterID op1, MacroAssembler::RegisterID shiftAmount, MacroAssembler::RegisterID result)
+    {
+        switch (op) {
+        case BitRShift:
+            m_jit.rshift32(op1, shiftAmount, result);
+            break;
+        case BitLShift:
+            m_jit.lshift32(op1, shiftAmount, result);
+            break;
+        case BitURShift:
+            m_jit.urshift32(op1, shiftAmount, result);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    // Called once a node has completed code generation but prior to setting
+    // its result, to free up its children. (This must happen prior to setting
+    // the nodes result, since the node may have the same VirtualRegister as
+    // a child, and as such will use the same GeneratioInfo).
+    void useChildren(Node&);
+
+    // These method called to initialize the the GenerationInfo
+    // to describe the result of an operation.
+    void integerResult(GPRReg reg, NodeIndex nodeIndex, DataFormat format = DataFormatInteger)
+    {
+        Node& node = m_jit.graph()[nodeIndex];
+        useChildren(node);
+
+        VirtualRegister virtualRegister = node.virtualRegister;
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+
+        if (format == DataFormatInteger) {
+            m_jit.jitAssertIsInt32(reg);
+            m_gprs.retain(reg, virtualRegister, SpillOrderInteger);
+            info.initInteger(nodeIndex, node.refCount, reg);
+        } else {
+            ASSERT(format == DataFormatJSInteger);
+            m_jit.jitAssertIsJSInt32(reg);
+            m_gprs.retain(reg, virtualRegister, SpillOrderJS);
+            info.initJSValue(nodeIndex, node.refCount, reg, format);
+        }
+    }
+    void noResult(NodeIndex nodeIndex)
+    {
+        Node& node = m_jit.graph()[nodeIndex];
+        useChildren(node);
+
+        VirtualRegister virtualRegister = node.virtualRegister;
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        info.initNone(nodeIndex, node.refCount);
+    }
+    void cellResult(GPRReg reg, NodeIndex nodeIndex)
+    {
+        Node& node = m_jit.graph()[nodeIndex];
+        useChildren(node);
+
+        VirtualRegister virtualRegister = node.virtualRegister;
+        m_gprs.retain(reg, virtualRegister, SpillOrderCell);
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        info.initCell(nodeIndex, node.refCount, reg);
+    }
+    void jsValueResult(GPRReg reg, NodeIndex nodeIndex, DataFormat format = DataFormatJS)
+    {
+        if (format == DataFormatJSInteger)
+            m_jit.jitAssertIsJSInt32(reg);
+        
+        Node& node = m_jit.graph()[nodeIndex];
+        useChildren(node);
+
+        VirtualRegister virtualRegister = node.virtualRegister;
+        m_gprs.retain(reg, virtualRegister, SpillOrderJS);
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        info.initJSValue(nodeIndex, node.refCount, reg, format);
+    }
+    void doubleResult(FPRReg reg, NodeIndex nodeIndex)
+    {
+        Node& node = m_jit.graph()[nodeIndex];
+        useChildren(node);
+
+        VirtualRegister virtualRegister = node.virtualRegister;
+        m_fprs.retain(reg, virtualRegister, SpillOrderDouble);
+        GenerationInfo& info = m_generationInfo[virtualRegister];
+        info.initDouble(nodeIndex, node.refCount, reg);
+    }
+    void initConstantInfo(NodeIndex nodeIndex)
+    {
+        ASSERT(isInt32Constant(nodeIndex) || isDoubleConstant(nodeIndex) || isJSConstant(nodeIndex));
+        Node& node = m_jit.graph()[nodeIndex];
+        m_generationInfo[node.virtualRegister].initConstant(nodeIndex, node.refCount);
+    }
+
+    // These methods used to sort arguments into the correct registers.
+    template<GPRReg destA, GPRReg destB>
+    void setupTwoStubArgs(GPRReg srcA, GPRReg srcB)
+    {
+        // Assuming that srcA != srcB, there are 7 interesting states the registers may be in:
+        // (1) both are already in arg regs, the right way around.
+        // (2) both are already in arg regs, the wrong way around.
+        // (3) neither are currently in arg registers.
+        // (4) srcA in in its correct reg.
+        // (5) srcA in in the incorrect reg.
+        // (6) srcB in in its correct reg.
+        // (7) srcB in in the incorrect reg.
+        //
+        // The trivial approach is to simply emit two moves, to put srcA in place then srcB in
+        // place (the MacroAssembler will omit redundant moves). This apporach will be safe in
+        // cases 1, 3, 4, 5, 6, and in cases where srcA==srcB. The two problem cases are 2
+        // (requires a swap) and 7 (must move srcB first, to avoid trampling.)
+
+        if (srcB != destA) {
+            // Handle the easy cases - two simple moves.
+            m_jit.move(JITCompiler::gprToRegisterID(srcA), JITCompiler::gprToRegisterID(destA));
+            m_jit.move(JITCompiler::gprToRegisterID(srcB), JITCompiler::gprToRegisterID(destB));
+        } else if (srcA != destB) {
+            // Handle the non-swap case - just put srcB in place first.
+            m_jit.move(JITCompiler::gprToRegisterID(srcB), JITCompiler::gprToRegisterID(destB));
+            m_jit.move(JITCompiler::gprToRegisterID(srcA), JITCompiler::gprToRegisterID(destA));
+        } else
+            m_jit.swap(JITCompiler::gprToRegisterID(destB), JITCompiler::gprToRegisterID(destB));
+    }
+    template<FPRReg destA, FPRReg destB>
+    void setupTwoStubArgs(FPRReg srcA, FPRReg srcB)
+    {
+        // Assuming that srcA != srcB, there are 7 interesting states the registers may be in:
+        // (1) both are already in arg regs, the right way around.
+        // (2) both are already in arg regs, the wrong way around.
+        // (3) neither are currently in arg registers.
+        // (4) srcA in in its correct reg.
+        // (5) srcA in in the incorrect reg.
+        // (6) srcB in in its correct reg.
+        // (7) srcB in in the incorrect reg.
+        //
+        // The trivial approach is to simply emit two moves, to put srcA in place then srcB in
+        // place (the MacroAssembler will omit redundant moves). This apporach will be safe in
+        // cases 1, 3, 4, 5, 6, and in cases where srcA==srcB. The two problem cases are 2
+        // (requires a swap) and 7 (must move srcB first, to avoid trampling.)
+
+        if (srcB != destA) {
+            // Handle the easy cases - two simple moves.
+            m_jit.moveDouble(JITCompiler::fprToRegisterID(srcA), JITCompiler::fprToRegisterID(destA));
+            m_jit.moveDouble(JITCompiler::fprToRegisterID(srcB), JITCompiler::fprToRegisterID(destB));
+            return;
+        }
+        
+        if (srcA != destB) {
+            // Handle the non-swap case - just put srcB in place first.
+            m_jit.moveDouble(JITCompiler::fprToRegisterID(srcB), JITCompiler::fprToRegisterID(destB));
+            m_jit.moveDouble(JITCompiler::fprToRegisterID(srcA), JITCompiler::fprToRegisterID(destA));
+            return;
+        }
+
+        ASSERT(srcB == destA && srcA == destB);
+        // Need to swap; pick a temporary register.
+        FPRReg temp;
+        if (destA != JITCompiler::argumentFPR3 && destA != JITCompiler::argumentFPR3)
+            temp = JITCompiler::argumentFPR3;
+        else if (destA != JITCompiler::argumentFPR2 && destA != JITCompiler::argumentFPR2)
+            temp = JITCompiler::argumentFPR2;
+        else {
+            ASSERT(destA != JITCompiler::argumentFPR1 && destA != JITCompiler::argumentFPR1);
+            temp = JITCompiler::argumentFPR1;
+        }
+        m_jit.moveDouble(JITCompiler::fprToRegisterID(destA), JITCompiler::fprToRegisterID(temp));
+        m_jit.moveDouble(JITCompiler::fprToRegisterID(destB), JITCompiler::fprToRegisterID(destA));
+        m_jit.moveDouble(JITCompiler::fprToRegisterID(temp), JITCompiler::fprToRegisterID(destB));
+    }
+    void setupStubArguments(GPRReg arg1, GPRReg arg2)
+    {
+        setupTwoStubArgs<JITCompiler::argumentGPR1, JITCompiler::argumentGPR2>(arg1, arg2);
+    }
+    void setupStubArguments(GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        // If neither of arg2/arg3 are in our way, then we can move arg1 into place.
+        // Then we can use setupTwoStubArgs to fix arg2/arg3.
+        if (arg2 != JITCompiler::argumentGPR1 && arg3 != JITCompiler::argumentGPR1) {
+            m_jit.move(JITCompiler::gprToRegisterID(arg1), JITCompiler::argumentRegister1);
+            setupTwoStubArgs<JITCompiler::argumentGPR2, JITCompiler::argumentGPR3>(arg2, arg3);
+            return;
+        }
+
+        // If neither of arg1/arg3 are in our way, then we can move arg2 into place.
+        // Then we can use setupTwoStubArgs to fix arg1/arg3.
+        if (arg1 != JITCompiler::argumentGPR2 && arg3 != JITCompiler::argumentGPR2) {
+            m_jit.move(JITCompiler::gprToRegisterID(arg2), JITCompiler::argumentRegister2);
+            setupTwoStubArgs<JITCompiler::argumentGPR1, JITCompiler::argumentGPR3>(arg1, arg3);
+            return;
+        }
+
+        // If neither of arg1/arg2 are in our way, then we can move arg3 into place.
+        // Then we can use setupTwoStubArgs to fix arg1/arg2.
+        if (arg1 != JITCompiler::argumentGPR3 && arg2 != JITCompiler::argumentGPR3) {
+            m_jit.move(JITCompiler::gprToRegisterID(arg3), JITCompiler::argumentRegister3);
+            setupTwoStubArgs<JITCompiler::argumentGPR1, JITCompiler::argumentGPR2>(arg1, arg2);
+            return;
+        }
+
+        // If we get here, we haven't been able to move any of arg1/arg2/arg3.
+        // Since all three are blocked, then all three must already be in the argument register.
+        // But are they in the right ones?
+
+        // First, ensure arg1 is in place.
+        if (arg1 != JITCompiler::argumentGPR1) {
+            m_jit.swap(JITCompiler::gprToRegisterID(arg1), JITCompiler::argumentRegister1);
+
+            // If arg1 wasn't in argumentGPR1, one of arg2/arg3 must be.
+            ASSERT(arg2 == JITCompiler::argumentGPR1 || arg3 == JITCompiler::argumentGPR1);
+            // If arg2 was in argumentGPR1 it no longer is (due to the swap).
+            // Otherwise arg3 must have been. Mark him as moved.
+            if (arg2 == JITCompiler::argumentGPR1)
+                arg2 = arg1;
+            else
+                arg3 = arg1;
+        }
+
+        // Either arg2 & arg3 need swapping, or we're all done.
+        ASSERT((arg2 == JITCompiler::argumentGPR2 || arg3 == JITCompiler::argumentGPR3)
+            || (arg2 == JITCompiler::argumentGPR3 || arg3 == JITCompiler::argumentGPR2));
+
+        if (arg2 != JITCompiler::argumentGPR2)
+            m_jit.swap(JITCompiler::argumentRegister2, JITCompiler::argumentRegister3);
+    }
+
+    // These methods add calls to C++ helper functions.
+    void callOperation(J_DFGOperation_EJP operation, GPRReg result, GPRReg arg1, void* pointer)
+    {
+        ASSERT(isFlushed());
+
+        m_jit.move(JITCompiler::gprToRegisterID(arg1), JITCompiler::argumentRegister1);
+        m_jit.move(JITCompiler::TrustedImmPtr(pointer), JITCompiler::argumentRegister2);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+        m_jit.move(JITCompiler::returnValueRegister, JITCompiler::gprToRegisterID(result));
+    }
+    void callOperation(J_DFGOperation_EJI operation, GPRReg result, GPRReg arg1, Identifier* identifier)
+    {
+        callOperation((J_DFGOperation_EJP)operation, result, arg1, identifier);
+    }
+    void callOperation(J_DFGOperation_EJ operation, GPRReg result, GPRReg arg1)
+    {
+        ASSERT(isFlushed());
+
+        m_jit.move(JITCompiler::gprToRegisterID(arg1), JITCompiler::argumentRegister1);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+        m_jit.move(JITCompiler::returnValueRegister, JITCompiler::gprToRegisterID(result));
+    }
+    void callOperation(Z_DFGOperation_EJ operation, GPRReg result, GPRReg arg1)
+    {
+        ASSERT(isFlushed());
+
+        m_jit.move(JITCompiler::gprToRegisterID(arg1), JITCompiler::argumentRegister1);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+        m_jit.move(JITCompiler::returnValueRegister, JITCompiler::gprToRegisterID(result));
+    }
+    void callOperation(Z_DFGOperation_EJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        ASSERT(isFlushed());
+
+        setupStubArguments(arg1, arg2);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+        m_jit.move(JITCompiler::returnValueRegister, JITCompiler::gprToRegisterID(result));
+    }
+    void callOperation(J_DFGOperation_EJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        ASSERT(isFlushed());
+
+        setupStubArguments(arg1, arg2);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+        m_jit.move(JITCompiler::returnValueRegister, JITCompiler::gprToRegisterID(result));
+    }
+    void callOperation(V_DFGOperation_EJJP operation, GPRReg arg1, GPRReg arg2, void* pointer)
+    {
+        ASSERT(isFlushed());
+
+        setupStubArguments(arg1, arg2);
+        m_jit.move(JITCompiler::TrustedImmPtr(pointer), JITCompiler::argumentRegister3);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+    }
+    void callOperation(V_DFGOperation_EJJI operation, GPRReg arg1, GPRReg arg2, Identifier* identifier)
+    {
+        callOperation((V_DFGOperation_EJJP)operation, arg1, arg2, identifier);
+    }
+    void callOperation(V_DFGOperation_EJJJ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        ASSERT(isFlushed());
+
+        setupStubArguments(arg1, arg2, arg3);
+        m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+
+        appendCallWithExceptionCheck(operation);
+    }
+    void callOperation(D_DFGOperation_DD operation, FPRReg result, FPRReg arg1, FPRReg arg2)
+    {
+        ASSERT(isFlushed());
+
+        setupTwoStubArgs<JITCompiler::argumentFPR0, JITCompiler::argumentFPR1>(arg1, arg2);
+
+        m_jit.appendCall(operation);
+        m_jit.moveDouble(JITCompiler::fpReturnValueRegister, JITCompiler::fprToRegisterID(result));
+    }
+
+    void appendCallWithExceptionCheck(const FunctionPtr& function)
+    {
+        m_jit.appendCallWithExceptionCheck(function, m_jit.graph()[m_compileIndex].exceptionInfo);
+    }
+
+    void addBranch(const MacroAssembler::Jump& jump, BlockIndex destination)
+    {
+        m_branches.append(BranchRecord(jump, destination));
+    }
+
+    void linkBranches()
+    {
+        for (size_t i = 0; i < m_branches.size(); ++i) {
+            BranchRecord& branch = m_branches[i];
+            branch.jump.linkTo(m_blockHeads[branch.destination], &m_jit);
+        }
+    }
+
+#ifndef NDEBUG
+    void dump(const char* label = 0);
+#endif
+
+#if DFG_CONSISTENCY_CHECK
+    void checkConsistency();
+#else
+    void checkConsistency() {}
+#endif
+
+    // The JIT, while also provides MacroAssembler functionality.
+    JITCompiler& m_jit;
+    // This flag is used to distinguish speculative and non-speculative
+    // code generation. This is significant when filling spilled values
+    // from the RegisterFile. When spilling we attempt to store information
+    // as to the type of boxed value being stored (int32, double, cell), and
+    // when filling on the speculative path we will retrieve this type info
+    // where available. On the non-speculative path, however, we cannot rely
+    // on the spill format info, since the a value being loaded might have
+    // been spilled by either the speculative or non-speculative paths (where
+    // we entered the non-speculative path on an intervening bail-out), and
+    // the value may have been boxed differently on the two paths.
+    bool m_isSpeculative;
+    // The current node being generated.
+    BlockIndex m_block;
+    NodeIndex m_compileIndex;
+    // Virtual and physical register maps.
+    Vector<GenerationInfo, 32> m_generationInfo;
+    RegisterBank<GPRReg, numberOfGPRs, SpillOrder, SpillOrderNone, SpillOrderMax> m_gprs;
+    RegisterBank<FPRReg, numberOfFPRs, SpillOrder, SpillOrderNone, SpillOrderMax> m_fprs;
+
+    Vector<MacroAssembler::Label> m_blockHeads;
+    struct BranchRecord {
+        BranchRecord(MacroAssembler::Jump jump, BlockIndex destination)
+            : jump(jump)
+            , destination(destination)
+        {
+        }
+
+        MacroAssembler::Jump jump;
+        BlockIndex destination;
+    };
+    Vector<BranchRecord, 8> m_branches;
+};
+
+// === Operand types ===
+//
+// IntegerOperand, DoubleOperand and JSValueOperand.
+//
+// These classes are used to lock the operands to a node into machine
+// registers. These classes implement of pattern of locking a value
+// into register at the point of construction only if it is already in
+// registers, and otherwise loading it lazily at the point it is first
+// used. We do so in order to attempt to avoid spilling one operand
+// in order to make space available for another.
+
+class IntegerOperand {
+public:
+    explicit IntegerOperand(JITCodeGenerator* jit, NodeIndex index)
+        : m_jit(jit)
+        , m_index(index)
+        , m_gprOrInvalid(InvalidGPRReg)
+#ifndef NDEBUG
+        , m_format(DataFormatNone)
+#endif
+    {
+        ASSERT(m_jit);
+        if (jit->isFilled(index))
+            gpr();
+    }
+
+    ~IntegerOperand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+
+    NodeIndex index() const
+    {
+        return m_index;
+    }
+
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillInteger(index(), m_format);
+        return m_gprOrInvalid;
+    }
+
+    DataFormat format()
+    {
+        gpr(); // m_format is set when m_gpr is locked.
+        ASSERT(m_format == DataFormatInteger || m_format == DataFormatJSInteger);
+        return m_format;
+    }
+
+    MacroAssembler::RegisterID registerID()
+    {
+        return JITCompiler::gprToRegisterID(gpr());
+    }
+
+private:
+    JITCodeGenerator* m_jit;
+    NodeIndex m_index;
+    GPRReg m_gprOrInvalid;
+    DataFormat m_format;
+};
+
+class DoubleOperand {
+public:
+    explicit DoubleOperand(JITCodeGenerator* jit, NodeIndex index)
+        : m_jit(jit)
+        , m_index(index)
+        , m_fprOrInvalid(InvalidFPRReg)
+    {
+        ASSERT(m_jit);
+        if (jit->isFilledDouble(index))
+            fpr();
+    }
+
+    ~DoubleOperand()
+    {
+        ASSERT(m_fprOrInvalid != InvalidFPRReg);
+        m_jit->unlock(m_fprOrInvalid);
+    }
+
+    NodeIndex index() const
+    {
+        return m_index;
+    }
+
+    FPRReg fpr()
+    {
+        if (m_fprOrInvalid == InvalidFPRReg)
+            m_fprOrInvalid = m_jit->fillDouble(index());
+        return m_fprOrInvalid;
+    }
+
+    MacroAssembler::FPRegisterID registerID()
+    {
+        return JITCompiler::fprToRegisterID(fpr());
+    }
+
+private:
+    JITCodeGenerator* m_jit;
+    NodeIndex m_index;
+    FPRReg m_fprOrInvalid;
+};
+
+class JSValueOperand {
+public:
+    explicit JSValueOperand(JITCodeGenerator* jit, NodeIndex index)
+        : m_jit(jit)
+        , m_index(index)
+        , m_gprOrInvalid(InvalidGPRReg)
+    {
+        ASSERT(m_jit);
+        if (jit->isFilled(index))
+            gpr();
+    }
+
+    ~JSValueOperand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+
+    NodeIndex index() const
+    {
+        return m_index;
+    }
+
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillJSValue(index());
+        return m_gprOrInvalid;
+    }
+
+    MacroAssembler::RegisterID registerID()
+    {
+        return JITCompiler::gprToRegisterID(gpr());
+    }
+
+private:
+    JITCodeGenerator* m_jit;
+    NodeIndex m_index;
+    GPRReg m_gprOrInvalid;
+};
+
+
+// === Temporaries ===
+//
+// These classes are used to allocate temporary registers.
+// A mechanism is provided to attempt to reuse the registers
+// currently allocated to child nodes whose value is consumed
+// by, and not live after, this operation.
+
+class GPRTemporary {
+public:
+    GPRTemporary(JITCodeGenerator*);
+    GPRTemporary(JITCodeGenerator*, SpeculateIntegerOperand&);
+    GPRTemporary(JITCodeGenerator*, SpeculateIntegerOperand&, SpeculateIntegerOperand&);
+    GPRTemporary(JITCodeGenerator*, IntegerOperand&);
+    GPRTemporary(JITCodeGenerator*, IntegerOperand&, IntegerOperand&);
+    GPRTemporary(JITCodeGenerator*, SpeculateCellOperand&);
+    GPRTemporary(JITCodeGenerator*, JSValueOperand&);
+
+    ~GPRTemporary()
+    {
+        m_jit->unlock(gpr());
+    }
+
+    GPRReg gpr() const
+    {
+        ASSERT(m_gpr != InvalidGPRReg);
+        return m_gpr;
+    }
+
+    MacroAssembler::RegisterID registerID()
+    {
+        ASSERT(m_gpr != InvalidGPRReg);
+        return JITCompiler::gprToRegisterID(m_gpr);
+    }
+
+protected:
+    GPRTemporary(JITCodeGenerator* jit, GPRReg lockedGPR)
+        : m_jit(jit)
+        , m_gpr(lockedGPR)
+    {
+    }
+
+private:
+    JITCodeGenerator* m_jit;
+    GPRReg m_gpr;
+};
+
+class FPRTemporary {
+public:
+    FPRTemporary(JITCodeGenerator*);
+    FPRTemporary(JITCodeGenerator*, DoubleOperand&);
+    FPRTemporary(JITCodeGenerator*, DoubleOperand&, DoubleOperand&);
+
+    ~FPRTemporary()
+    {
+        m_jit->unlock(fpr());
+    }
+
+    FPRReg fpr() const
+    {
+        ASSERT(m_fpr != InvalidFPRReg);
+        return m_fpr;
+    }
+
+    MacroAssembler::FPRegisterID registerID()
+    {
+        ASSERT(m_fpr != InvalidFPRReg);
+        return JITCompiler::fprToRegisterID(m_fpr);
+    }
+
+protected:
+    FPRTemporary(JITCodeGenerator* jit, FPRReg lockedFPR)
+        : m_jit(jit)
+        , m_fpr(lockedFPR)
+    {
+    }
+
+private:
+    JITCodeGenerator* m_jit;
+    FPRReg m_fpr;
+};
+
+
+// === Results ===
+//
+// These classes lock the result of a call to a C++ helper function.
+
+class GPRResult : public GPRTemporary {
+public:
+    GPRResult(JITCodeGenerator* jit)
+        : GPRTemporary(jit, lockedResult(jit))
+    {
+    }
+
+private:
+    static GPRReg lockedResult(JITCodeGenerator* jit)
+    {
+        jit->lock(JITCompiler::returnValueGPR);
+        return JITCompiler::returnValueGPR;
+    }
+};
+
+class FPRResult : public FPRTemporary {
+public:
+    FPRResult(JITCodeGenerator* jit)
+        : FPRTemporary(jit, lockedResult(jit))
+    {
+    }
+
+private:
+    static FPRReg lockedResult(JITCodeGenerator* jit)
+    {
+        jit->lock(JITCompiler::returnValueFPR);
+        return JITCompiler::returnValueFPR;
+    }
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
+
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
new file mode 100644
index 0000000..5cd044a
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
@@ -0,0 +1,433 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGJITCompiler.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGJITCodeGenerator.h"
+#include "DFGNonSpeculativeJIT.h"
+#include "DFGOperations.h"
+#include "DFGRegisterBank.h"
+#include "DFGSpeculativeJIT.h"
+#include "JSGlobalData.h"
+#include "LinkBuffer.h"
+
+namespace JSC { namespace DFG {
+
+// This method used to fill a numeric value to a FPR when linking speculative -> non-speculative.
+void JITCompiler::fillNumericToDouble(NodeIndex nodeIndex, FPRReg fpr, GPRReg temporary)
+{
+    Node& node = graph()[nodeIndex];
+    MacroAssembler::RegisterID tempReg = gprToRegisterID(temporary);
+
+    if (node.isConstant()) {
+        ASSERT(node.op == DoubleConstant);
+        move(MacroAssembler::ImmPtr(reinterpret_cast<void*>(reinterpretDoubleToIntptr(valueOfDoubleConstant(nodeIndex)))), tempReg);
+        movePtrToDouble(tempReg, fprToRegisterID(fpr));
+    } else {
+        loadPtr(addressFor(node.virtualRegister), tempReg);
+        Jump isInteger = branchPtr(MacroAssembler::AboveOrEqual, tempReg, tagTypeNumberRegister);
+        jitAssertIsJSDouble(gpr0);
+        addPtr(tagTypeNumberRegister, tempReg);
+        movePtrToDouble(tempReg, fprToRegisterID(fpr));
+        Jump hasUnboxedDouble = jump();
+        isInteger.link(this);
+        convertInt32ToDouble(tempReg, fprToRegisterID(fpr));
+        hasUnboxedDouble.link(this);
+    }
+}
+
+// This method used to fill an integer value to a GPR when linking speculative -> non-speculative.
+void JITCompiler::fillInt32ToInteger(NodeIndex nodeIndex, GPRReg gpr)
+{
+    Node& node = graph()[nodeIndex];
+
+    if (node.isConstant()) {
+        ASSERT(node.op == Int32Constant);
+        move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gprToRegisterID(gpr));
+    } else {
+#if DFG_JIT_ASSERT
+        // Redundant load, just so we can check the tag!
+        loadPtr(addressFor(node.virtualRegister), gprToRegisterID(gpr));
+        jitAssertIsJSInt32(gpr);
+#endif
+        load32(addressFor(node.virtualRegister), gprToRegisterID(gpr));
+    }
+}
+
+// This method used to fill a JSValue to a GPR when linking speculative -> non-speculative.
+void JITCompiler::fillToJS(NodeIndex nodeIndex, GPRReg gpr)
+{
+    Node& node = graph()[nodeIndex];
+
+    if (node.isConstant()) {
+        if (isInt32Constant(nodeIndex)) {
+            JSValue jsValue = jsNumber(valueOfInt32Constant(nodeIndex));
+            move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gprToRegisterID(gpr));
+        } else if (isDoubleConstant(nodeIndex)) {
+            JSValue jsValue(JSValue::EncodeAsDouble, valueOfDoubleConstant(nodeIndex));
+            move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gprToRegisterID(gpr));
+        } else {
+            ASSERT(isJSConstant(nodeIndex));
+            JSValue jsValue = valueOfJSConstant(nodeIndex);
+            move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gprToRegisterID(gpr));
+        }
+        return;
+    }
+
+    loadPtr(addressFor(node.virtualRegister), gprToRegisterID(gpr));
+}
+
+void JITCompiler::jumpFromSpeculativeToNonSpeculative(const SpeculationCheck& check, const EntryLocation& entry, SpeculationRecovery* recovery)
+{
+    ASSERT(check.m_nodeIndex == entry.m_nodeIndex);
+
+    // Link the jump from the Speculative path to here.
+    check.m_check.link(this);
+
+    // Does this speculation check require any additional recovery to be performed,
+    // to restore any state that has been overwritten before we enter back in to the
+    // non-speculative path.
+    if (recovery) {
+        // The only additional recovery we currently support is for integer add operation
+        ASSERT(recovery->type() == SpeculativeAdd);
+        // Revert the add.
+        sub32(gprToRegisterID(recovery->src()), gprToRegisterID(recovery->dest()));
+    }
+
+    // FIXME: - This is hideously inefficient!
+    // Where a value is live in a register in the speculative path, and is required in a register
+    // on the non-speculative path, we should not need to be spilling it and reloading (we may
+    // need to spill anyway, if the value is marked as spilled on the non-speculative path).
+    // This may also be spilling values that don't need spilling, e.g. are already spilled,
+    // are constants, or are arguments.
+
+    // Spill all GPRs in use by the speculative path.
+    for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+        NodeIndex nodeIndex = check.m_gprInfo[gpr].nodeIndex;
+        if (nodeIndex == NoNode)
+            continue;
+
+        DataFormat dataFormat = check.m_gprInfo[gpr].format;
+        VirtualRegister virtualRegister = graph()[nodeIndex].virtualRegister;
+
+        ASSERT(dataFormat == DataFormatInteger || DataFormatCell || dataFormat & DataFormatJS);
+        if (dataFormat == DataFormatInteger)
+            orPtr(tagTypeNumberRegister, gprToRegisterID(gpr));
+        storePtr(gprToRegisterID(gpr), addressFor(virtualRegister));
+    }
+
+    // Spill all FPRs in use by the speculative path.
+    for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+        NodeIndex nodeIndex = check.m_fprInfo[fpr];
+        if (nodeIndex == NoNode)
+            continue;
+
+        VirtualRegister virtualRegister = graph()[nodeIndex].virtualRegister;
+
+        moveDoubleToPtr(fprToRegisterID(fpr), regT0);
+        subPtr(tagTypeNumberRegister, regT0);
+        storePtr(regT0, addressFor(virtualRegister));
+    }
+
+    // Fill all FPRs in use by the non-speculative path.
+    for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+        NodeIndex nodeIndex = entry.m_fprInfo[fpr];
+        if (nodeIndex == NoNode)
+            continue;
+
+        fillNumericToDouble(nodeIndex, fpr, gpr0);
+    }
+
+    // Fill all GPRs in use by the non-speculative path.
+    for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+        NodeIndex nodeIndex = entry.m_gprInfo[gpr].nodeIndex;
+        if (nodeIndex == NoNode)
+            continue;
+
+        DataFormat dataFormat = entry.m_gprInfo[gpr].format;
+        if (dataFormat == DataFormatInteger)
+            fillInt32ToInteger(nodeIndex, gpr);
+        else {
+            ASSERT(dataFormat & DataFormatJS || dataFormat == DataFormatCell); // Treat cell as JSValue for now!
+            fillToJS(nodeIndex, gpr);
+            // FIXME: For subtypes of DataFormatJS, should jitAssert the subtype?
+        }
+    }
+
+    // Jump into the non-speculative path.
+    jump(entry.m_entry);
+}
+
+void JITCompiler::linkSpeculationChecks(SpeculativeJIT& speculative, NonSpeculativeJIT& nonSpeculative)
+{
+    // Iterators to walk over the set of bail outs & corresponding entry points.
+    SpeculationCheckVector::Iterator checksIter = speculative.speculationChecks().begin();
+    SpeculationCheckVector::Iterator checksEnd = speculative.speculationChecks().end();
+    NonSpeculativeJIT::EntryLocationVector::Iterator entriesIter = nonSpeculative.entryLocations().begin();
+    NonSpeculativeJIT::EntryLocationVector::Iterator entriesEnd = nonSpeculative.entryLocations().end();
+
+    // Iterate over the speculation checks.
+    while (checksIter != checksEnd) {
+        // For every bail out from the speculative path, we must have provided an entry point
+        // into the non-speculative one.
+        ASSERT(checksIter->m_nodeIndex == entriesIter->m_nodeIndex);
+
+        // There may be multiple bail outs that map to the same entry point!
+        do {
+            ASSERT(checksIter != checksEnd);
+            ASSERT(entriesIter != entriesEnd);
+
+            // Plant code to link this speculation failure.
+            const SpeculationCheck& check = *checksIter;
+            const EntryLocation& entry = *entriesIter;
+            jumpFromSpeculativeToNonSpeculative(check, entry, speculative.speculationRecovery(check.m_recoveryIndex));
+             ++checksIter;
+        } while (checksIter != checksEnd && checksIter->m_nodeIndex == entriesIter->m_nodeIndex);
+         ++entriesIter;
+    }
+
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56289
+    ASSERT(!(checksIter != checksEnd));
+    ASSERT(!(entriesIter != entriesEnd));
+}
+
+void JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWithArityCheck)
+{
+    // === Stage 1 - Function header code generation ===
+    //
+    // This code currently matches the old JIT. In the function header we need to
+    // pop the return address (since we do not allow any recursion on the machine
+    // stack), and perform a fast register file check.
+
+    // This is the main entry point, without performing an arity check.
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56292
+    // We'll need to convert the remaining cti_ style calls (specifically the register file
+    // check) which will be dependent on stack layout. (We'd need to account for this in
+    // both normal return code and when jumping to an exception handler).
+    preserveReturnAddressAfterCall(regT2);
+    emitPutToCallFrameHeader(regT2, RegisterFile::ReturnPC);
+    // If we needed to perform an arity check we will already have moved the return address,
+    // so enter after this.
+    Label fromArityCheck(this);
+
+    // Setup a pointer to the codeblock in the CallFrameHeader.
+    emitPutImmediateToCallFrameHeader(m_codeBlock, RegisterFile::CodeBlock);
+
+    // Plant a check that sufficient space is available in the RegisterFile.
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56291
+    addPtr(Imm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, regT1);
+    Jump registerFileCheck = branchPtr(Below, AbsoluteAddress(m_globalData->interpreter->registerFile().addressOfEnd()), regT1);
+    // Return here after register file check.
+    Label fromRegisterFileCheck = label();
+
+
+    // === Stage 2 - Function body code generation ===
+    //
+    // We generate the speculative code path, followed by the non-speculative
+    // code for the function. Next we need to link the two together, making
+    // bail-outs from the speculative path jump to the corresponding point on
+    // the non-speculative one (and generating any code necessary to juggle
+    // register values around, rebox values, and ensure spilled, to match the
+    // non-speculative path's requirements).
+
+#if DFG_JIT_BREAK_ON_EVERY_FUNCTION
+    // Handy debug tool!
+    breakpoint();
+#endif
+
+    // First generate the speculative path.
+    Label speculativePathBegin = label();
+    SpeculativeJIT speculative(*this);
+    bool compiledSpeculative = speculative.compile();
+
+    // Next, generate the non-speculative path. We pass this a SpeculationCheckIndexIterator
+    // to allow it to check which nodes in the graph may bail out, and may need to reenter the
+    // non-speculative path.
+    if (compiledSpeculative) {
+        SpeculationCheckIndexIterator checkIterator(speculative.speculationChecks());
+        NonSpeculativeJIT nonSpeculative(*this);
+        nonSpeculative.compile(checkIterator);
+
+        // Link the bail-outs from the speculative path to the corresponding entry points into the non-speculative one.
+        linkSpeculationChecks(speculative, nonSpeculative);
+    } else {
+        // If compilation through the SpeculativeJIT failed, throw away the code we generated.
+        m_calls.clear();
+        rewindToLabel(speculativePathBegin);
+
+        SpeculationCheckVector noChecks;
+        SpeculationCheckIndexIterator checkIterator(noChecks);
+        NonSpeculativeJIT nonSpeculative(*this);
+        nonSpeculative.compile(checkIterator);
+    }
+
+    // === Stage 3 - Function footer code generation ===
+    //
+    // Generate code to lookup and jump to exception handlers, to perform the slow
+    // register file check (if the fast one in the function header fails), and
+    // generate the entry point with arity check.
+
+    // Iterate over the m_calls vector, checking for exception checks,
+    // and linking them to here.
+    unsigned exceptionCheckCount = 0;
+    for (unsigned i = 0; i < m_calls.size(); ++i) {
+        Jump& exceptionCheck = m_calls[i].m_exceptionCheck;
+        if (exceptionCheck.isSet()) {
+            exceptionCheck.link(this);
+            ++exceptionCheckCount;
+        }
+    }
+    // If any exception checks were linked, generate code to lookup a handler.
+    if (exceptionCheckCount) {
+        // lookupExceptionHandler is passed two arguments, exec (the CallFrame*), and
+        // an identifier for the operation that threw the exception, which we can use
+        // to look up handler information. The identifier we use is the return address
+        // of the call out from JIT code that threw the exception; this is still
+        // available on the stack, just below the stack pointer!
+        move(callFrameRegister, argumentRegister0);
+        peek(argumentRegister1, -1);
+        m_calls.append(CallRecord(call(), lookupExceptionHandler));
+        // lookupExceptionHandler leaves the handler CallFrame* in the returnValueRegister,
+        // and the address of the handler in returnValueRegister2.
+        jump(returnValueRegister2);
+    }
+
+    // Generate the register file check; if the fast check in the function head fails,
+    // we need to call out to a helper function to check whether more space is available.
+    // FIXME: change this from a cti call to a DFG style operation (normal C calling conventions).
+    registerFileCheck.link(this);
+    move(stackPointerRegister, argumentRegister0);
+    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
+    Call callRegisterFileCheck = call();
+    jump(fromRegisterFileCheck);
+
+    // The fast entry point into a function does not check the correct number of arguments
+    // have been passed to the call (we only use the fast entry point where we can statically
+    // determine the correct number of arguments have been passed, or have already checked).
+    // In cases where an arity check is necessary, we enter here.
+    // FIXME: change this from a cti call to a DFG style operation (normal C calling conventions).
+    Label arityCheck = label();
+    preserveReturnAddressAfterCall(regT2);
+    emitPutToCallFrameHeader(regT2, RegisterFile::ReturnPC);
+    branch32(Equal, regT1, Imm32(m_codeBlock->m_numParameters)).linkTo(fromArityCheck, this);
+    move(stackPointerRegister, argumentRegister0);
+    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
+    Call callArityCheck = call();
+    move(regT0, callFrameRegister);
+    jump(fromArityCheck);
+
+
+    // === Stage 4 - Link ===
+    //
+    // Link the code, populate data in CodeBlock data structures.
+
+    LinkBuffer linkBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()), 0);
+
+#if DFG_DEBUG_VERBOSE
+    fprintf(stderr, "JIT code start at %p\n", linkBuffer.debugAddress());
+#endif
+
+    // Link all calls out from the JIT code to their respective functions.
+    for (unsigned i = 0; i < m_calls.size(); ++i)
+        linkBuffer.link(m_calls[i].m_call, m_calls[i].m_function);
+
+    if (m_codeBlock->needsCallReturnIndices()) {
+        m_codeBlock->callReturnIndexVector().reserveCapacity(exceptionCheckCount);
+        for (unsigned i = 0; i < m_calls.size(); ++i) {
+            if (m_calls[i].m_exceptionCheck.isSet()) {
+                unsigned returnAddressOffset = linkBuffer.returnAddressOffset(m_calls[i].m_call);
+                unsigned exceptionInfo = m_calls[i].m_exceptionInfo;
+                m_codeBlock->callReturnIndexVector().append(CallReturnOffsetToBytecodeOffset(returnAddressOffset, exceptionInfo));
+            }
+        }
+    }
+
+    // FIXME: switch the register file check & arity check over to DFGOpertaion style calls, not JIT stubs.
+    linkBuffer.link(callRegisterFileCheck, cti_register_file_check);
+    linkBuffer.link(callArityCheck, m_codeBlock->m_isConstructor ? cti_op_construct_arityCheck : cti_op_call_arityCheck);
+
+    entryWithArityCheck = linkBuffer.locationOf(arityCheck);
+    entry = linkBuffer.finalizeCode();
+}
+
+#if DFG_JIT_ASSERT
+void JITCompiler::jitAssertIsInt32(GPRReg gpr)
+{
+#if CPU(X86_64)
+    Jump checkInt32 = branchPtr(BelowOrEqual, gprToRegisterID(gpr), TrustedImmPtr(reinterpret_cast<void*>(static_cast<uintptr_t>(0xFFFFFFFFu))));
+    breakpoint();
+    checkInt32.link(this);
+#else
+    UNUSED_PARAM(gpr);
+#endif
+}
+
+void JITCompiler::jitAssertIsJSInt32(GPRReg gpr)
+{
+    Jump checkJSInt32 = branchPtr(AboveOrEqual, gprToRegisterID(gpr), tagTypeNumberRegister);
+    breakpoint();
+    checkJSInt32.link(this);
+}
+
+void JITCompiler::jitAssertIsJSNumber(GPRReg gpr)
+{
+    Jump checkJSNumber = branchTestPtr(MacroAssembler::NonZero, gprToRegisterID(gpr), tagTypeNumberRegister);
+    breakpoint();
+    checkJSNumber.link(this);
+}
+
+void JITCompiler::jitAssertIsJSDouble(GPRReg gpr)
+{
+    Jump checkJSInt32 = branchPtr(AboveOrEqual, gprToRegisterID(gpr), tagTypeNumberRegister);
+    Jump checkJSNumber = branchTestPtr(MacroAssembler::NonZero, gprToRegisterID(gpr), tagTypeNumberRegister);
+    checkJSInt32.link(this);
+    breakpoint();
+    checkJSNumber.link(this);
+}
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS) && CPU(X86_64) // Or any other 64-bit platform!
+void JITCompiler::emitCount(AbstractSamplingCounter& counter, uint32_t increment)
+{
+    addPtr(TrustedImm32(increment), AbsoluteAddress(counter.addressOfCounter()));
+}
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS) && CPU(X86) // Or any other little-endian 32-bit platform!
+void JITCompiler::emitCount(AbstractSamplingCounter& counter, uint32_t increment)
+{
+    intptr_t hiWord = reinterpret_cast<intptr_t>(counter.addressOfCounter()) + sizeof(int32_t);
+    add32(TrustedImm32(increment), AbsoluteAddress(counter.addressOfCounter()));
+    addWithCarry32(TrustedImm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
+}
+#endif
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.h b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
new file mode 100644
index 0000000..03ae2b8
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
@@ -0,0 +1,329 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGJITCompiler_h
+#define DFGJITCompiler_h
+
+#if ENABLE(DFG_JIT)
+
+#include <assembler/MacroAssembler.h>
+#include <bytecode/CodeBlock.h>
+#include <dfg/DFGGraph.h>
+#include <jit/JITCode.h>
+
+namespace JSC {
+
+class AbstractSamplingCounter;
+class CodeBlock;
+class JSGlobalData;
+
+namespace DFG {
+
+class JITCodeGenerator;
+class NonSpeculativeJIT;
+class SpeculativeJIT;
+class SpeculationRecovery;
+
+struct EntryLocation;
+struct SpeculationCheck;
+
+// Abstracted sequential numbering of available machine registers (as opposed to MacroAssembler::RegisterID,
+// which are non-sequential, and not abstracted from the register numbering used by the underlying processor).
+enum GPRReg { gpr0, gpr1, gpr2, gpr3, gpr4, gpr5, numberOfGPRs, InvalidGPRReg = 0xFFFFFFFF };
+enum FPRReg { fpr0, fpr1, fpr2, fpr3, fpr4, fpr5, numberOfFPRs, InvalidFPRReg = 0xFFFFFFFF };
+
+// GPRReg/FPRReg are enum types to provide type checking at compile time, use these method to iterate.
+inline GPRReg next(GPRReg& reg)
+{
+    ASSERT(reg < numberOfGPRs);
+    return reg = static_cast<GPRReg>(reg + 1);
+}
+inline FPRReg next(FPRReg& reg)
+{
+    ASSERT(reg < numberOfFPRs);
+    return reg = static_cast<FPRReg>(reg + 1);
+}
+
+// === CallRecord ===
+//
+// A record of a call out from JIT code to a helper function.
+// Every CallRecord contains a reference to the call instruction & the function
+// that it needs to be linked to. Calls that might throw an exception also record
+// the Jump taken on exception (unset if not present), and ExceptionInfo (presently
+// an unsigned, bytecode index) used to recover handler/source info.
+struct CallRecord {
+    // Constructor for a call with no exception handler.
+    CallRecord(MacroAssembler::Call call, FunctionPtr function)
+        : m_call(call)
+        , m_function(function)
+    {
+    }
+
+    // Constructor for a call with an exception handler.
+    CallRecord(MacroAssembler::Call call, FunctionPtr function, MacroAssembler::Jump exceptionCheck, ExceptionInfo exceptionInfo)
+        : m_call(call)
+        , m_function(function)
+        , m_exceptionCheck(exceptionCheck)
+        , m_exceptionInfo(exceptionInfo)
+    {
+    }
+
+    MacroAssembler::Call m_call;
+    FunctionPtr m_function;
+    MacroAssembler::Jump m_exceptionCheck;
+    ExceptionInfo m_exceptionInfo;
+};
+
+// === JITCompiler ===
+//
+// DFG::JITCompiler is responsible for generating JIT code from the dataflow graph.
+// It does so by delegating to the speculative & non-speculative JITs, which
+// generate to a MacroAssembler (which the JITCompiler owns through an inheritance
+// relationship). The JITCompiler holds references to information required during
+// compilation, and also records information used in linking (e.g. a list of all
+// call to be linked).
+class JITCompiler : public MacroAssembler {
+public:
+    JITCompiler(JSGlobalData* globalData, Graph& dfg, CodeBlock* codeBlock)
+        : m_globalData(globalData)
+        , m_graph(dfg)
+        , m_codeBlock(codeBlock)
+    {
+    }
+
+    void compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWithArityCheck);
+
+    // Accessors for properties.
+    Graph& graph() { return m_graph; }
+    CodeBlock* codeBlock() { return m_codeBlock; }
+    JSGlobalData* globalData() { return m_globalData; }
+
+#if CPU(X86_64)
+    // These registers match the old JIT.
+    static const RegisterID timeoutCheckRegister = X86Registers::r12;
+    static const RegisterID callFrameRegister = X86Registers::r13;
+    static const RegisterID tagTypeNumberRegister = X86Registers::r14;
+    static const RegisterID tagMaskRegister = X86Registers::r15;
+
+    // Temporary registers (these correspond to the temporary GPRReg/FPRReg
+    // registers i.e. regT0 and grp0 refer to the same thing, grp0 being
+    // the abstracted, sequential name, and regT0 being the machine register
+    // number in the instruction set, as provided by the MacroAssembler).
+    static const RegisterID regT0 = X86Registers::eax;
+    static const RegisterID regT1 = X86Registers::edx;
+    static const RegisterID regT2 = X86Registers::ecx;
+    static const RegisterID regT3 = X86Registers::ebx;
+    static const RegisterID regT4 = X86Registers::edi;
+    static const RegisterID regT5 = X86Registers::esi;
+    static const FPRegisterID fpRegT0 = X86Registers::xmm0;
+    static const FPRegisterID fpRegT1 = X86Registers::xmm1;
+    static const FPRegisterID fpRegT2 = X86Registers::xmm2;
+    static const FPRegisterID fpRegT3 = X86Registers::xmm3;
+    static const FPRegisterID fpRegT4 = X86Registers::xmm4;
+    static const FPRegisterID fpRegT5 = X86Registers::xmm5;
+
+    // These constants provide both RegisterID & GPRReg style names for the
+    // general purpose argument & return value register.
+    static const GPRReg argumentGPR0 = gpr4;
+    static const GPRReg argumentGPR1 = gpr5;
+    static const GPRReg argumentGPR2 = gpr1;
+    static const GPRReg argumentGPR3 = gpr2;
+    static const RegisterID argumentRegister0 = regT4;
+    static const RegisterID argumentRegister1 = regT5;
+    static const RegisterID argumentRegister2 = regT1;
+    static const RegisterID argumentRegister3 = regT2;
+    static const GPRReg returnValueGPR = gpr0;
+    static const RegisterID returnValueRegister = regT0;
+    static const RegisterID returnValueRegister2 = regT1;
+
+    // These constants provide both FPRegisterID & FPRReg style names for the
+    // floating point argument & return value register.
+    static const FPRReg argumentFPR0 = fpr0;
+    static const FPRReg argumentFPR1 = fpr1;
+    static const FPRReg argumentFPR2 = fpr2;
+    static const FPRReg argumentFPR3 = fpr3;
+    static const FPRegisterID fpArgumentRegister0 = fpRegT0;
+    static const FPRegisterID fpArgumentRegister1 = fpRegT1;
+    static const FPRegisterID fpArgumentRegister2 = fpRegT2;
+    static const FPRegisterID fpArgumentRegister3 = fpRegT3;
+    static const FPRReg returnValueFPR = fpr0;
+    static const FPRegisterID fpReturnValueRegister = fpRegT0;
+
+
+    void preserveReturnAddressAfterCall(RegisterID reg)
+    {
+        pop(reg);
+    }
+
+    void restoreReturnAddressBeforeReturn(RegisterID reg)
+    {
+        push(reg);
+    }
+
+    void restoreReturnAddressBeforeReturn(Address address)
+    {
+        push(address);
+    }
+
+    void emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to)
+    {
+        loadPtr(Address(callFrameRegister, entry * sizeof(Register)), to);
+    }
+    void emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry)
+    {
+        storePtr(from, Address(callFrameRegister, entry * sizeof(Register)));
+    }
+
+    void emitPutImmediateToCallFrameHeader(void* value, RegisterFile::CallFrameHeaderEntry entry)
+    {
+        storePtr(TrustedImmPtr(value), Address(callFrameRegister, entry * sizeof(Register)));
+    }
+#endif
+
+    Address addressForArgument(int32_t argument)
+    {
+        return Address(callFrameRegister, (argument - (m_codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize)) * sizeof(Register));
+    }
+
+    static Address addressForGlobalVar(RegisterID global, int32_t varNumber)
+    {
+        return Address(global, varNumber * sizeof(Register));
+    }
+
+    static Address addressFor(VirtualRegister virtualRegister)
+    {
+        return Address(callFrameRegister, virtualRegister * sizeof(Register));
+    }
+
+    // These methods provide mapping from sequential register numbering (GPRReg/FPRReg)
+    // to machine register numbering (RegisterID/FPRegisterID).
+    static RegisterID gprToRegisterID(GPRReg reg)
+    {
+        ASSERT(reg < numberOfGPRs);
+        static const RegisterID idForRegister[numberOfGPRs] = { regT0, regT1, regT2, regT3, regT4, regT5 };
+        return idForRegister[reg];
+    }
+    static FPRegisterID fprToRegisterID(FPRReg reg)
+    {
+        ASSERT(reg < numberOfFPRs);
+        static const FPRegisterID idForRegister[numberOfFPRs] = { fpRegT0, fpRegT1, fpRegT2, fpRegT3, fpRegT4, fpRegT5 };
+        return idForRegister[reg];
+    }
+
+    // Add a call out from JIT code, without an exception check.
+    void appendCall(const FunctionPtr& function)
+    {
+        m_calls.append(CallRecord(call(), function));
+        // FIXME: should be able to JIT_ASSERT here that globalData->exception is null on return back to JIT code.
+    }
+
+    // Add a call out from JIT code, with an exception check.
+    void appendCallWithExceptionCheck(const FunctionPtr& function, unsigned exceptionInfo)
+    {
+        Call functionCall = call();
+        Jump exceptionCheck = branchTestPtr(NonZero, AbsoluteAddress(&globalData()->exception));
+        m_calls.append(CallRecord(functionCall, function, exceptionCheck, exceptionInfo));
+    }
+
+    // Helper methods to check nodes for constants.
+    bool isConstant(NodeIndex nodeIndex)
+    {
+        return graph()[nodeIndex].isConstant();
+    }
+    bool isInt32Constant(NodeIndex nodeIndex)
+    {
+        return graph()[nodeIndex].op == Int32Constant;
+    }
+    bool isDoubleConstant(NodeIndex nodeIndex)
+    {
+        return graph()[nodeIndex].op == DoubleConstant;
+    }
+    bool isJSConstant(NodeIndex nodeIndex)
+    {
+        return graph()[nodeIndex].op == JSConstant;
+    }
+
+    // Helper methods get constant values from nodes.
+    int32_t valueOfInt32Constant(NodeIndex nodeIndex)
+    {
+        ASSERT(isInt32Constant(nodeIndex));
+        return graph()[nodeIndex].int32Constant();
+    }
+    double valueOfDoubleConstant(NodeIndex nodeIndex)
+    {
+        ASSERT(isDoubleConstant(nodeIndex));
+        return graph()[nodeIndex].numericConstant();
+    }
+    JSValue valueOfJSConstant(NodeIndex nodeIndex)
+    {
+        ASSERT(isJSConstant(nodeIndex));
+        unsigned constantIndex = graph()[nodeIndex].constantNumber();
+        return codeBlock()->constantRegister(FirstConstantRegisterIndex + constantIndex).get();
+    }
+
+    // These methods JIT generate dynamic, debug-only checks - akin to ASSERTs.
+#if DFG_JIT_ASSERT
+    void jitAssertIsInt32(GPRReg);
+    void jitAssertIsJSInt32(GPRReg);
+    void jitAssertIsJSNumber(GPRReg);
+    void jitAssertIsJSDouble(GPRReg);
+#else
+    void jitAssertIsInt32(GPRReg) {}
+    void jitAssertIsJSInt32(GPRReg) {}
+    void jitAssertIsJSNumber(GPRReg) {}
+    void jitAssertIsJSDouble(GPRReg) {}
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS)
+    // Debug profiling tool.
+    void emitCount(AbstractSamplingCounter&, uint32_t increment = 1);
+#endif
+
+private:
+    // These methods used in linking the speculative & non-speculative paths together.
+    void fillNumericToDouble(NodeIndex, FPRReg, GPRReg temporary);
+    void fillInt32ToInteger(NodeIndex, GPRReg);
+    void fillToJS(NodeIndex, GPRReg);
+    void jumpFromSpeculativeToNonSpeculative(const SpeculationCheck&, const EntryLocation&, SpeculationRecovery*);
+    void linkSpeculationChecks(SpeculativeJIT&, NonSpeculativeJIT&);
+
+    // The globalData, used to access constants such as the vPtrs.
+    JSGlobalData* m_globalData;
+
+    // The dataflow graph currently being generated.
+    Graph& m_graph;
+
+    // The codeBlock currently being generated, used to access information such as constant values, immediates.
+    CodeBlock* m_codeBlock;
+
+    // Vector of calls out from JIT code, including exception handler information.
+    Vector<CallRecord> m_calls;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
+
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
new file mode 100644
index 0000000..2a5b6dd
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -0,0 +1,355 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGNode_h
+#define DFGNode_h
+
+// Emit various logging information for debugging, including dumping the dataflow graphs.
+#define DFG_DEBUG_VERBOSE 0
+// Enable generation of dynamic checks into the instruction stream.
+#define DFG_JIT_ASSERT 0
+// Consistency check contents compiler data structures.
+#define DFG_CONSISTENCY_CHECK 0
+// Emit a breakpoint into the head of every generated function, to aid debugging in GDB.
+#define DFG_JIT_BREAK_ON_EVERY_FUNCTION 0
+// Emit a breakpoint into the head of every generated node, to aid debugging in GDB.
+#define DFG_JIT_BREAK_ON_EVERY_BLOCK 0
+// Emit a breakpoint into the head of every generated node, to aid debugging in GDB.
+#define DFG_JIT_BREAK_ON_EVERY_NODE 0
+// Disable the DFG JIT without having to touch Platform.h!
+#define DFG_DEBUG_LOCAL_DISBALE 0
+// Generate stats on how successful we were in making use of the DFG jit, and remaining on the hot path.
+#define DFG_SUCCESS_STATS 0
+
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+// Type for a virtual register number (spill location).
+// Using an enum to make this type-checked at compile time, to avert programmer errors.
+enum VirtualRegister { InvalidVirtualRegister = -1 };
+COMPILE_ASSERT(sizeof(VirtualRegister) == sizeof(int), VirtualRegister_is_32bit);
+
+// Type for a reference to another node in the graph.
+typedef uint32_t NodeIndex;
+static const NodeIndex NoNode = UINT_MAX;
+
+// Information used to map back from an exception to any handler/source information.
+// (Presently implemented as a bytecode index).
+typedef uint32_t ExceptionInfo;
+
+// Entries in the NodeType enum (below) are composed of an id, a result type (possibly none)
+// and some additional informative flags (must generate, is constant, etc).
+#define NodeIdMask          0xFFF
+#define NodeResultMask     0xF000
+#define NodeMustGenerate  0x10000 // set on nodes that have side effects, and may not trivially be removed by DCE.
+#define NodeIsConstant    0x20000
+#define NodeIsJump        0x40000
+#define NodeIsBranch      0x80000
+
+// These values record the result type of the node (as checked by NodeResultMask, above), 0 for no result.
+#define NodeResultJS      0x1000
+#define NodeResultDouble  0x2000
+#define NodeResultInt32   0x3000
+
+// This macro defines a set of information about all known node types, used to populate NodeId, NodeType below.
+#define FOR_EACH_DFG_OP(macro) \
+    /* Nodes for constants. */\
+    macro(JSConstant, NodeResultJS | NodeIsConstant) \
+    macro(Int32Constant, NodeResultJS | NodeIsConstant) \
+    macro(DoubleConstant, NodeResultJS | NodeIsConstant) \
+    macro(ConvertThis, NodeResultJS) \
+    \
+    /* Nodes for local variable access. */\
+    macro(GetLocal, NodeResultJS) \
+    macro(SetLocal, NodeMustGenerate) \
+    \
+    /* Nodes for bitwise operations. */\
+    macro(BitAnd, NodeResultInt32) \
+    macro(BitOr, NodeResultInt32) \
+    macro(BitXor, NodeResultInt32) \
+    macro(BitLShift, NodeResultInt32) \
+    macro(BitRShift, NodeResultInt32) \
+    macro(BitURShift, NodeResultInt32) \
+    /* Bitwise operators call ToInt32 on their operands. */\
+    macro(NumberToInt32, NodeResultInt32) \
+    macro(ValueToInt32, NodeResultInt32 | NodeMustGenerate) \
+    /* Used to box the result of URShift nodes (result has range 0..2^32-1). */\
+    macro(UInt32ToNumber, NodeResultDouble) \
+    \
+    /* Nodes for arithmetic operations. */\
+    macro(ArithAdd, NodeResultDouble) \
+    macro(ArithSub, NodeResultDouble) \
+    macro(ArithMul, NodeResultDouble) \
+    macro(ArithDiv, NodeResultDouble) \
+    macro(ArithMod, NodeResultDouble) \
+    /* Arithmetic operators call ToNumber on their operands. */\
+    macro(Int32ToNumber, NodeResultDouble) \
+    macro(ValueToNumber, NodeResultDouble | NodeMustGenerate) \
+    \
+    /* Add of values may either be arithmetic, or result in string concatenation. */\
+    macro(ValueAdd, NodeResultJS | NodeMustGenerate) \
+    \
+    /* Property access. */\
+    /* PutByValAlias indicates a 'put' aliases a prior write to the same property. */\
+    /* Since a put to 'length' may invalidate optimizations here, */\
+    /* this must be the directly subsequent property put. */\
+    macro(GetByVal, NodeResultJS | NodeMustGenerate) \
+    macro(PutByVal, NodeMustGenerate) \
+    macro(PutByValAlias, NodeMustGenerate) \
+    macro(GetById, NodeResultJS | NodeMustGenerate) \
+    macro(PutById, NodeMustGenerate) \
+    macro(PutByIdDirect, NodeMustGenerate) \
+    macro(GetGlobalVar, NodeResultJS | NodeMustGenerate) \
+    macro(PutGlobalVar, NodeMustGenerate) \
+    \
+    /* Nodes for comparison operations. */\
+    macro(CompareLess, NodeResultJS | NodeMustGenerate) \
+    macro(CompareLessEq, NodeResultJS | NodeMustGenerate) \
+    macro(CompareEq, NodeResultJS | NodeMustGenerate) \
+    macro(CompareStrictEq, NodeResultJS) \
+    \
+    /* Nodes for misc operations. */\
+    macro(LogicalNot, NodeResultJS) \
+    \
+    /* Block terminals. */\
+    macro(Jump, NodeMustGenerate | NodeIsJump) \
+    macro(Branch, NodeMustGenerate | NodeIsBranch) \
+    macro(Return, NodeMustGenerate)
+
+// This enum generates a monotonically increasing id for all Node types,
+// and is used by the subsequent enum to fill out the id (as accessed via the NodeIdMask).
+enum NodeId {
+#define DFG_OP_ENUM(opcode, flags) opcode##_id,
+    FOR_EACH_DFG_OP(DFG_OP_ENUM)
+#undef DFG_OP_ENUM
+};
+
+// Entries in this enum describe all Node types.
+// The enum value contains a monotonically increasing id, a result type, and additional flags.
+enum NodeType {
+#define DFG_OP_ENUM(opcode, flags) opcode = opcode##_id | (flags),
+    FOR_EACH_DFG_OP(DFG_OP_ENUM)
+#undef DFG_OP_ENUM
+};
+
+// This type used in passing an immediate argument to Node constructor;
+// distinguishes an immediate value (typically an index into a CodeBlock data structure - 
+// a constant index, argument, or identifier) from a NodeIndex.
+struct OpInfo {
+    explicit OpInfo(unsigned value) : m_value(value) {}
+    unsigned m_value;
+};
+
+// === Node ===
+//
+// Node represents a single operation in the data flow graph.
+struct Node {
+    // Construct a node with up to 3 children, no immediate value.
+    Node(NodeType op, ExceptionInfo exceptionInfo, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+        : op(op)
+        , exceptionInfo(exceptionInfo)
+        , child1(child1)
+        , child2(child2)
+        , child3(child3)
+        , virtualRegister(InvalidVirtualRegister)
+        , refCount(0)
+    {
+    }
+
+    // Construct a node with up to 3 children and an immediate value.
+    Node(NodeType op, ExceptionInfo exceptionInfo, OpInfo imm, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+        : op(op)
+        , exceptionInfo(exceptionInfo)
+        , child1(child1)
+        , child2(child2)
+        , child3(child3)
+        , virtualRegister(InvalidVirtualRegister)
+        , refCount(0)
+        , m_opInfo(imm.m_value)
+    {
+    }
+
+    // Construct a node with up to 3 children and two immediate values.
+    Node(NodeType op, ExceptionInfo exceptionInfo, OpInfo imm1, OpInfo imm2, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)
+        : op(op)
+        , exceptionInfo(exceptionInfo)
+        , child1(child1)
+        , child2(child2)
+        , child3(child3)
+        , virtualRegister(InvalidVirtualRegister)
+        , refCount(0)
+        , m_opInfo(imm1.m_value)
+    {
+        m_constantValue.opInfo2 = imm2.m_value;
+    }
+
+    bool mustGenerate()
+    {
+        return op & NodeMustGenerate;
+    }
+
+    bool isConstant()
+    {
+        return op & NodeIsConstant;
+    }
+
+    unsigned constantNumber()
+    {
+        ASSERT(isConstant());
+        return m_opInfo;
+    }
+
+    bool hasLocal()
+    {
+        return op == GetLocal || op == SetLocal;
+    }
+
+    VirtualRegister local()
+    {
+        ASSERT(hasLocal());
+        return (VirtualRegister)m_opInfo;
+    }
+
+    bool hasIdentifier()
+    {
+        return op == GetById || op == PutById || op == PutByIdDirect;
+    }
+
+    unsigned identifierNumber()
+    {
+        ASSERT(hasIdentifier());
+        return m_opInfo;
+    }
+
+    bool hasVarNumber()
+    {
+        return op == GetGlobalVar || op == PutGlobalVar;
+    }
+
+    unsigned varNumber()
+    {
+        ASSERT(hasVarNumber());
+        return m_opInfo;
+    }
+
+    bool hasInt32Result()
+    {
+        return (op & NodeResultMask) == NodeResultInt32;
+    }
+
+    bool hasDoubleResult()
+    {
+        return (op & NodeResultMask) == NodeResultDouble;
+    }
+
+    bool hasJSResult()
+    {
+        return (op & NodeResultMask) == NodeResultJS;
+    }
+
+    // Check for integers or doubles.
+    bool hasNumericResult()
+    {
+        // This check will need updating if more result types are added.
+        ASSERT((hasInt32Result() || hasDoubleResult()) == !hasJSResult());
+        return !hasJSResult();
+    }
+
+    int32_t int32Constant()
+    {
+        ASSERT(op == Int32Constant);
+        return m_constantValue.asInt32;
+    }
+
+    void setInt32Constant(int32_t value)
+    {
+        ASSERT(op == Int32Constant);
+        m_constantValue.asInt32 = value;
+    }
+
+    double numericConstant()
+    {
+        ASSERT(op == DoubleConstant);
+        return m_constantValue.asDouble;
+    }
+
+    void setDoubleConstant(double value)
+    {
+        ASSERT(op == DoubleConstant);
+        m_constantValue.asDouble = value;
+    }
+
+    bool isJump()
+    {
+        return op & NodeIsJump;
+    }
+
+    bool isBranch()
+    {
+        return op & NodeIsBranch;
+    }
+
+    unsigned takenBytecodeOffset()
+    {
+        ASSERT(isBranch() || isJump());
+        return m_opInfo;
+    }
+
+    unsigned notTakenBytecodeOffset()
+    {
+        ASSERT(isBranch());
+        return m_constantValue.opInfo2;
+    }
+
+    // This enum value describes the type of the node.
+    NodeType op;
+    // Used to look up exception handling information (currently implemented as a bytecode index).
+    ExceptionInfo exceptionInfo;
+    // References to up to 3 children (0 for no child).
+    NodeIndex child1, child2, child3;
+    // The virtual register number (spill location) associated with this .
+    VirtualRegister virtualRegister;
+    // The number of uses of the result of this operation (+1 for 'must generate' nodes, which have side-effects).
+    unsigned refCount;
+
+private:
+    // An immediate value, accesses type-checked via accessors above.
+    unsigned m_opInfo;
+    // The value of an int32/double constant.
+    union {
+        int32_t asInt32;
+        double asDouble;
+        unsigned opInfo2;
+    } m_constantValue;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp
new file mode 100644
index 0000000..87c4234
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.cpp
@@ -0,0 +1,689 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGNonSpeculativeJIT.h"
+
+#include "DFGSpeculativeJIT.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+const double twoToThe32 = (double)0x100000000ull;
+
+EntryLocation::EntryLocation(MacroAssembler::Label entry, NonSpeculativeJIT* jit)
+    : m_entry(entry)
+    , m_nodeIndex(jit->m_compileIndex)
+{
+    for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+        VirtualRegister virtualRegister = jit->m_gprs.name(gpr);
+        if (virtualRegister != InvalidVirtualRegister) {
+            GenerationInfo& info =  jit->m_generationInfo[virtualRegister];
+            m_gprInfo[gpr].nodeIndex = info.nodeIndex();
+            m_gprInfo[gpr].format = info.registerFormat();
+        } else
+            m_gprInfo[gpr].nodeIndex = NoNode;
+    }
+    for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+        VirtualRegister virtualRegister = jit->m_fprs.name(fpr);
+        if (virtualRegister != InvalidVirtualRegister) {
+            GenerationInfo& info =  jit->m_generationInfo[virtualRegister];
+            ASSERT(info.registerFormat() == DataFormatDouble);
+            m_fprInfo[fpr] = info.nodeIndex();
+        } else
+            m_fprInfo[fpr] = NoNode;
+    }
+}
+
+void NonSpeculativeJIT::valueToNumber(JSValueOperand& operand, FPRReg fpr)
+{
+    GPRReg jsValueGpr = operand.gpr();
+    GPRReg tempGpr = allocate(); // FIXME: can we skip this allocation on the last use of the virtual register?
+
+    JITCompiler::RegisterID jsValueReg = JITCompiler::gprToRegisterID(jsValueGpr);
+    JITCompiler::FPRegisterID fpReg = JITCompiler::fprToRegisterID(fpr);
+    JITCompiler::RegisterID tempReg = JITCompiler::gprToRegisterID(tempGpr);
+
+    JITCompiler::Jump isInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, jsValueReg, JITCompiler::tagTypeNumberRegister);
+    JITCompiler::Jump nonNumeric = m_jit.branchTestPtr(MacroAssembler::Zero, jsValueReg, JITCompiler::tagTypeNumberRegister);
+
+    // First, if we get here we have a double encoded as a JSValue
+    m_jit.move(jsValueReg, tempReg);
+    m_jit.addPtr(JITCompiler::tagTypeNumberRegister, tempReg);
+    m_jit.movePtrToDouble(tempReg, fpReg);
+    JITCompiler::Jump hasUnboxedDouble = m_jit.jump();
+
+    // Next handle cells (& other JS immediates)
+    nonNumeric.link(&m_jit);
+    silentSpillAllRegisters(fpr, jsValueGpr);
+    m_jit.move(jsValueReg, JITCompiler::argumentRegister1);
+    m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+    appendCallWithExceptionCheck(dfgConvertJSValueToNumber);
+    m_jit.moveDouble(JITCompiler::fpReturnValueRegister, fpReg);
+    silentFillAllRegisters(fpr);
+    JITCompiler::Jump hasCalledToNumber = m_jit.jump();
+    
+    // Finally, handle integers.
+    isInteger.link(&m_jit);
+    m_jit.convertInt32ToDouble(jsValueReg, fpReg);
+    hasUnboxedDouble.link(&m_jit);
+    hasCalledToNumber.link(&m_jit);
+
+    m_gprs.unlock(tempGpr);
+}
+
+void NonSpeculativeJIT::valueToInt32(JSValueOperand& operand, GPRReg result)
+{
+    GPRReg jsValueGpr = operand.gpr();
+
+    JITCompiler::RegisterID jsValueReg = JITCompiler::gprToRegisterID(jsValueGpr);
+    JITCompiler::RegisterID resultReg = JITCompiler::gprToRegisterID(result);
+
+    JITCompiler::Jump isInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, jsValueReg, JITCompiler::tagTypeNumberRegister);
+
+    // First handle non-integers
+    silentSpillAllRegisters(result, jsValueGpr);
+    m_jit.move(jsValueReg, JITCompiler::argumentRegister1);
+    m_jit.move(JITCompiler::callFrameRegister, JITCompiler::argumentRegister0);
+    appendCallWithExceptionCheck(dfgConvertJSValueToInt32);
+    m_jit.zeroExtend32ToPtr(JITCompiler::returnValueRegister, resultReg);
+    silentFillAllRegisters(result);
+    JITCompiler::Jump hasCalledToInt32 = m_jit.jump();
+    
+    // Then handle integers.
+    isInteger.link(&m_jit);
+    m_jit.zeroExtend32ToPtr(jsValueReg, resultReg);
+    hasCalledToInt32.link(&m_jit);
+}
+
+void NonSpeculativeJIT::numberToInt32(FPRReg fpr, GPRReg gpr)
+{
+    JITCompiler::FPRegisterID fpReg = JITCompiler::fprToRegisterID(fpr);
+    JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+
+    JITCompiler::Jump truncatedToInteger = m_jit.branchTruncateDoubleToInt32(fpReg, reg, JITCompiler::BranchIfTruncateSuccessful);
+
+    silentSpillAllRegisters(gpr);
+
+    m_jit.moveDouble(fpReg, JITCompiler::fpArgumentRegister0);
+    appendCallWithExceptionCheck(toInt32);
+    m_jit.zeroExtend32ToPtr(JITCompiler::returnValueRegister, reg);
+
+    silentFillAllRegisters(gpr);
+
+    truncatedToInteger.link(&m_jit);
+}
+
+bool NonSpeculativeJIT::isKnownInteger(NodeIndex nodeIndex)
+{
+    GenerationInfo& info = m_generationInfo[m_jit.graph()[nodeIndex].virtualRegister];
+
+    DataFormat registerFormat = info.registerFormat();
+    if (registerFormat != DataFormatNone)
+        return (registerFormat | DataFormatJS) == DataFormatJSInteger;
+
+    DataFormat spillFormat = info.spillFormat();
+    if (spillFormat != DataFormatNone)
+        return (spillFormat | DataFormatJS) == DataFormatJSInteger;
+
+    ASSERT(isConstant(nodeIndex));
+    return isInt32Constant(nodeIndex);
+}
+
+bool NonSpeculativeJIT::isKnownNumeric(NodeIndex nodeIndex)
+{
+    GenerationInfo& info = m_generationInfo[m_jit.graph()[nodeIndex].virtualRegister];
+
+    DataFormat registerFormat = info.registerFormat();
+    if (registerFormat != DataFormatNone)
+        return (registerFormat | DataFormatJS) == DataFormatJSInteger
+            || (registerFormat | DataFormatJS) == DataFormatJSDouble;
+
+    DataFormat spillFormat = info.spillFormat();
+    if (spillFormat != DataFormatNone)
+        return (spillFormat | DataFormatJS) == DataFormatJSInteger
+            || (spillFormat | DataFormatJS) == DataFormatJSDouble;
+
+    ASSERT(isConstant(nodeIndex));
+    return isInt32Constant(nodeIndex) || isDoubleConstant(nodeIndex);
+}
+
+void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, Node& node)
+{
+    // ...
+    if (checkIterator.hasCheckAtIndex(m_compileIndex))
+        trackEntry(m_jit.label());
+
+    checkConsistency();
+    NodeType op = node.op;
+
+    switch (op) {
+    case ConvertThis: {
+        JSValueOperand thisValue(this, node.child1);
+        GPRReg thisGPR = thisValue.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationConvertThis, result.gpr(), thisGPR);
+        cellResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case Int32Constant:
+    case DoubleConstant:
+    case JSConstant:
+        initConstantInfo(m_compileIndex);
+        break;
+
+    case GetLocal: {
+        GPRTemporary result(this);
+        m_jit.loadPtr(JITCompiler::addressFor(node.local()), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case SetLocal: {
+        JSValueOperand value(this, node.child1);
+        m_jit.storePtr(value.registerID(), JITCompiler::addressFor(node.local()));
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+        if (isInt32Constant(node.child1)) {
+            IntegerOperand op2(this, node.child2);
+            GPRTemporary result(this, op2);
+
+            bitOp(op, valueOfInt32Constant(node.child1), op2.registerID(), result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        } else if (isInt32Constant(node.child2)) {
+            IntegerOperand op1(this, node.child1);
+            GPRTemporary result(this, op1);
+
+            bitOp(op, valueOfInt32Constant(node.child2), op1.registerID(), result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        } else {
+            IntegerOperand op1(this, node.child1);
+            IntegerOperand op2(this, node.child2);
+            GPRTemporary result(this, op1, op2);
+
+            MacroAssembler::RegisterID reg1 = op1.registerID();
+            MacroAssembler::RegisterID reg2 = op2.registerID();
+            bitOp(op, reg1, reg2, result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        }
+        break;
+
+    case BitRShift:
+    case BitLShift:
+    case BitURShift:
+        if (isInt32Constant(node.child2)) {
+            IntegerOperand op1(this, node.child1);
+            GPRTemporary result(this, op1);
+
+            int shiftAmount = valueOfInt32Constant(node.child2) & 0x1f;
+            // Shifts by zero should have been optimized out of the graph!
+            ASSERT(shiftAmount);
+            shiftOp(op, op1.registerID(), shiftAmount, result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        } else {
+            // Do not allow shift amount to be used as the result, MacroAssembler does not permit this.
+            IntegerOperand op1(this, node.child1);
+            IntegerOperand op2(this, node.child2);
+            GPRTemporary result(this, op1);
+
+            MacroAssembler::RegisterID reg1 = op1.registerID();
+            MacroAssembler::RegisterID reg2 = op2.registerID();
+            shiftOp(op, reg1, reg2, result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        }
+        break;
+
+    case UInt32ToNumber: {
+        IntegerOperand op1(this, node.child1);
+        FPRTemporary result(this);
+        m_jit.convertInt32ToDouble(op1.registerID(), result.registerID());
+
+        MacroAssembler::Jump positive = m_jit.branch32(MacroAssembler::GreaterThanOrEqual, op1.registerID(), TrustedImm32(0));
+        m_jit.addDouble(JITCompiler::AbsoluteAddress(&twoToThe32), result.registerID());
+        positive.link(&m_jit);
+
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case Int32ToNumber: {
+        IntegerOperand op1(this, node.child1);
+        FPRTemporary result(this);
+        m_jit.convertInt32ToDouble(op1.registerID(), result.registerID());
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case NumberToInt32:
+    case ValueToInt32: {
+        ASSERT(!isInt32Constant(node.child1));
+
+        if (isKnownInteger(node.child1)) {
+            IntegerOperand op1(this, node.child1);
+            GPRTemporary result(this, op1);
+            m_jit.move(op1.registerID(), result.registerID());
+            integerResult(result.gpr(), m_compileIndex);
+            break;
+        }
+
+        if (isKnownNumeric(node.child1)) {
+            DoubleOperand op1(this, node.child1);
+            GPRTemporary result(this);
+            numberToInt32(op1.fpr(), result.gpr());
+            integerResult(result.gpr(), m_compileIndex);
+            break;
+        }
+
+        // We should have handled this via isKnownInteger, or isKnownNumeric!
+        ASSERT(op != NumberToInt32);
+
+        JSValueOperand op1(this, node.child1);
+        GPRTemporary result(this, op1);
+        valueToInt32(op1, result.gpr());
+        integerResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case ValueToNumber: {
+        ASSERT(!isInt32Constant(node.child1));
+        ASSERT(!isDoubleConstant(node.child1));
+
+        if (isKnownInteger(node.child1)) {
+            IntegerOperand op1(this, node.child1);
+            FPRTemporary result(this);
+            m_jit.convertInt32ToDouble(op1.registerID(), result.registerID());
+            doubleResult(result.fpr(), m_compileIndex);
+            break;
+        }
+
+        if (isKnownNumeric(node.child1)) {
+            DoubleOperand op1(this, node.child1);
+            FPRTemporary result(this, op1);
+            m_jit.moveDouble(op1.registerID(), result.registerID());
+            doubleResult(result.fpr(), m_compileIndex);
+            break;
+        }
+
+        JSValueOperand op1(this, node.child1);
+        FPRTemporary result(this);
+        valueToNumber(op1, result.fpr());
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case ValueAdd: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationValueAdd, result.gpr(), arg1GPR, arg2GPR);
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+        
+    case ArithAdd: {
+        DoubleOperand op1(this, node.child1);
+        DoubleOperand op2(this, node.child2);
+        FPRTemporary result(this, op1, op2);
+
+        MacroAssembler::FPRegisterID reg1 = op1.registerID();
+        MacroAssembler::FPRegisterID reg2 = op2.registerID();
+        m_jit.addDouble(reg1, reg2, result.registerID());
+
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithSub: {
+        DoubleOperand op1(this, node.child1);
+        DoubleOperand op2(this, node.child2);
+        FPRTemporary result(this, op1);
+
+        MacroAssembler::FPRegisterID reg1 = op1.registerID();
+        MacroAssembler::FPRegisterID reg2 = op2.registerID();
+        m_jit.subDouble(reg1, reg2, result.registerID());
+
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithMul: {
+        DoubleOperand op1(this, node.child1);
+        DoubleOperand op2(this, node.child2);
+        FPRTemporary result(this, op1, op2);
+
+        MacroAssembler::FPRegisterID reg1 = op1.registerID();
+        MacroAssembler::FPRegisterID reg2 = op2.registerID();
+        m_jit.mulDouble(reg1, reg2, result.registerID());
+
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithDiv: {
+        DoubleOperand op1(this, node.child1);
+        DoubleOperand op2(this, node.child2);
+        FPRTemporary result(this, op1);
+
+        MacroAssembler::FPRegisterID reg1 = op1.registerID();
+        MacroAssembler::FPRegisterID reg2 = op2.registerID();
+        m_jit.divDouble(reg1, reg2, result.registerID());
+
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithMod: {
+        DoubleOperand arg1(this, node.child1);
+        DoubleOperand arg2(this, node.child2);
+        FPRReg arg1FPR = arg1.fpr();
+        FPRReg arg2FPR = arg2.fpr();
+        flushRegisters();
+
+        FPRResult result(this);
+        callOperation(fmod, result.fpr(), arg1FPR, arg2FPR);
+
+        doubleResult(result.fpr(), m_compileIndex);
+        break;
+    }
+
+    case LogicalNot: {
+        JSValueOperand arg1(this, node.child1);
+        GPRReg arg1GPR = arg1.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(dfgConvertJSValueToBoolean, result.gpr(), arg1GPR);
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.xor32(TrustedImm32(ValueTrue), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareLess: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationCompareLess, result.gpr(), arg1GPR, arg2GPR);
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareLessEq: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationCompareLessEq, result.gpr(), arg1GPR, arg2GPR);
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareEq: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationCompareEq, result.gpr(), arg1GPR, arg2GPR);
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareStrictEq: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationCompareStrictEq, result.gpr(), arg1GPR, arg2GPR);
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case GetByVal: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationGetByVal, result.gpr(), arg1GPR, arg2GPR);
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case PutByVal:
+    case PutByValAlias: {
+        JSValueOperand arg1(this, node.child1);
+        JSValueOperand arg2(this, node.child2);
+        JSValueOperand arg3(this, node.child3);
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg arg2GPR = arg2.gpr();
+        GPRReg arg3GPR = arg3.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByValStrict : operationPutByValNonStrict, arg1GPR, arg2GPR, arg3GPR);
+
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case GetById: {
+        JSValueOperand base(this, node.child1);
+        GPRReg baseGPR = base.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationGetById, result.gpr(), baseGPR, identifier(node.identifierNumber()));
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case PutById: {
+        JSValueOperand base(this, node.child1);
+        JSValueOperand value(this, node.child2);
+        GPRReg valueGPR = value.gpr();
+        GPRReg baseGPR = base.gpr();
+        flushRegisters();
+
+        callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByIdStrict : operationPutByIdNonStrict, valueGPR, baseGPR, identifier(node.identifierNumber()));
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case PutByIdDirect: {
+        JSValueOperand base(this, node.child1);
+        JSValueOperand value(this, node.child2);
+        GPRReg valueGPR = value.gpr();
+        GPRReg baseGPR = base.gpr();
+        flushRegisters();
+
+        callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByIdDirectStrict : operationPutByIdDirectNonStrict, valueGPR, baseGPR, identifier(node.identifierNumber()));
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case GetGlobalVar: {
+        GPRTemporary result(this);
+
+        JSVariableObject* globalObject = m_jit.codeBlock()->globalObject();
+        m_jit.loadPtr(globalObject->addressOfRegisters(), result.registerID());
+        m_jit.loadPtr(JITCompiler::addressForGlobalVar(result.registerID(), node.varNumber()), result.registerID());
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case PutGlobalVar: {
+        JSValueOperand value(this, node.child1);
+        GPRTemporary temp(this);
+
+        JSVariableObject* globalObject = m_jit.codeBlock()->globalObject();
+        m_jit.loadPtr(globalObject->addressOfRegisters(), temp.registerID());
+        m_jit.storePtr(value.registerID(), JITCompiler::addressForGlobalVar(temp.registerID(), node.varNumber()));
+
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case DFG::Jump: {
+        BlockIndex taken = m_jit.graph().blockIndexForBytecodeOffset(node.takenBytecodeOffset());
+        if (taken != (m_block + 1))
+            addBranch(m_jit.jump(), taken);
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case Branch: {
+        JSValueOperand value(this, node.child1);
+        GPRReg valueGPR = value.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(dfgConvertJSValueToBoolean, result.gpr(), valueGPR);
+
+        BlockIndex taken = m_jit.graph().blockIndexForBytecodeOffset(node.takenBytecodeOffset());
+        BlockIndex notTaken = m_jit.graph().blockIndexForBytecodeOffset(node.notTakenBytecodeOffset());
+
+        addBranch(m_jit.branchTest8(MacroAssembler::NonZero, result.registerID()), taken);
+        if (notTaken != (m_block + 1))
+            addBranch(m_jit.jump(), notTaken);
+
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case Return: {
+        ASSERT(JITCompiler::callFrameRegister != JITCompiler::regT1);
+        ASSERT(JITCompiler::regT1 != JITCompiler::returnValueRegister);
+        ASSERT(JITCompiler::returnValueRegister != JITCompiler::callFrameRegister);
+
+#if DFG_SUCCESS_STATS
+        static SamplingCounter counter("NonSpeculativeJIT");
+        m_jit.emitCount(counter);
+#endif
+
+        // Return the result in returnValueRegister.
+        JSValueOperand op1(this, node.child1);
+        m_jit.move(op1.registerID(), JITCompiler::returnValueRegister);
+
+        // Grab the return address.
+        m_jit.emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, JITCompiler::regT1);
+        // Restore our caller's "r".
+        m_jit.emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, JITCompiler::callFrameRegister);
+        // Return.
+        m_jit.restoreReturnAddressBeforeReturn(JITCompiler::regT1);
+        m_jit.ret();
+
+        noResult(m_compileIndex);
+        break;
+    }
+    }
+
+    if (node.mustGenerate())
+        use(m_compileIndex);
+
+    checkConsistency();
+}
+
+void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator, BasicBlock& block)
+{
+    ASSERT(m_compileIndex == block.begin);
+    m_blockHeads[m_block] = m_jit.label();
+
+#if DFG_JIT_BREAK_ON_EVERY_BLOCK
+    m_jit.breakpoint();
+#endif
+
+    for (; m_compileIndex < block.end; ++m_compileIndex) {
+        Node& node = m_jit.graph()[m_compileIndex];
+        if (!node.refCount)
+            continue;
+
+#if DFG_DEBUG_VERBOSE
+        fprintf(stderr, "NonSpeculativeJIT generating Node @%d at code offset 0x%x\n", (int)m_compileIndex, m_jit.debugOffset());
+#endif
+#if DFG_JIT_BREAK_ON_EVERY_NODE
+    m_jit.breakpoint();
+#endif
+
+        compile(checkIterator, node);
+    }
+}
+
+void NonSpeculativeJIT::compile(SpeculationCheckIndexIterator& checkIterator)
+{
+    ASSERT(!m_compileIndex);
+    Vector<BasicBlock> blocks = m_jit.graph().m_blocks;
+    for (m_block = 0; m_block < blocks.size(); ++m_block)
+        compile(checkIterator, blocks[m_block]);
+    linkBranches();
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.h
new file mode 100644
index 0000000..de4c04b
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGNonSpeculativeJIT.h
@@ -0,0 +1,259 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGNonSpeculativeJIT_h
+#define DFGNonSpeculativeJIT_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGJITCodeGenerator.h>
+
+namespace JSC { namespace DFG {
+
+class SpeculationCheckIndexIterator;
+
+// === EntryLocation ===
+//
+// This structure describes an entry point into the non-speculative
+// code path. This is used in linking bail-outs from the speculative path.
+struct EntryLocation {
+    EntryLocation(MacroAssembler::Label, NonSpeculativeJIT*);
+
+    // The node this entry point corresponds to, and the label
+    // marking the start of code for the given node.
+    MacroAssembler::Label m_entry;
+    NodeIndex m_nodeIndex;
+
+    // For every entry point we record a map recording for every
+    // machine register which, if any, values it contains. For
+    // GPR registers we must also record the format of the value.
+    struct RegisterInfo {
+        NodeIndex nodeIndex;
+        DataFormat format;
+    };
+    RegisterInfo m_gprInfo[numberOfGPRs];
+    NodeIndex m_fprInfo[numberOfFPRs];
+};
+
+// === NonSpeculativeJIT ===
+//
+// This class is used to generate code for the non-speculative path.
+// Code generation will take advantage of static information available
+// in the dataflow to perform safe optimizations - for example, avoiding
+// boxing numeric values between arithmetic operations, but will not
+// perform any unsafe optimizations that would render the code unable
+// to produce the correct results for any possible input.
+class NonSpeculativeJIT : public JITCodeGenerator {
+    friend struct EntryLocation;
+public:
+    NonSpeculativeJIT(JITCompiler& jit)
+        : JITCodeGenerator(jit, false)
+    {
+    }
+
+    void compile(SpeculationCheckIndexIterator&);
+
+    typedef SegmentedVector<EntryLocation, 16> EntryLocationVector;
+    EntryLocationVector& entryLocations() { return m_entryLocations; }
+
+private:
+    void compile(SpeculationCheckIndexIterator&, Node&);
+    void compile(SpeculationCheckIndexIterator&, BasicBlock&);
+
+    bool isKnownInteger(NodeIndex);
+    bool isKnownNumeric(NodeIndex);
+
+    // These methods are used when generating 'unexpected'
+    // calls out from JIT code to C++ helper routines -
+    // they spill all live values to the appropriate
+    // slots in the RegisterFile without changing any state
+    // in the GenerationInfo.
+    void silentSpillGPR(VirtualRegister spillMe, GPRReg exclude = InvalidGPRReg)
+    {
+        GenerationInfo& info = m_generationInfo[spillMe];
+        ASSERT(info.registerFormat() != DataFormatNone && info.registerFormat() != DataFormatDouble);
+
+        if (!info.needsSpill() || (info.gpr() == exclude))
+            return;
+
+        DataFormat registerFormat = info.registerFormat();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
+
+        if (registerFormat == DataFormatInteger) {
+            m_jit.orPtr(JITCompiler::tagTypeNumberRegister, reg);
+            m_jit.storePtr(reg, JITCompiler::addressFor(spillMe));
+        } else {
+            ASSERT(registerFormat & DataFormatJS || registerFormat == DataFormatCell);
+            m_jit.storePtr(reg, JITCompiler::addressFor(spillMe));
+        }
+    }
+    void silentSpillFPR(VirtualRegister spillMe, GPRReg canTrample, FPRReg exclude = InvalidFPRReg)
+    {
+        GenerationInfo& info = m_generationInfo[spillMe];
+        ASSERT(info.registerFormat() == DataFormatDouble);
+
+        if (!info.needsSpill() || (info.fpr() == exclude))
+            return;
+
+        boxDouble(info.fpr(), canTrample);
+        m_jit.storePtr(JITCompiler::gprToRegisterID(canTrample), JITCompiler::addressFor(spillMe));
+    }
+
+    void silentFillGPR(VirtualRegister spillMe, GPRReg exclude = InvalidGPRReg)
+    {
+        GenerationInfo& info = m_generationInfo[spillMe];
+        if (info.gpr() == exclude)
+            return;
+
+        NodeIndex nodeIndex = info.nodeIndex();
+        Node& node = m_jit.graph()[nodeIndex];
+        ASSERT(info.registerFormat() != DataFormatNone && info.registerFormat() != DataFormatDouble);
+        DataFormat registerFormat = info.registerFormat();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
+
+        if (registerFormat == DataFormatInteger) {
+            if (node.isConstant()) {
+                ASSERT(isInt32Constant(nodeIndex));
+                m_jit.move(Imm32(valueOfInt32Constant(nodeIndex)), reg);
+            } else
+                m_jit.load32(JITCompiler::addressFor(spillMe), reg);
+            return;
+        }
+
+        if (node.isConstant())
+            m_jit.move(constantAsJSValueAsImmPtr(nodeIndex), reg);
+        else {
+            ASSERT(registerFormat & DataFormatJS || registerFormat == DataFormatCell);
+            m_jit.loadPtr(JITCompiler::addressFor(spillMe), reg);
+        }
+    }
+    void silentFillFPR(VirtualRegister spillMe, GPRReg canTrample, FPRReg exclude = InvalidFPRReg)
+    {
+        GenerationInfo& info = m_generationInfo[spillMe];
+        if (info.fpr() == exclude)
+            return;
+
+        NodeIndex nodeIndex = info.nodeIndex();
+        Node& node = m_jit.graph()[nodeIndex];
+        ASSERT(info.registerFormat() == DataFormatDouble);
+
+        if (node.isConstant()) {
+            JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(info.gpr());
+            m_jit.move(constantAsJSValueAsImmPtr(nodeIndex), reg);
+        } else {
+            m_jit.loadPtr(JITCompiler::addressFor(spillMe), JITCompiler::gprToRegisterID(canTrample));
+            unboxDouble(canTrample, info.fpr());
+        }
+    }
+
+    void silentSpillAllRegisters(GPRReg exclude, GPRReg preserve = InvalidGPRReg)
+    {
+        GPRReg canTrample = (preserve == gpr0) ? gpr1 : gpr0;
+        
+        for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+            VirtualRegister name = m_gprs.name(gpr);
+            if (name != InvalidVirtualRegister)
+                silentSpillGPR(name, exclude);
+        }
+        for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+            VirtualRegister name = m_fprs.name(fpr);
+            if (name != InvalidVirtualRegister)
+                silentSpillFPR(name, canTrample);
+        }
+    }
+    void silentSpillAllRegisters(FPRReg exclude, GPRReg preserve = InvalidGPRReg)
+    {
+        GPRReg canTrample = (preserve == gpr0) ? gpr1 : gpr0;
+        
+        for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+            VirtualRegister name = m_gprs.name(gpr);
+            if (name != InvalidVirtualRegister)
+                silentSpillGPR(name);
+        }
+        for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+            VirtualRegister name = m_fprs.name(fpr);
+            if (name != InvalidVirtualRegister)
+                silentSpillFPR(name, canTrample, exclude);
+        }
+    }
+    void silentFillAllRegisters(GPRReg exclude)
+    {
+        GPRReg canTrample = (exclude == gpr0) ? gpr1 : gpr0;
+        
+        for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+            VirtualRegister name = m_fprs.name(fpr);
+            if (name != InvalidVirtualRegister)
+                silentFillFPR(name, canTrample);
+        }
+        for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+            VirtualRegister name = m_gprs.name(gpr);
+            if (name != InvalidVirtualRegister)
+                silentFillGPR(name, exclude);
+        }
+    }
+    void silentFillAllRegisters(FPRReg exclude)
+    {
+        GPRReg canTrample = gpr0;
+        
+        for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+            VirtualRegister name = m_fprs.name(fpr);
+            if (name != InvalidVirtualRegister) {
+#ifndef NDEBUG
+                ASSERT(fpr != exclude);
+#else
+                UNUSED_PARAM(exclude);
+#endif
+                silentFillFPR(name, canTrample, exclude);
+            }
+        }
+        for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+            VirtualRegister name = m_gprs.name(gpr);
+            if (name != InvalidVirtualRegister)
+                silentFillGPR(name);
+        }
+    }
+
+    // These methods are used to plant calls out to C++
+    // helper routines to convert between types.
+    void valueToNumber(JSValueOperand&, FPRReg result);
+    void valueToInt32(JSValueOperand&, GPRReg result);
+    void numberToInt32(FPRReg, GPRReg result);
+
+    // Record an entry location into the non-speculative code path;
+    // for every bail-out on the speculative path we record information
+    // to be able to re-enter into the non-speculative one.
+    void trackEntry(MacroAssembler::Label entry)
+    {
+        m_entryLocations.append(EntryLocation(entry, this));
+    }
+
+    EntryLocationVector m_entryLocations;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
+
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
new file mode 100644
index 0000000..a310d22
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -0,0 +1,245 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOperations.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "Interpreter.h"
+#include "JSByteArray.h"
+#include "JSGlobalData.h"
+#include "Operations.h"
+
+namespace JSC { namespace DFG {
+
+EncodedJSValue operationConvertThis(ExecState* exec, EncodedJSValue encodedOp)
+{
+    return JSValue::encode(JSValue::decode(encodedOp).toThisObject(exec));
+}
+
+EncodedJSValue operationValueAdd(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    if (op1.isInt32() && op2.isInt32()) {
+        int64_t result64 = static_cast<int64_t>(op1.asInt32()) + static_cast<int64_t>(op2.asInt32());
+        int32_t result32 = static_cast<int32_t>(result64);
+        if (LIKELY(result32 == result64))
+            return JSValue::encode(jsNumber(result32));
+        return JSValue::encode(jsNumber((double)result64));
+    }
+    
+    double number1;
+    double number2;
+    if (op1.getNumber(number1) && op2.getNumber(number2))
+        return JSValue::encode(jsNumber(number1 + number2));
+
+    return JSValue::encode(jsAddSlowCase(exec, op1, op2));
+}
+
+EncodedJSValue operationGetByVal(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty)
+{
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue property = JSValue::decode(encodedProperty);
+
+    if (LIKELY(baseValue.isCell())) {
+        JSCell* base = baseValue.asCell();
+
+        if (property.isUInt32()) {
+            JSGlobalData* globalData = &exec->globalData();
+            uint32_t i = property.asUInt32();
+
+            // FIXME: the JIT used to handle these in compiled code!
+            if (isJSArray(globalData, base) && asArray(base)->canGetIndex(i))
+                return JSValue::encode(asArray(base)->getIndex(i));
+
+            // FIXME: the JITstub used to relink this to an optimized form!
+            if (isJSString(globalData, base) && asString(base)->canGetIndex(i))
+                return JSValue::encode(asString(base)->getIndex(exec, i));
+
+            // FIXME: the JITstub used to relink this to an optimized form!
+            if (isJSByteArray(globalData, base) && asByteArray(base)->canAccessIndex(i))
+                return JSValue::encode(asByteArray(base)->getIndex(exec, i));
+
+            return JSValue::encode(baseValue.get(exec, i));
+        }
+
+        if (property.isString()) {
+            Identifier propertyName(exec, asString(property)->value(exec));
+            PropertySlot slot(base);
+            if (base->fastGetOwnPropertySlot(exec, propertyName, slot))
+                return JSValue::encode(slot.getValue(exec, propertyName));
+        }
+    }
+
+    Identifier ident(exec, property.toString(exec));
+    return JSValue::encode(baseValue.get(exec, ident));
+}
+
+EncodedJSValue operationGetById(ExecState* exec, EncodedJSValue encodedBase, Identifier* identifier)
+{
+    JSValue baseValue = JSValue::decode(encodedBase);
+    PropertySlot slot(baseValue);
+    return JSValue::encode(baseValue.get(exec, *identifier, slot));
+}
+
+template<bool strict>
+ALWAYS_INLINE static void operationPutByValInternal(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    JSGlobalData* globalData = &exec->globalData();
+
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue property = JSValue::decode(encodedProperty);
+    JSValue value = JSValue::decode(encodedValue);
+
+    if (LIKELY(property.isUInt32())) {
+        uint32_t i = property.asUInt32();
+
+        if (isJSArray(globalData, baseValue)) {
+            JSArray* jsArray = asArray(baseValue);
+            if (jsArray->canSetIndex(i)) {
+                jsArray->setIndex(*globalData, i, value);
+                return;
+            }
+
+            jsArray->JSArray::put(exec, i, value);
+            return;
+        }
+
+        if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+            JSByteArray* jsByteArray = asByteArray(baseValue);
+            // FIXME: the JITstub used to relink this to an optimized form!
+            if (value.isInt32()) {
+                jsByteArray->setIndex(i, value.asInt32());
+                return;
+            }
+
+            double dValue = 0;
+            if (value.getNumber(dValue)) {
+                jsByteArray->setIndex(i, dValue);
+                return;
+            }
+        }
+
+        baseValue.put(exec, i, value);
+        return;
+    }
+
+    // Don't put to an object if toString throws an exception.
+    Identifier ident(exec, property.toString(exec));
+    if (!globalData->exception) {
+        PutPropertySlot slot(strict);
+        baseValue.put(exec, ident, value, slot);
+    }
+}
+
+void operationPutByValStrict(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    operationPutByValInternal<true>(exec, encodedBase, encodedProperty, encodedValue);
+}
+
+void operationPutByValNonStrict(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    operationPutByValInternal<false>(exec, encodedBase, encodedProperty, encodedValue);
+}
+
+void operationPutByIdStrict(ExecState* exec, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier* identifier)
+{
+    PutPropertySlot slot(true);
+    JSValue::decode(encodedBase).put(exec, *identifier, JSValue::decode(encodedValue), slot);
+}
+
+void operationPutByIdNonStrict(ExecState* exec, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier* identifier)
+{
+    PutPropertySlot slot(false);
+    JSValue::decode(encodedBase).put(exec, *identifier, JSValue::decode(encodedValue), slot);
+}
+
+void operationPutByIdDirectStrict(ExecState* exec, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier* identifier)
+{
+    PutPropertySlot slot(true);
+    JSValue::decode(encodedBase).putDirect(exec, *identifier, JSValue::decode(encodedValue), slot);
+}
+
+void operationPutByIdDirectNonStrict(ExecState* exec, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier* identifier)
+{
+    PutPropertySlot slot(false);
+    JSValue::decode(encodedBase).putDirect(exec, *identifier, JSValue::decode(encodedValue), slot);
+}
+
+bool operationCompareLess(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    return jsLess(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+}
+
+bool operationCompareLessEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    return jsLessEq(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+}
+
+bool operationCompareEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    return JSValue::equal(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+}
+
+bool operationCompareStrictEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    return JSValue::strictEqual(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+}
+
+DFGHandler lookupExceptionHandler(ExecState* exec, ReturnAddressPtr faultLocation)
+{
+    JSValue exceptionValue = exec->exception();
+    ASSERT(exceptionValue);
+
+    unsigned vPCIndex = exec->codeBlock()->bytecodeOffset(faultLocation);
+    HandlerInfo* handler = exec->globalData().interpreter->throwException(exec, exceptionValue, vPCIndex);
+
+    void* catchRoutine = handler ? handler->nativeCode.executableAddress() : (void*)ctiOpThrowNotCaught;
+    ASSERT(catchRoutine);
+    return DFGHandler(exec, catchRoutine);
+}
+
+double dfgConvertJSValueToNumber(ExecState* exec, EncodedJSValue value)
+{
+    return JSValue::decode(value).toNumber(exec);
+}
+
+int32_t dfgConvertJSValueToInt32(ExecState* exec, EncodedJSValue value)
+{
+    return JSValue::decode(value).toInt32(exec);
+}
+
+bool dfgConvertJSValueToBoolean(ExecState* exec, EncodedJSValue encodedOp)
+{
+    return JSValue::decode(encodedOp).toBoolean(exec);
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
new file mode 100644
index 0000000..d4c7c0f
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGOperations_h
+#define DFGOperations_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGJITCompiler.h>
+
+namespace JSC {
+
+class Identifier;
+
+namespace DFG {
+
+// These typedefs provide typechecking when generating calls out to helper routines;
+// this helps prevent calling a helper routine with the wrong arguments!
+typedef EncodedJSValue (*J_DFGOperation_EJJ)(ExecState*, EncodedJSValue, EncodedJSValue);
+typedef EncodedJSValue (*J_DFGOperation_EJ)(ExecState*, EncodedJSValue);
+typedef EncodedJSValue (*J_DFGOperation_EJP)(ExecState*, EncodedJSValue, void*);
+typedef EncodedJSValue (*J_DFGOperation_EJI)(ExecState*, EncodedJSValue, Identifier*);
+typedef bool (*Z_DFGOperation_EJ)(ExecState*, EncodedJSValue);
+typedef bool (*Z_DFGOperation_EJJ)(ExecState*, EncodedJSValue, EncodedJSValue);
+typedef void (*V_DFGOperation_EJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
+typedef void (*V_DFGOperation_EJJP)(ExecState*, EncodedJSValue, EncodedJSValue, void*);
+typedef void (*V_DFGOperation_EJJI)(ExecState*, EncodedJSValue, EncodedJSValue, Identifier*);
+typedef double (*D_DFGOperation_DD)(double, double);
+
+// These routines are provide callbacks out to C++ implementations of operations too complex to JIT.
+EncodedJSValue operationConvertThis(ExecState*, EncodedJSValue encodedOp1);
+EncodedJSValue operationValueAdd(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
+EncodedJSValue operationGetByVal(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty);
+EncodedJSValue operationGetById(ExecState*, EncodedJSValue encodedBase, Identifier*);
+void operationPutByValStrict(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue);
+void operationPutByValNonStrict(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue);
+void operationPutByIdStrict(ExecState*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier*);
+void operationPutByIdNonStrict(ExecState*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier*);
+void operationPutByIdDirectStrict(ExecState*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier*);
+void operationPutByIdDirectNonStrict(ExecState*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, Identifier*);
+bool operationCompareLess(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
+bool operationCompareLessEq(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
+bool operationCompareEq(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
+bool operationCompareStrictEq(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2);
+
+// This method is used to lookup an exception hander, keyed by faultLocation, which is
+// the return location from one of the calls out to one of the helper operations above.
+struct DFGHandler {
+    DFGHandler(ExecState* exec, void* handler)
+        : exec(exec)
+        , handler(handler)
+    {
+    }
+
+    ExecState* exec;
+    void* handler;
+};
+DFGHandler lookupExceptionHandler(ExecState*, ReturnAddressPtr faultLocation);
+
+// These operations implement the implicitly called ToInt32, ToNumber, and ToBoolean conversions from ES5.
+double dfgConvertJSValueToNumber(ExecState*, EncodedJSValue);
+int32_t dfgConvertJSValueToInt32(ExecState*, EncodedJSValue);
+bool dfgConvertJSValueToBoolean(ExecState*, EncodedJSValue);
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGRegisterBank.h b/Source/JavaScriptCore/dfg/DFGRegisterBank.h
new file mode 100644
index 0000000..575e6b7
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGRegisterBank.h
@@ -0,0 +1,253 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGRegisterBank_h
+#define DFGRegisterBank_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGJITCompiler.h>
+
+namespace JSC { namespace DFG {
+
+// === RegisterBank ===
+//
+// This class is used to implement the GPR and FPR register banks.
+// All registers have two pieces of state associated with them:
+// a lock count (used to indicate this register is already in use
+// in code generation of the current node, and cannot be spilled or
+// allocated as a temporary), and VirtualRegister 'name', recording
+// which value (if any) a machine register currently holds.
+// Either or both of these pieces of information may be valid for a
+// given register. A register may be:
+//
+//  - unlocked, and unnamed: Available for allocation.
+//  - locked, but unnamed:   Already allocated as a temporary or
+//                           result for the current node.
+//  - unlocked, but named:   Contains the result of a prior operation,
+//                           not yet in use for this node,
+//  - locked, but named:     Contains the result of a prior operation,
+//                           already allocated as a operand to the
+//                           current operation.
+//
+// For every named register we also record a hint value indicating
+// the order in which registers should be selected to be spilled;
+// registers that can be more cheaply spilled and/or filled should
+// be selected first.
+//
+// Locking register is a strong retention mechanism; a locked register
+// will never be reallocated (this is used to ensure the operands to
+// the current node are in registers). Naming, conversely, in a weak
+// retention mechanism - allocating a register may force a named value
+// to be spilled.
+//
+// All named values must be given a hint that is greater than Min and
+// less than Max.
+template<typename RegID, size_t NUM_REGS, typename SpillHint, SpillHint SpillHintMin, SpillHint SpillHintMax>
+class RegisterBank {
+public:
+    RegisterBank()
+        : m_lastAllocated(NUM_REGS - 1)
+    {
+    }
+
+    // Allocate a register - this function finds an unlocked register,
+    // locks it, and returns it. If any named registers exist, one
+    // of these should be selected to be allocated. If all unlocked
+    // registers are named, then one of the named registers will need
+    // to be spilled. In this case the register selected to be spilled
+    // will be one of the registers that has the lowest 'spillOrder'
+    // cost associated with it.
+    //
+    // This method select the register to be allocated, and calls the
+    // private 'allocateInternal' method to update internal data
+    // structures accordingly.
+    RegID allocate(VirtualRegister &spillMe)
+    {
+        uint32_t currentLowest = NUM_REGS;
+        SpillHint currentSpillOrder = SpillHintMax;
+
+        // Scan through all register, starting at the last allocated & looping around.
+        ASSERT(m_lastAllocated < NUM_REGS);
+
+        // This loop is broken into two halves, looping from the last allocated
+        // register (the register returned last time this method was called) to
+        // the maximum register value, then from 0 to the last allocated.
+        // This implements a simple round-robin like approach to try to reduce
+        // thrash, and minimize time spent scanning locked registers in allocation.
+        // If a unlocked and unnamed register is found return it immediately.
+        // Otherwise, find the first unlocked register with the lowest spillOrder.
+        for (uint32_t i = m_lastAllocated + 1; i < NUM_REGS; ++i) {
+            // (1) If the current register is locked, it is not a candidate.
+            if (m_data[i].lockCount)
+                continue;
+            // (2) If the current register's spill order is 0, pick this! – unassigned registers have spill order 0.
+            SpillHint spillOrder = m_data[i].spillOrder;
+            if (!spillOrder)
+                return allocateInternal(i, spillMe);
+            // If this register is better (has a lower spill order value) than any prior
+            // candidate, then record it.
+            if (spillOrder < currentSpillOrder) {
+                currentSpillOrder = spillOrder;
+                currentLowest = i;
+            }
+        }
+        // Loop over the remaining entries.
+        for (uint32_t i = 0; i <= m_lastAllocated; ++i) {
+            if (m_data[i].lockCount)
+                continue;
+            SpillHint spillOrder = m_data[i].spillOrder;
+            if (!spillOrder)
+                return allocateInternal(i, spillMe);
+            if (spillOrder < currentSpillOrder) {
+                currentSpillOrder = spillOrder;
+                currentLowest = i;
+            }
+        }
+
+        // Deadlock check - this could only occur is all registers are locked!
+        ASSERT(currentLowest != NUM_REGS && currentSpillOrder != SpillHintMax);
+        // There were no available registers; currentLowest will need to be spilled.
+        return allocateInternal(currentLowest, spillMe);
+    }
+
+    // retain/release - these methods are used to associate/disassociate names
+    // with values in registers. retain should only be called on locked registers.
+    void retain(RegID reg, VirtualRegister name, SpillHint spillOrder)
+    {
+        // 'reg' must be a valid, locked register.
+        ASSERT(reg < NUM_REGS);
+        ASSERT(m_data[reg].lockCount);
+        // 'reg' should not currently be named, the new name must be valid.
+        ASSERT(m_data[reg].name == InvalidVirtualRegister);
+        ASSERT(name != InvalidVirtualRegister);
+        // 'reg' should not currently have a spillOrder, the new spill order must be valid.
+        ASSERT(spillOrder && spillOrder < SpillHintMax);
+        ASSERT(m_data[reg].spillOrder == SpillHintMin);
+
+        m_data[reg].name = name;
+        m_data[reg].spillOrder = spillOrder;
+    }
+    void release(RegID reg)
+    {
+        // 'reg' must be a valid register.
+        ASSERT(reg < NUM_REGS);
+        // 'reg' should currently be named.
+        ASSERT(m_data[reg].name != InvalidVirtualRegister);
+        // 'reg' should currently have a valid spill order.
+        ASSERT(m_data[reg].spillOrder > SpillHintMin && m_data[reg].spillOrder < SpillHintMax);
+
+        m_data[reg].name = InvalidVirtualRegister;
+        m_data[reg].spillOrder = SpillHintMin;
+    }
+
+    // lock/unlock register, ensures that they are not spilled.
+    void lock(RegID reg)
+    {
+        ASSERT(reg < NUM_REGS);
+        ++m_data[reg].lockCount;
+        ASSERT(m_data[reg].lockCount);
+    }
+    void unlock(RegID reg)
+    {
+        ASSERT(reg < NUM_REGS);
+        ASSERT(m_data[reg].lockCount);
+        --m_data[reg].lockCount;
+    }
+    bool isLocked(RegID reg)
+    {
+        ASSERT(reg < NUM_REGS);
+        return m_data[reg].lockCount;
+    }
+
+    // Get the name (VirtualRegister) associated with the
+    // given register (or InvalidVirtualRegister for none).
+    VirtualRegister name(RegID reg)
+    {
+        ASSERT(reg < NUM_REGS);
+        return m_data[reg].name;
+    }
+
+#ifndef NDEBUG
+    void dump()
+    {
+        // For each register, print the VirtualRegister 'name'.
+        for (uint32_t i =0; i < NUM_REGS; ++i) {
+            if (m_data[i].name != InvalidVirtualRegister)
+                fprintf(stderr, "[%02d]", m_data[i].name);
+            else
+                fprintf(stderr, "[--]");
+        }
+        fprintf(stderr, "\n");
+    }
+#endif
+
+private:
+    // Used by 'allocate', above, to update inforamtion in the map.
+    RegID allocateInternal(uint32_t i, VirtualRegister &spillMe)
+    {
+        // 'i' must be a valid, unlocked register.
+        ASSERT(i < NUM_REGS && !m_data[i].lockCount);
+
+        // Return the VirtualRegister of the named value currently stored in
+        // the register being returned - or InvalidVirtualRegister if none.
+        spillMe = m_data[i].name;
+
+        // Clear any name/spillOrder currently associated with the register,
+        m_data[i] = MapEntry();
+        m_data[i].lockCount = 1;
+        // Mark the register as locked (with a lock count of 1).
+        m_lastAllocated = i;
+        return (RegID)i;
+    }
+
+    // === MapEntry ===
+    //
+    // This structure provides information for an individual machine register
+    // being managed by the RegisterBank. For each register we track a lock
+    // count, name and spillOrder hint.
+    struct MapEntry {
+        MapEntry()
+            : name(InvalidVirtualRegister)
+            , spillOrder(SpillHintMin)
+            , lockCount(0)
+        {
+        }
+
+        VirtualRegister name;
+        SpillHint spillOrder;
+        uint32_t lockCount;
+    };
+
+    // Holds the current status of all registers.
+    MapEntry m_data[NUM_REGS];
+    // Used to to implement a simple round-robin like allocation scheme.
+    uint32_t m_lastAllocated;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGScoreBoard.h b/Source/JavaScriptCore/dfg/DFGScoreBoard.h
new file mode 100644
index 0000000..b9bf1fd
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGScoreBoard.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGScoreBoard_h
+#define DFGScoreBoard_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGGraph.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+// === ScoreBoard ===
+//
+// This class is used in performing a virtual register allocation over the graph.
+// VirtualRegisters are allocated to nodes, with a used count for each virtual
+// register tracking the lifespan of the value; after the final use of a node
+// the VirtualRegister associated is freed such that it can be reused for
+// another node.
+class ScoreBoard {
+public:
+    ScoreBoard(Graph& graph, uint32_t firstTemporary)
+        : m_graph(graph)
+        , m_firstTemporary(firstTemporary)
+    {
+    }
+
+#if DFG_CONSISTENCY_CHECK
+    ~ScoreBoard()
+    {
+        // Every VirtualRegister that was allocated should now be free.
+        ASSERT(m_used.size() == m_free.size());
+        // For every entry in the free list, the use count of the virtual register should be zero.
+        // * By using the virtual register numbers from m_free, we are checking that all values
+        //   in m_free are < m_used.size(), and correspond to an allocated VirtualRegsiter.
+        // * By setting m_used to a non-zero value after checking it, we are checking that all
+        //   entries in m_free are unique (otherwise the second test of m_used will fail).
+        for (size_t i = 0; i < m_free.size(); ++i) {
+            uint32_t virtualRegister = m_free[i];
+            ASSERT(!m_used[virtualRegister]);
+            m_used[virtualRegister] = 1;
+        }
+    }
+#endif
+
+    VirtualRegister allocate()
+    {
+        // Do we have any VirtualRegsiters in the free list, that were used by
+        // prior nodes, but are now available?
+        if (!m_free.isEmpty()) {
+            uint32_t index = m_free.last();
+            m_free.removeLast();
+            // Use count must have hit zero for it to have been added to the free list!
+            ASSERT(!m_used[index]);
+            return (VirtualRegister)(m_firstTemporary + index);
+        }
+
+        // Allocate a new VirtualRegister, and add a corresponding entry to m_used.
+        size_t next = allocatedCount();
+        m_used.append(0);
+        return (VirtualRegister)(m_firstTemporary + next);
+    }
+
+    // Increment the usecount for the VirtualRegsiter associated with 'child',
+    // if it reaches the node's refcount, free the VirtualRegsiter.
+    void use(NodeIndex child)
+    {
+        if (child == NoNode)
+            return;
+
+        // Find the virtual register number for this child, increment its use count.
+        Node& node = m_graph[child];
+        uint32_t index = node.virtualRegister - m_firstTemporary;
+        if (node.refCount == ++m_used[index]) {
+            // If the use count in the scoreboard reaches the use count for the node,
+            // then this was its last use; the virtual register is now free.
+            // Clear the use count & add to the free list.
+            m_used[index] = 0;
+            m_free.append(index);
+        }
+    }
+
+    unsigned allocatedCount()
+    {
+        // m_used contains an entry for every allocated VirtualRegister.
+        return m_used.size();
+    }
+
+private:
+    // The graph, so we can get refCounts for nodes, to determine when values are dead.
+    Graph& m_graph;
+    // The first VirtualRegsiter to be used as a temporary.
+    uint32_t m_firstTemporary;
+    
+    // For every virtual register that has been allocated (either currently alive, or in
+    // the free list), we keep a count of the number of remaining uses until it is dead
+    // (0, in the case of entries in the free list). Since there is an entry for every
+    // allocated VirtualRegister, the length of this array conveniently provides the
+    // next available VirtualRegister number.
+    Vector<uint32_t, 64> m_used;
+    // A free list of VirtualRegsiters no longer alive.
+    Vector<uint32_t, 64> m_free;
+};
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
new file mode 100644
index 0000000..7963184
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -0,0 +1,824 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGSpeculativeJIT.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+template<bool strict>
+GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat& returnFormat)
+{
+    Node& node = m_jit.graph()[nodeIndex];
+    VirtualRegister virtualRegister = node.virtualRegister;
+    GenerationInfo& info = m_generationInfo[virtualRegister];
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        GPRReg gpr = allocate();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+
+        if (node.isConstant()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            if (isInt32Constant(nodeIndex)) {
+                m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), reg);
+                info.fillInteger(gpr);
+                returnFormat = DataFormatInteger;
+                return gpr;
+            }
+            m_jit.move(constantAsJSValueAsImmPtr(nodeIndex), reg);
+        } else {
+            DataFormat spillFormat = info.spillFormat();
+            ASSERT(spillFormat & DataFormatJS);
+
+            m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+
+            if (spillFormat == DataFormatJSInteger) {
+                // If we know this was spilled as an integer we can fill without checking.
+                if (strict) {
+                    m_jit.load32(JITCompiler::addressFor(virtualRegister), reg);
+                    info.fillInteger(gpr);
+                    returnFormat = DataFormatInteger;
+                    return gpr;
+                }
+                m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
+                info.fillJSValue(gpr, DataFormatJSInteger);
+                returnFormat = DataFormatJSInteger;
+                return gpr;
+            }
+            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
+        }
+
+        // Fill as JSValue, and fall through.
+        info.fillJSValue(gpr, DataFormatJSInteger);
+        m_gprs.unlock(gpr);
+    }
+
+    case DataFormatJS: {
+        // Check the value is an integer.
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+        speculationCheck(m_jit.branchPtr(MacroAssembler::Below, reg, JITCompiler::tagTypeNumberRegister));
+        info.fillJSValue(gpr, DataFormatJSInteger);
+        // If !strict we're done, return.
+        if (!strict) {
+            returnFormat = DataFormatJSInteger;
+            return gpr;
+        }
+        // else fall through & handle as DataFormatJSInteger.
+        m_gprs.unlock(gpr);
+    }
+
+    case DataFormatJSInteger: {
+        // In a strict fill we need to strip off the value tag.
+        if (strict) {
+            GPRReg gpr = info.gpr();
+            GPRReg result;
+            // If the register has already been locked we need to take a copy.
+            // If not, we'll zero extend in place, so mark on the info that this is now type DataFormatInteger, not DataFormatJSInteger.
+            if (m_gprs.isLocked(gpr))
+                result = allocate();
+            else {
+                m_gprs.lock(gpr);
+                info.fillInteger(gpr);
+                result = gpr;
+            }
+            m_jit.zeroExtend32ToPtr(JITCompiler::gprToRegisterID(gpr), JITCompiler::gprToRegisterID(result));
+            returnFormat = DataFormatInteger;
+            return result;
+        }
+
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        returnFormat = DataFormatJSInteger;
+        return gpr;
+    }
+
+    case DataFormatInteger: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        returnFormat = DataFormatInteger;
+        return gpr;
+    }
+
+    case DataFormatDouble:
+    case DataFormatCell:
+    case DataFormatJSDouble:
+    case DataFormatJSCell: {
+        terminateSpeculativeExecution();
+        returnFormat = DataFormatInteger;
+        return allocate();
+    }
+    }
+
+    ASSERT_NOT_REACHED();
+    return InvalidGPRReg;
+}
+
+SpeculationCheck::SpeculationCheck(MacroAssembler::Jump check, SpeculativeJIT* jit, unsigned recoveryIndex)
+    : m_check(check)
+    , m_nodeIndex(jit->m_compileIndex)
+    , m_recoveryIndex(recoveryIndex)
+{
+    for (GPRReg gpr = gpr0; gpr < numberOfGPRs; next(gpr)) {
+        VirtualRegister virtualRegister = jit->m_gprs.name(gpr);
+        if (virtualRegister != InvalidVirtualRegister) {
+            GenerationInfo& info =  jit->m_generationInfo[virtualRegister];
+            m_gprInfo[gpr].nodeIndex = info.nodeIndex();
+            m_gprInfo[gpr].format = info.registerFormat();
+        } else
+            m_gprInfo[gpr].nodeIndex = NoNode;
+    }
+    for (FPRReg fpr = fpr0; fpr < numberOfFPRs; next(fpr)) {
+        VirtualRegister virtualRegister = jit->m_fprs.name(fpr);
+        if (virtualRegister != InvalidVirtualRegister) {
+            GenerationInfo& info =  jit->m_generationInfo[virtualRegister];
+            ASSERT(info.registerFormat() == DataFormatDouble);
+            m_fprInfo[fpr] = info.nodeIndex();
+        } else
+            m_fprInfo[fpr] = NoNode;
+    }
+}
+
+GPRReg SpeculativeJIT::fillSpeculateInt(NodeIndex nodeIndex, DataFormat& returnFormat)
+{
+    return fillSpeculateIntInternal<false>(nodeIndex, returnFormat);
+}
+
+GPRReg SpeculativeJIT::fillSpeculateIntStrict(NodeIndex nodeIndex)
+{
+    DataFormat mustBeDataFormatInteger;
+    GPRReg result = fillSpeculateIntInternal<true>(nodeIndex, mustBeDataFormatInteger);
+    ASSERT(mustBeDataFormatInteger == DataFormatInteger);
+    return result;
+}
+
+GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
+{
+    Node& node = m_jit.graph()[nodeIndex];
+    VirtualRegister virtualRegister = node.virtualRegister;
+    GenerationInfo& info = m_generationInfo[virtualRegister];
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        GPRReg gpr = allocate();
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+
+        if (node.isConstant()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            JSValue jsValue = constantAsJSValue(nodeIndex);
+            if (jsValue.isCell()) {
+                m_jit.move(MacroAssembler::TrustedImmPtr(jsValue.asCell()), reg);
+                info.fillJSValue(gpr, DataFormatJSCell);
+                return gpr;
+            }
+            terminateSpeculativeExecution();
+            return gpr;
+        }
+        ASSERT(info.spillFormat() & DataFormatJS);
+        m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+        m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), reg);
+
+        if (info.spillFormat() != DataFormatJSCell)
+            speculationCheck(m_jit.branchTestPtr(MacroAssembler::NonZero, reg, JITCompiler::tagMaskRegister));
+        info.fillJSValue(gpr, DataFormatJSCell);
+        return gpr;
+    }
+
+    case DataFormatCell:
+    case DataFormatJSCell: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        return gpr;
+    }
+
+    case DataFormatJS: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        JITCompiler::RegisterID reg = JITCompiler::gprToRegisterID(gpr);
+        speculationCheck(m_jit.branchTestPtr(MacroAssembler::NonZero, reg, JITCompiler::tagMaskRegister));
+        info.fillJSValue(gpr, DataFormatJSCell);
+        return gpr;
+    }
+
+    case DataFormatJSInteger:
+    case DataFormatInteger:
+    case DataFormatJSDouble:
+    case DataFormatDouble: {
+        terminateSpeculativeExecution();
+        return allocate();
+    }
+    }
+
+    ASSERT_NOT_REACHED();
+    return InvalidGPRReg;
+}
+
+bool SpeculativeJIT::compile(Node& node)
+{
+    checkConsistency();
+    NodeType op = node.op;
+
+    switch (op) {
+    case Int32Constant:
+    case DoubleConstant:
+    case JSConstant:
+        initConstantInfo(m_compileIndex);
+        break;
+
+    case GetLocal: {
+        GPRTemporary result(this);
+        m_jit.loadPtr(JITCompiler::addressFor(node.local()), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case SetLocal: {
+        JSValueOperand value(this, node.child1);
+        m_jit.storePtr(value.registerID(), JITCompiler::addressFor(node.local()));
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+        if (isInt32Constant(node.child1)) {
+            SpeculateIntegerOperand op2(this, node.child2);
+            GPRTemporary result(this, op2);
+
+            bitOp(op, valueOfInt32Constant(node.child1), op2.registerID(), result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        } else if (isInt32Constant(node.child2)) {
+            SpeculateIntegerOperand op1(this, node.child1);
+            GPRTemporary result(this, op1);
+
+            bitOp(op, valueOfInt32Constant(node.child2), op1.registerID(), result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        } else {
+            SpeculateIntegerOperand op1(this, node.child1);
+            SpeculateIntegerOperand op2(this, node.child2);
+            GPRTemporary result(this, op1, op2);
+
+            MacroAssembler::RegisterID reg1 = op1.registerID();
+            MacroAssembler::RegisterID reg2 = op2.registerID();
+            bitOp(op, reg1, reg2, result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        }
+        break;
+
+    case BitRShift:
+    case BitLShift:
+    case BitURShift:
+        if (isInt32Constant(node.child2)) {
+            SpeculateIntegerOperand op1(this, node.child1);
+            GPRTemporary result(this, op1);
+
+            shiftOp(op, op1.registerID(), valueOfInt32Constant(node.child2) & 0x1f, result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        } else {
+            // Do not allow shift amount to be used as the result, MacroAssembler does not permit this.
+            SpeculateIntegerOperand op1(this, node.child1);
+            SpeculateIntegerOperand op2(this, node.child2);
+            GPRTemporary result(this, op1);
+
+            MacroAssembler::RegisterID reg1 = op1.registerID();
+            MacroAssembler::RegisterID reg2 = op2.registerID();
+            shiftOp(op, reg1, reg2, result.registerID());
+
+            integerResult(result.gpr(), m_compileIndex);
+        }
+        break;
+
+    case UInt32ToNumber: {
+        IntegerOperand op1(this, node.child1);
+        GPRTemporary result(this, op1);
+
+        // Test the operand is positive.
+        speculationCheck(m_jit.branch32(MacroAssembler::LessThan, op1.registerID(), TrustedImm32(0)));
+
+        m_jit.move(op1.registerID(), result.registerID());
+        integerResult(result.gpr(), m_compileIndex, op1.format());
+        break;
+    }
+
+    case NumberToInt32: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        GPRTemporary result(this, op1);
+        m_jit.move(op1.registerID(), result.registerID());
+        integerResult(result.gpr(), m_compileIndex, op1.format());
+        break;
+    }
+
+    case Int32ToNumber: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        GPRTemporary result(this, op1);
+        m_jit.move(op1.registerID(), result.registerID());
+        integerResult(result.gpr(), m_compileIndex, op1.format());
+        break;
+    }
+
+    case ValueToInt32: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        GPRTemporary result(this, op1);
+        m_jit.move(op1.registerID(), result.registerID());
+        integerResult(result.gpr(), m_compileIndex, op1.format());
+        break;
+    }
+
+    case ValueToNumber: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        GPRTemporary result(this, op1);
+        m_jit.move(op1.registerID(), result.registerID());
+        integerResult(result.gpr(), m_compileIndex, op1.format());
+        break;
+    }
+
+    case ValueAdd:
+    case ArithAdd: {
+        int32_t imm1;
+        if (isDoubleConstantWithInt32Value(node.child1, imm1)) {
+            SpeculateIntegerOperand op2(this, node.child2);
+            GPRTemporary result(this);
+
+            MacroAssembler::RegisterID reg = op2.registerID();
+            speculationCheck(m_jit.branchAdd32(MacroAssembler::Overflow, reg, Imm32(imm1), result.registerID()));
+
+            integerResult(result.gpr(), m_compileIndex);
+            break;
+        }
+            
+        int32_t imm2;
+        if (isDoubleConstantWithInt32Value(node.child2, imm2)) {
+            SpeculateIntegerOperand op1(this, node.child1);
+            GPRTemporary result(this);
+
+            MacroAssembler::RegisterID reg = op1.registerID();
+            speculationCheck(m_jit.branchAdd32(MacroAssembler::Overflow, reg, Imm32(imm2), result.registerID()));
+
+            integerResult(result.gpr(), m_compileIndex);
+            break;
+        }
+            
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        GPRReg gpr1 = op1.gpr();
+        GPRReg gpr2 = op2.gpr();
+        GPRReg gprResult = result.gpr();
+        MacroAssembler::Jump check = m_jit.branchAdd32(MacroAssembler::Overflow, JITCompiler::gprToRegisterID(gpr1), JITCompiler::gprToRegisterID(gpr2), JITCompiler::gprToRegisterID(gprResult));
+
+        if (gpr1 == gprResult)
+            speculationCheck(check, SpeculationRecovery(SpeculativeAdd, gprResult, gpr2));
+        else if (gpr2 == gprResult)
+            speculationCheck(check, SpeculationRecovery(SpeculativeAdd, gprResult, gpr1));
+        else
+            speculationCheck(check);
+
+        integerResult(gprResult, m_compileIndex);
+        break;
+    }
+
+    case ArithSub: {
+        int32_t imm2;
+        if (isDoubleConstantWithInt32Value(node.child2, imm2)) {
+            SpeculateIntegerOperand op1(this, node.child1);
+            GPRTemporary result(this);
+
+            MacroAssembler::RegisterID reg = op1.registerID();
+            speculationCheck(m_jit.branchSub32(MacroAssembler::Overflow, reg, Imm32(imm2), result.registerID()));
+
+            integerResult(result.gpr(), m_compileIndex);
+            break;
+        }
+            
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this);
+
+        MacroAssembler::RegisterID reg1 = op1.registerID();
+        MacroAssembler::RegisterID reg2 = op2.registerID();
+        speculationCheck(m_jit.branchSub32(MacroAssembler::Overflow, reg1, reg2, result.registerID()));
+
+        integerResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithMul: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this);
+
+        MacroAssembler::RegisterID reg1 = op1.registerID();
+        MacroAssembler::RegisterID reg2 = op2.registerID();
+        speculationCheck(m_jit.branchMul32(MacroAssembler::Overflow, reg1, reg2, result.registerID()));
+
+        MacroAssembler::Jump resultNonZero = m_jit.branchTest32(MacroAssembler::NonZero, result.registerID());
+        speculationCheck(m_jit.branch32(MacroAssembler::LessThan, reg1, TrustedImm32(0)));
+        speculationCheck(m_jit.branch32(MacroAssembler::LessThan, reg2, TrustedImm32(0)));
+        resultNonZero.link(&m_jit);
+
+        integerResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithDiv: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        terminateSpeculativeExecution();
+
+        integerResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case ArithMod: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        terminateSpeculativeExecution();
+
+        integerResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case LogicalNot: {
+        JSValueOperand value(this, node.child1);
+        GPRTemporary result(this); // FIXME: We could reuse, but on speculation fail would need recovery to restore tag (akin to add).
+
+        m_jit.move(value.registerID(), result.registerID());
+        m_jit.xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), result.registerID());
+        speculationCheck(m_jit.branchTestPtr(JITCompiler::NonZero, result.registerID(), TrustedImm32(static_cast<int32_t>(~1))));
+        m_jit.xorPtr(TrustedImm32(static_cast<int32_t>(ValueTrue)), result.registerID());
+
+        // If we add a DataFormatBool, we should use it here.
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareLess: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        m_jit.set32Compare32(JITCompiler::LessThan, op1.registerID(), op2.registerID(), result.registerID());
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareLessEq: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        m_jit.set32Compare32(JITCompiler::LessThanOrEqual, op1.registerID(), op2.registerID(), result.registerID());
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareEq: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        m_jit.set32Compare32(JITCompiler::Equal, op1.registerID(), op2.registerID(), result.registerID());
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case CompareStrictEq: {
+        SpeculateIntegerOperand op1(this, node.child1);
+        SpeculateIntegerOperand op2(this, node.child2);
+        GPRTemporary result(this, op1, op2);
+
+        m_jit.set32Compare32(JITCompiler::Equal, op1.registerID(), op2.registerID(), result.registerID());
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.or32(TrustedImm32(ValueFalse), result.registerID());
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case GetByVal: {
+        NodeIndex alias = node.child3;
+        if (alias != NoNode) {
+            // FIXME: result should be able to reuse child1, child2. Should have an 'UnusedOperand' type.
+            JSValueOperand aliasedValue(this, node.child3);
+            GPRTemporary result(this, aliasedValue);
+            m_jit.move(aliasedValue.registerID(), result.registerID());
+            jsValueResult(result.gpr(), m_compileIndex);
+            break;
+        }
+
+        SpeculateCellOperand base(this, node.child1);
+        SpeculateStrictInt32Operand property(this, node.child2);
+        GPRTemporary storage(this);
+
+        MacroAssembler::RegisterID baseReg = base.registerID();
+        MacroAssembler::RegisterID propertyReg = property.registerID();
+        MacroAssembler::RegisterID storageReg = storage.registerID();
+
+        // Get the array storage. We haven't yet checked this is a JSArray, so this is only safe if
+        // an access with offset JSArray::storageOffset() is valid for all JSCells!
+        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
+
+        // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
+        speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
+        speculationCheck(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
+
+        // FIXME: In cases where there are subsequent by_val accesses to the same base it might help to cache
+        // the storage pointer - especially if there happens to be another register free right now. If we do so,
+        // then we'll need to allocate a new temporary for result.
+        GPRTemporary& result = storage;
+        m_jit.loadPtr(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), result.registerID());
+        speculationCheck(m_jit.branchTestPtr(MacroAssembler::Zero, result.registerID()));
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case PutByVal: {
+        SpeculateCellOperand base(this, node.child1);
+        SpeculateStrictInt32Operand property(this, node.child2);
+        JSValueOperand value(this, node.child3);
+        GPRTemporary storage(this);
+
+        // Map base, property & value into registers, allocate a register for storage.
+        MacroAssembler::RegisterID baseReg = base.registerID();
+        MacroAssembler::RegisterID propertyReg = property.registerID();
+        MacroAssembler::RegisterID valueReg = value.registerID();
+        MacroAssembler::RegisterID storageReg = storage.registerID();
+
+        // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
+        speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg), MacroAssembler::TrustedImmPtr(m_jit.globalData()->jsArrayVPtr)));
+        speculationCheck(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
+
+        // Get the array storage.
+        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
+
+        // Check if we're writing to a hole; if so increment m_numValuesInVector.
+        MacroAssembler::Jump notHoleValue = m_jit.branchTestPtr(MacroAssembler::NonZero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+        m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+
+        // If we're writing to a hole we might be growing the array; 
+        MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+        m_jit.add32(TrustedImm32(1), propertyReg);
+        m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+        m_jit.sub32(TrustedImm32(1), propertyReg);
+
+        lengthDoesNotNeedUpdate.link(&m_jit);
+        notHoleValue.link(&m_jit);
+
+        // Store the value to the array.
+        m_jit.storePtr(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case PutByValAlias: {
+        SpeculateCellOperand base(this, node.child1);
+        SpeculateStrictInt32Operand property(this, node.child2);
+        JSValueOperand value(this, node.child3);
+        GPRTemporary storage(this, base); // storage may overwrite base.
+
+        // Get the array storage.
+        MacroAssembler::RegisterID storageReg = storage.registerID();
+        m_jit.loadPtr(MacroAssembler::Address(base.registerID(), JSArray::storageOffset()), storageReg);
+
+        // Map property & value into registers.
+        MacroAssembler::RegisterID propertyReg = property.registerID();
+        MacroAssembler::RegisterID valueReg = value.registerID();
+
+        // Store the value to the array.
+        m_jit.storePtr(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case DFG::Jump: {
+        BlockIndex taken = m_jit.graph().blockIndexForBytecodeOffset(node.takenBytecodeOffset());
+        if (taken != (m_block + 1))
+            addBranch(m_jit.jump(), taken);
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case Branch: {
+        JSValueOperand value(this, node.child1);
+        MacroAssembler::RegisterID valueReg = value.registerID();
+
+        BlockIndex taken = m_jit.graph().blockIndexForBytecodeOffset(node.takenBytecodeOffset());
+        BlockIndex notTaken = m_jit.graph().blockIndexForBytecodeOffset(node.notTakenBytecodeOffset());
+
+        // Integers
+        addBranch(m_jit.branchPtr(MacroAssembler::Equal, valueReg, MacroAssembler::ImmPtr(JSValue::encode(jsNumber(0)))), notTaken);
+        MacroAssembler::Jump isNonZeroInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, valueReg, JITCompiler::tagTypeNumberRegister);
+
+        // Booleans
+        addBranch(m_jit.branchPtr(MacroAssembler::Equal, valueReg, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(false)))), notTaken);
+        speculationCheck(m_jit.branchPtr(MacroAssembler::NotEqual, valueReg, MacroAssembler::ImmPtr(JSValue::encode(jsBoolean(true)))));
+
+        if (taken == (m_block + 1))
+            isNonZeroInteger.link(&m_jit);
+        else {
+            addBranch(isNonZeroInteger, taken);
+            addBranch(m_jit.jump(), taken);
+        }
+
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case Return: {
+        ASSERT(JITCompiler::callFrameRegister != JITCompiler::regT1);
+        ASSERT(JITCompiler::regT1 != JITCompiler::returnValueRegister);
+        ASSERT(JITCompiler::returnValueRegister != JITCompiler::callFrameRegister);
+
+#if DFG_SUCCESS_STATS
+        static SamplingCounter counter("SpeculativeJIT");
+        m_jit.emitCount(counter);
+#endif
+
+        // Return the result in returnValueRegister.
+        JSValueOperand op1(this, node.child1);
+        m_jit.move(op1.registerID(), JITCompiler::returnValueRegister);
+
+        // Grab the return address.
+        m_jit.emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, JITCompiler::regT1);
+        // Restore our caller's "r".
+        m_jit.emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, JITCompiler::callFrameRegister);
+        // Return.
+        m_jit.restoreReturnAddressBeforeReturn(JITCompiler::regT1);
+        m_jit.ret();
+        
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case ConvertThis: {
+        SpeculateCellOperand thisValue(this, node.child1);
+        GPRTemporary temp(this);
+
+        m_jit.loadPtr(JITCompiler::Address(thisValue.registerID(), JSCell::structureOffset()), temp.registerID());
+        speculationCheck(m_jit.branchTest8(JITCompiler::NonZero, JITCompiler::Address(temp.registerID(), Structure::typeInfoFlagsOffset()), JITCompiler::TrustedImm32(NeedsThisConversion)));
+
+        cellResult(thisValue.gpr(), m_compileIndex);
+        break;
+    }
+
+    case GetById: {
+        JSValueOperand base(this, node.child1);
+        GPRReg baseGPR = base.gpr();
+        flushRegisters();
+
+        GPRResult result(this);
+        callOperation(operationGetById, result.gpr(), baseGPR, identifier(node.identifierNumber()));
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case PutById: {
+        JSValueOperand base(this, node.child1);
+        JSValueOperand value(this, node.child2);
+        GPRReg valueGPR = value.gpr();
+        GPRReg baseGPR = base.gpr();
+        flushRegisters();
+
+        callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByIdStrict : operationPutByIdNonStrict, valueGPR, baseGPR, identifier(node.identifierNumber()));
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case PutByIdDirect: {
+        JSValueOperand base(this, node.child1);
+        JSValueOperand value(this, node.child2);
+        GPRReg valueGPR = value.gpr();
+        GPRReg baseGPR = base.gpr();
+        flushRegisters();
+
+        callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByIdDirectStrict : operationPutByIdDirectNonStrict, valueGPR, baseGPR, identifier(node.identifierNumber()));
+        noResult(m_compileIndex);
+        break;
+    }
+
+    case GetGlobalVar: {
+        GPRTemporary result(this);
+
+        JSVariableObject* globalObject = m_jit.codeBlock()->globalObject();
+        m_jit.loadPtr(globalObject->addressOfRegisters(), result.registerID());
+        m_jit.loadPtr(JITCompiler::addressForGlobalVar(result.registerID(), node.varNumber()), result.registerID());
+
+        jsValueResult(result.gpr(), m_compileIndex);
+        break;
+    }
+
+    case PutGlobalVar: {
+        JSValueOperand value(this, node.child1);
+        GPRTemporary temp(this);
+
+        JSVariableObject* globalObject = m_jit.codeBlock()->globalObject();
+        m_jit.loadPtr(globalObject->addressOfRegisters(), temp.registerID());
+        m_jit.storePtr(value.registerID(), JITCompiler::addressForGlobalVar(temp.registerID(), node.varNumber()));
+
+        noResult(m_compileIndex);
+        break;
+    }
+    }
+
+    // Check if generation for the speculative path has failed catastrophically. :-)
+    // In the future, we may want to throw away the code we've generated in this case.
+    // For now, there is no point generating any further code, return immediately.
+    if (m_didTerminate)
+        return false;
+
+    if (node.mustGenerate())
+        use(m_compileIndex);
+
+    checkConsistency();
+
+    return true;
+}
+
+bool SpeculativeJIT::compile(BasicBlock& block)
+{
+    ASSERT(m_compileIndex == block.begin);
+    m_blockHeads[m_block] = m_jit.label();
+#if DFG_JIT_BREAK_ON_EVERY_BLOCK
+    m_jit.breakpoint();
+#endif
+
+    for (; m_compileIndex < block.end; ++m_compileIndex) {
+        Node& node = m_jit.graph()[m_compileIndex];
+        if (!node.refCount)
+            continue;
+
+#if DFG_DEBUG_VERBOSE
+        fprintf(stderr, "SpeculativeJIT generating Node @%d at JIT offset 0x%x\n", (int)m_compileIndex, m_jit.debugOffset());
+#endif
+#if DFG_JIT_BREAK_ON_EVERY_NODE
+    m_jit.breakpoint();
+#endif
+        if (!compile(node))
+            return false;
+    }
+    return true;
+}
+
+bool SpeculativeJIT::compile()
+{
+    ASSERT(!m_compileIndex);
+    Vector<BasicBlock> blocks = m_jit.graph().m_blocks;
+    for (m_block = 0; m_block < blocks.size(); ++m_block) {
+        if (!compile(blocks[m_block]))
+            return false;
+    }
+    linkBranches();
+    return true;
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
new file mode 100644
index 0000000..965cdbe
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -0,0 +1,372 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGSpeculativeJIT_h
+#define DFGSpeculativeJIT_h
+
+#if ENABLE(DFG_JIT)
+
+#include <dfg/DFGJITCodeGenerator.h>
+
+namespace JSC { namespace DFG {
+
+class SpeculativeJIT;
+
+// This enum describes the types of additional recovery that
+// may need be performed should a speculation check fail.
+enum SpeculationRecoveryType {
+    SpeculativeAdd
+};
+
+// === SpeculationRecovery ===
+//
+// This class provides additional information that may be associated with a
+// speculation check - for example 
+class SpeculationRecovery {
+public:
+    SpeculationRecovery(SpeculationRecoveryType type, GPRReg dest, GPRReg src)
+        : m_type(type)
+        , m_dest(dest)
+        , m_src(src)
+    {
+    }
+
+    SpeculationRecoveryType type() { return m_type; }
+    GPRReg dest() { return m_dest; }
+    GPRReg src() { return m_src; }
+
+private:
+    // Indicates the type of additional recovery to be performed.
+    SpeculationRecoveryType m_type;
+    // different recovery types may required different additional information here.
+    GPRReg m_dest;
+    GPRReg m_src;
+};
+
+// === SpeculationCheck ===
+//
+// This structure records a bail-out from the speculative path,
+// which will need to be linked in to the non-speculative one.
+struct SpeculationCheck {
+    SpeculationCheck(MacroAssembler::Jump, SpeculativeJIT*, unsigned recoveryIndex = 0);
+
+    // The location of the jump out from the speculative path, 
+    // and the node we were generating code for.
+    MacroAssembler::Jump m_check;
+    NodeIndex m_nodeIndex;
+    // Used to record any additional recovery to be performed; this
+    // value is an index into the SpeculativeJIT's m_speculationRecoveryList
+    // array, offset by 1. (m_recoveryIndex == 0) means no recovery.
+    unsigned m_recoveryIndex;
+
+    struct RegisterInfo {
+        NodeIndex nodeIndex;
+        DataFormat format;
+    };
+    RegisterInfo m_gprInfo[numberOfGPRs];
+    NodeIndex m_fprInfo[numberOfFPRs];
+};
+typedef SegmentedVector<SpeculationCheck, 16> SpeculationCheckVector;
+
+
+// === SpeculativeJIT ===
+//
+// The SpeculativeJIT is used to generate a fast, but potentially
+// incomplete code path for the dataflow. When code generating
+// we may make assumptions about operand types, dynamically check,
+// and bail-out to an alternate code path if these checks fail.
+// Importantly, the speculative code path cannot be reentered once
+// a speculative check has failed. This allows the SpeculativeJIT
+// to propagate type information (including information that has
+// only speculatively been asserted) through the dataflow.
+class SpeculativeJIT : public JITCodeGenerator {
+    friend struct SpeculationCheck;
+public:
+    SpeculativeJIT(JITCompiler& jit)
+        : JITCodeGenerator(jit, true)
+        , m_didTerminate(false)
+    {
+    }
+
+    bool compile();
+
+    // Retrieve the list of bail-outs from the speculative path,
+    // and additional recovery information.
+    SpeculationCheckVector& speculationChecks()
+    {
+        return m_speculationChecks;
+    }
+    SpeculationRecovery* speculationRecovery(size_t index)
+    {
+        // SpeculationCheck::m_recoveryIndex is offset by 1,
+        // 0 means no recovery.
+        return index ? &m_speculationRecoveryList[index - 1] : 0;
+    }
+
+    // Called by the speculative operand types, below, to fill operand to
+    // machine registers, implicitly generating speculation checks as needed.
+    GPRReg fillSpeculateInt(NodeIndex, DataFormat& returnFormat);
+    GPRReg fillSpeculateIntStrict(NodeIndex);
+    GPRReg fillSpeculateCell(NodeIndex);
+
+private:
+    bool compile(Node&);
+    bool compile(BasicBlock&);
+
+    bool isDoubleConstantWithInt32Value(NodeIndex nodeIndex, int32_t& out)
+    {
+        if (!m_jit.isDoubleConstant(nodeIndex))
+            return false;
+        double value = m_jit.valueOfDoubleConstant(nodeIndex);
+
+        int32_t asInt32 = static_cast<int32_t>(value);
+        if (value != asInt32)
+            return false;
+        if (!asInt32 && signbit(value))
+            return false;
+
+        out = asInt32;
+        return true;
+    }
+
+    // Add a speculation check without additional recovery.
+    void speculationCheck(MacroAssembler::Jump jumpToFail)
+    {
+        m_speculationChecks.append(SpeculationCheck(jumpToFail, this));
+    }
+    // Add a speculation check with additional recovery.
+    void speculationCheck(MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery)
+    {
+        m_speculationRecoveryList.append(recovery);
+        m_speculationChecks.append(SpeculationCheck(jumpToFail, this, m_speculationRecoveryList.size()));
+    }
+
+    // Called when we statically determine that a speculation will fail.
+    void terminateSpeculativeExecution()
+    {
+        // FIXME: in cases where we can statically determine we're going to bail out from the speculative
+        // JIT we should probably rewind code generation and only produce the non-speculative path.
+        m_didTerminate = true;
+        speculationCheck(m_jit.jump());
+    }
+
+    template<bool strict>
+    GPRReg fillSpeculateIntInternal(NodeIndex, DataFormat& returnFormat);
+
+    // It is possible, during speculative generation, to reach a situation in which we
+    // can statically determine a speculation will fail (for example, when two nodes
+    // will make conflicting speculations about the same operand). In such cases this
+    // flag is set, indicating no further code generation should take place.
+    bool m_didTerminate;
+    // This vector tracks bail-outs from the speculative path to the non-speculative one.
+    SpeculationCheckVector m_speculationChecks;
+    // Some bail-outs need to record additional information recording specific recovery
+    // to be performed (for example, on detected overflow from an add, we may need to
+    // reverse the addition if an operand is being overwritten).
+    Vector<SpeculationRecovery, 16> m_speculationRecoveryList;
+};
+
+
+// === Speculative Operand types ===
+//
+// SpeculateIntegerOperand, SpeculateStrictInt32Operand and SpeculateCellOperand.
+//
+// These are used to lock the operands to a node into machine registers within the
+// SpeculativeJIT. The classes operate like those provided by the JITCodeGenerator,
+// however these will perform a speculative check for a more restrictive type than
+// we can statically determine the operand to have. If the operand does not have
+// the requested type, a bail-out to the non-speculative path will be taken.
+
+class SpeculateIntegerOperand {
+public:
+    explicit SpeculateIntegerOperand(SpeculativeJIT* jit, NodeIndex index)
+        : m_jit(jit)
+        , m_index(index)
+        , m_gprOrInvalid(InvalidGPRReg)
+#ifndef NDEBUG
+        , m_format(DataFormatNone)
+#endif
+    {
+        ASSERT(m_jit);
+        if (jit->isFilled(index))
+            gpr();
+    }
+
+    ~SpeculateIntegerOperand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+
+    NodeIndex index() const
+    {
+        return m_index;
+    }
+
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillSpeculateInt(index(), m_format);
+        return m_gprOrInvalid;
+    }
+
+    DataFormat format()
+    {
+        gpr(); // m_format is set when m_gpr is locked.
+        ASSERT(m_format == DataFormatInteger || m_format == DataFormatJSInteger);
+        return m_format;
+    }
+
+    MacroAssembler::RegisterID registerID()
+    {
+        return JITCompiler::gprToRegisterID(gpr());
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    NodeIndex m_index;
+    GPRReg m_gprOrInvalid;
+    DataFormat m_format;
+};
+
+class SpeculateStrictInt32Operand {
+public:
+    explicit SpeculateStrictInt32Operand(SpeculativeJIT* jit, NodeIndex index)
+        : m_jit(jit)
+        , m_index(index)
+        , m_gprOrInvalid(InvalidGPRReg)
+    {
+        ASSERT(m_jit);
+        if (jit->isFilled(index))
+            gpr();
+    }
+
+    ~SpeculateStrictInt32Operand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+
+    NodeIndex index() const
+    {
+        return m_index;
+    }
+
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillSpeculateIntStrict(index());
+        return m_gprOrInvalid;
+    }
+
+    MacroAssembler::RegisterID registerID()
+    {
+        return JITCompiler::gprToRegisterID(gpr());
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    NodeIndex m_index;
+    GPRReg m_gprOrInvalid;
+};
+
+class SpeculateCellOperand {
+public:
+    explicit SpeculateCellOperand(SpeculativeJIT* jit, NodeIndex index)
+        : m_jit(jit)
+        , m_index(index)
+        , m_gprOrInvalid(InvalidGPRReg)
+    {
+        ASSERT(m_jit);
+        if (jit->isFilled(index))
+            gpr();
+    }
+
+    ~SpeculateCellOperand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+
+    NodeIndex index() const
+    {
+        return m_index;
+    }
+
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillSpeculateCell(index());
+        return m_gprOrInvalid;
+    }
+
+    MacroAssembler::RegisterID registerID()
+    {
+        return JITCompiler::gprToRegisterID(gpr());
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    NodeIndex m_index;
+    GPRReg m_gprOrInvalid;
+};
+
+
+// === SpeculationCheckIndexIterator ===
+//
+// This class is used by the non-speculative JIT to check which
+// nodes require entry points from the speculative path.
+class SpeculationCheckIndexIterator {
+public:
+    SpeculationCheckIndexIterator(SpeculationCheckVector& speculationChecks)
+        : m_speculationChecks(speculationChecks)
+        , m_iter(m_speculationChecks.begin())
+        , m_end(m_speculationChecks.end())
+    {
+    }
+
+    bool hasCheckAtIndex(NodeIndex nodeIndex)
+    {
+        while (m_iter != m_end) {
+            NodeIndex current = m_iter->m_nodeIndex;
+            if (current >= nodeIndex)
+                return current == nodeIndex;
+            ++m_iter;
+        }
+        return false;
+    }
+
+private:
+    SpeculationCheckVector& m_speculationChecks;
+    SpeculationCheckVector::Iterator m_iter;
+    SpeculationCheckVector::Iterator m_end;
+};
+
+
+} } // namespace JSC::DFG
+
+#endif
+#endif
+
diff --git a/Source/JavaScriptCore/gyp/JavaScriptCore.gyp b/Source/JavaScriptCore/gyp/JavaScriptCore.gyp
new file mode 100644
index 0000000..a520344
--- /dev/null
+++ b/Source/JavaScriptCore/gyp/JavaScriptCore.gyp
@@ -0,0 +1,228 @@
+{
+  'includes': [
+    '../../gyp/common.gypi',
+    '../JavaScriptCore.gypi',
+  ],
+  'configurations': {
+    'Production': {
+      'xcode_config_file': '<(project_dir)/Configurations/Base.xcconfig',
+    },
+    'Profiling': {
+      'xcode_config_file': '<(project_dir)/Configurations/DebugRelease.xcconfig',
+      'xcode_settings': {
+        'STRIP_INSTALLED_PRODUCT': 'NO',
+      },
+    },
+    'Release': {
+      'xcode_config_file': '<(project_dir)/Configurations/DebugRelease.xcconfig',
+      'xcode_settings': {
+        'STRIP_INSTALLED_PRODUCT': 'NO',
+      },
+    },
+    'Debug': {
+      'xcode_config_file': '<(project_dir)/Configurations/DebugRelease.xcconfig',
+      'xcode_settings': {
+        'DEAD_CODE_STRIPPING': '$(DEAD_CODE_STRIPPING_debug)',
+        'DEBUG_DEFINES': '$(DEBUG_DEFINES_debug)',
+        'GCC_OPTIMIZATION_LEVEL': '$(GCC_OPTIMIZATION_LEVEL_debug)',
+        'STRIP_INSTALLED_PRODUCT': '$(STRIP_INSTALLED_PRODUCT_debug)',
+      },
+    },
+  },
+  'variables': {
+    'javascriptcore_include_dirs': [
+      '<(project_dir)',
+      '<(project_dir)/icu',
+    ],
+  },
+  'target_defaults': {
+    'configurations': {
+      'Profiling': {},
+    },
+  },
+  'targets': [
+    {
+      'target_name': 'JavaScriptCore',
+      'type': 'shared_library',
+      'dependencies': [
+        'Derived Sources',
+        'Update Version',
+      ],
+      'include_dirs': [
+        '<@(javascriptcore_include_dirs)',
+        '<(PRODUCT_DIR)/DerivedSources/JavaScriptCore',
+      ],
+      'configurations': {
+        'Production': {
+          'INSTALL_PATH': '$(BUILT_PRODUCTS_DIR)',
+        },
+      },
+      'sources': [
+        '<@(javascriptcore_files)',
+        '<@(javascriptcore_publicheader_files)',
+        '<@(javascriptcore_privateheader_files)',
+        '<@(javascriptcore_derived_source_files)',
+        '$(SDKROOT)/System/Library/Frameworks/CoreFoundation.framework',
+        '$(SDKROOT)/System/Library/Frameworks/Foundation.framework',
+        '/usr/lib/libicucore.dylib',
+        '/usr/lib/libobjc.dylib',
+      ],
+      'mac_framework_headers': [
+        '<@(javascriptcore_publicheader_files)',
+      ],
+      'mac_framework_private_headers': [
+        '<@(javascriptcore_privateheader_files)',
+      ],
+      'xcode_config_file': '<(project_dir)/Configurations/JavaScriptCore.xcconfig',
+      'sources/': [
+        ['exclude', 'API/tests/'],
+        ['exclude', 'ForwardingHeaders/'],
+        ['exclude', '(?<!unicode)/icu/'],
+        ['exclude', 'os-win32/'],
+        ['exclude', 'qt/'],
+        ['exclude', 'wtf/(android|brew|efl|gtk|haiku|qt|wince|wx)/'],
+        ['exclude', 'wtf/unicode/brew/'],
+        ['exclude', 'wtf/unicode/glib/'],
+        ['exclude', 'wtf/unicode/qt4/'],
+        ['exclude', 'wtf/unicode/wince/'],
+        ['exclude', 'wtf/url/'],
+        ['exclude', '/(gtk|glib|gobject)/.*\\.(cpp|h)$'],
+        ['exclude', '(Default|Gtk|Chromium|None|Qt|Win|Wx|Symbian)\\.(cpp|mm|h)$'],
+        ['exclude', 'GCActivityCallback\.cpp$'],
+        ['exclude', 'BSTR[^/]*$'],
+      ],
+      'postbuilds': [
+        {
+          'postbuild_name': 'Check For Global Initializers',
+          'action': [
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-global-initializers'
+          ],
+        },
+        {
+          'postbuild_name': 'Check For Exit Time Destructors',
+          'action': [
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-exit-time-destructors'
+          ],
+        },
+        {
+          'postbuild_name': 'Check For Weak VTables and Externals',
+          'action': [
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-weak-vtables-and-externals'
+          ],
+        },
+      ],
+      'conditions': [
+        ['OS=="mac"', {
+          'mac_bundle': 1,
+          'xcode_settings': {
+            # FIXME: Remove these overrides once JavaScriptCore.xcconfig is
+            # used only by this project.
+            'GCC_PREFIX_HEADER': '<(project_dir)/JavaScriptCorePrefix.h',
+            'INFOPLIST_FILE': '<(project_dir)/Info.plist',
+          },
+        }],
+      ],
+    },
+    {
+      'target_name': 'Derived Sources',
+      'type': 'none',
+      'actions': [
+        {
+          'action_name': 'Generate Derived Sources',
+          'inputs': [],
+          'outputs': [
+            '<@(javascriptcore_derived_source_files)',
+          ],
+          'action': [
+            'sh', 'generate-derived-sources.sh'
+          ],
+        },
+        {
+          'action_name': 'Generate DTrace Header',
+          'inputs': [],
+           'outputs': [],
+           'action': [
+             'sh', '<(project_dir)/gyp/generate-dtrace-header.sh', '<(project_dir)'
+            ]
+        }
+      ],
+    },
+    {
+      'target_name': 'Update Version',
+      'type': 'none',
+      'actions': [{
+        'action_name': 'Update Info.plist with version information',
+        'inputs': [],
+         'outputs': [],
+         'action': [
+           'sh', '<(project_dir)/gyp/update-info-plist.sh', '<(project_dir)/Info.plist'
+          ]
+      }],
+    },
+    {
+      'target_name': 'minidom',
+      'type': 'executable',
+      'dependencies': [
+        'JavaScriptCore',
+      ],
+      # FIXME: We should use a header map instead of listing these explicitly.
+      'include_dirs': [
+        '<@(javascriptcore_include_dirs)',
+      ],
+      'sources': [
+        '<@(minidom_files)',
+        '$(SDKROOT)/System/Library/Frameworks/CoreFoundation.framework',
+      ],
+      'copies': [{
+        'destination': '<(PRODUCT_DIR)',
+        'files': [
+          '<@(minidom_support_files)',
+        ],
+      }],
+    },
+    {
+      'target_name': 'testapi',
+      'type': 'executable',
+      'dependencies': [
+        'JavaScriptCore',
+      ],
+      # FIXME: We should use a header map instead of listing these explicitly.
+      'include_dirs': [
+        '<@(javascriptcore_include_dirs)',
+      ],
+      'sources': [
+        '<@(testapi_files)',
+        '$(SDKROOT)/System/Library/Frameworks/CoreFoundation.framework',
+      ],
+      'copies': [{
+        'destination': '<(PRODUCT_DIR)',
+        'files': [
+          '<@(testapi_support_files)',
+        ],
+      }],
+    },
+    {
+      'target_name': 'jsc',
+      'type': 'executable',
+      'dependencies': [
+        'JavaScriptCore',
+      ],
+      # FIXME: We should use a header map instead of listing these explicitly.
+      'include_dirs': [
+        '<@(javascriptcore_include_dirs)',
+      ],
+      'configurations': {
+        'Production': {
+          'xcode_settings': {
+            'INSTALL_PATH': '$(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/Resources',
+          },
+        },
+      },
+      'sources': [
+        '<@(jsc_files)',
+        '$(SDKROOT)/System/Library/Frameworks/CoreFoundation.framework',
+        '/usr/lib/libedit.dylib',
+      ],
+    },
+  ], # targets
+}
diff --git a/Source/JavaScriptCore/gyp/generate-derived-sources.sh b/Source/JavaScriptCore/gyp/generate-derived-sources.sh
new file mode 100755
index 0000000..fcd3056
--- /dev/null
+++ b/Source/JavaScriptCore/gyp/generate-derived-sources.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+mkdir -p "${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore/docs"
+cd "${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore"
+
+/bin/ln -sfh "${SRCROOT}/.." JavaScriptCore
+export JavaScriptCore="JavaScriptCore"
+
+make -f "JavaScriptCore/DerivedSources.make" -j `/usr/sbin/sysctl -n hw.ncpu`
diff --git a/Source/JavaScriptCore/gyp/generate-dtrace-header.sh b/Source/JavaScriptCore/gyp/generate-dtrace-header.sh
new file mode 100755
index 0000000..a3c31dd
--- /dev/null
+++ b/Source/JavaScriptCore/gyp/generate-dtrace-header.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+TRACING_D="$1/runtime/Tracing.d";
+TRACING_H="$BUILT_PRODUCTS_DIR/DerivedSources/JavaScriptCore/TracingDtrace.h";
+
+if [[ "${HAVE_DTRACE}" = "1" && "${TRACING_D}" -nt "${TRACING_H}" ]]; then
+    dtrace -h -o "${TRACING_H}" -s "${TRACING_D}";
+fi;
+
diff --git a/Source/JavaScriptCore/gyp/gtk.gyp b/Source/JavaScriptCore/gyp/gtk.gyp
new file mode 100644
index 0000000..33eaa17
--- /dev/null
+++ b/Source/JavaScriptCore/gyp/gtk.gyp
@@ -0,0 +1,18 @@
+{ # Just a stub file to allow Source/gyp/configure to run successfully for testing.
+  'includes': [
+    '../../gyp/common.gypi',
+    '../JavaScriptCore.gypi',
+  ],
+  'targets': [
+    {
+      'target_name': 'JavaScriptCore',
+      'type': 'static_library',
+      'sources': [
+        '<@(javascriptcore_files)',
+        '<@(javascriptcore_publicheader_files)',
+        '<@(javascriptcore_privateheader_files)',
+        '<@(javascriptcore_derived_source_files)',
+      ],
+    },
+  ], # targets
+}
diff --git a/Source/JavaScriptCore/gyp/run-if-exists.sh b/Source/JavaScriptCore/gyp/run-if-exists.sh
new file mode 100755
index 0000000..242ffc8
--- /dev/null
+++ b/Source/JavaScriptCore/gyp/run-if-exists.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+if [ -f $1 ]; then
+    $1 || exit $?;
+fi
diff --git a/Source/JavaScriptCore/gyp/update-info-plist.sh b/Source/JavaScriptCore/gyp/update-info-plist.sh
new file mode 100755
index 0000000..d02ecce
--- /dev/null
+++ b/Source/JavaScriptCore/gyp/update-info-plist.sh
@@ -0,0 +1,4 @@
+# Touch Info.plist to let Xcode know it needs to copy it into the built product
+if [[ "${CONFIGURATION}" != "Production" ]]; then
+    touch "$1";
+fi
diff --git a/Source/JavaScriptCore/runtime/ConservativeSet.cpp b/Source/JavaScriptCore/heap/ConservativeRoots.cpp
index bc8bd6d..1aad779 100644
--- a/Source/JavaScriptCore/runtime/ConservativeSet.cpp
+++ b/Source/JavaScriptCore/heap/ConservativeRoots.cpp
@@ -24,7 +24,7 @@
  */
 
 #include "config.h"
-#include "ConservativeSet.h"
+#include "ConservativeRoots.h"
 
 namespace JSC {
 
@@ -33,33 +33,26 @@ inline bool isPointerAligned(void* p)
     return !((intptr_t)(p) & (sizeof(char*) - 1));
 }
 
-void ConservativeSet::grow()
+void ConservativeRoots::grow()
 {
     size_t newCapacity = m_capacity == inlineCapacity ? nonInlineCapacity : m_capacity * 2;
-    DeprecatedPtr<JSCell>* newSet = static_cast<DeprecatedPtr<JSCell>*>(OSAllocator::reserveAndCommit(newCapacity * sizeof(JSCell*)));
-    memcpy(newSet, m_set, m_size * sizeof(JSCell*));
-    if (m_set != m_inlineSet)
-        OSAllocator::decommitAndRelease(m_set, m_capacity * sizeof(JSCell*));
+    JSCell** newRoots = static_cast<JSCell**>(OSAllocator::reserveAndCommit(newCapacity * sizeof(JSCell*)));
+    memcpy(newRoots, m_roots, m_size * sizeof(JSCell*));
+    if (m_roots != m_inlineRoots)
+        OSAllocator::decommitAndRelease(m_roots, m_capacity * sizeof(JSCell*));
     m_capacity = newCapacity;
-    m_set = newSet;
+    m_roots = newRoots;
 }
 
-void ConservativeSet::add(void* begin, void* end)
+void ConservativeRoots::add(void* begin, void* end)
 {
     ASSERT(begin <= end);
     ASSERT((static_cast<char*>(end) - static_cast<char*>(begin)) < 0x1000000);
     ASSERT(isPointerAligned(begin));
     ASSERT(isPointerAligned(end));
 
-    for (char** it = static_cast<char**>(begin); it != static_cast<char**>(end); ++it) {
-        if (!m_heap->contains(*it))
-            continue;
-
-        if (m_size == m_capacity)
-            grow();
-
-        m_set[m_size++] = reinterpret_cast<JSCell*>(*it);
-    }
+    for (char** it = static_cast<char**>(begin); it != static_cast<char**>(end); ++it)
+        add(*it);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ConservativeSet.h b/Source/JavaScriptCore/heap/ConservativeRoots.h
index e7c2c4a..d078606 100644
--- a/Source/JavaScriptCore/runtime/ConservativeSet.h
+++ b/Source/JavaScriptCore/heap/ConservativeRoots.h
@@ -23,24 +23,30 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef ConservativeSet_h
-#define ConservativeSet_h
+#ifndef ConservativeRoots_h
+#define ConservativeRoots_h
 
 #include "Heap.h"
-#include "MarkStack.h"
+#include <wtf/OSAllocator.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
 
 class JSCell;
+class Heap;
 
-class ConservativeSet {
+// May contain duplicates.
+
+class ConservativeRoots {
 public:
-    ConservativeSet(Heap*);
-    ~ConservativeSet();
+    ConservativeRoots(Heap*);
+    ~ConservativeRoots();
 
+    void add(void*);
     void add(void* begin, void* end);
-    void mark(MarkStack&);
+    
+    size_t size();
+    JSCell** roots();
 
 private:
     static const size_t inlineCapacity = 128;
@@ -49,32 +55,47 @@ private:
     void grow();
 
     Heap* m_heap;
-    DeprecatedPtr<JSCell>* m_set;
+    JSCell** m_roots;
     size_t m_size;
     size_t m_capacity;
-    DeprecatedPtr<JSCell> m_inlineSet[inlineCapacity];
+    JSCell* m_inlineRoots[inlineCapacity];
 };
 
-inline ConservativeSet::ConservativeSet(Heap* heap)
+inline ConservativeRoots::ConservativeRoots(Heap* heap)
     : m_heap(heap)
-    , m_set(m_inlineSet)
+    , m_roots(m_inlineRoots)
     , m_size(0)
     , m_capacity(inlineCapacity)
 {
 }
 
-inline ConservativeSet::~ConservativeSet()
+inline ConservativeRoots::~ConservativeRoots()
+{
+    if (m_roots != m_inlineRoots)
+        OSAllocator::decommitAndRelease(m_roots, m_capacity * sizeof(JSCell*));
+}
+
+inline void ConservativeRoots::add(void* p)
+{
+    if (!m_heap->contains(p))
+        return;
+
+    if (m_size == m_capacity)
+        grow();
+
+    m_roots[m_size++] = reinterpret_cast<JSCell*>(p);
+}
+
+inline size_t ConservativeRoots::size()
 {
-    if (m_set != m_inlineSet)
-        OSAllocator::decommitAndRelease(m_set, m_capacity * sizeof(DeprecatedPtr<JSCell>*));
+    return m_size;
 }
 
-inline void ConservativeSet::mark(MarkStack& markStack)
+inline JSCell** ConservativeRoots::roots()
 {
-    for (size_t i = 0; i < m_size; ++i)
-        markStack.append(&m_set[i]);
+    return m_roots;
 }
 
 } // namespace JSC
 
-#endif // ConservativeSet_h
+#endif // ConservativeRoots_h
diff --git a/Source/JavaScriptCore/heap/Handle.h b/Source/JavaScriptCore/heap/Handle.h
new file mode 100644
index 0000000..531d535
--- /dev/null
+++ b/Source/JavaScriptCore/heap/Handle.h
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Handle_h
+#define Handle_h
+
+#include "WriteBarrier.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+/*
+    A Handle is a smart pointer that updates automatically when the garbage
+    collector moves the object to which it points.
+
+    The base Handle class represents a temporary reference to a pointer whose
+    lifetime is guaranteed by something else.
+*/
+
+template <class T> class Handle;
+
+// Creating a JSValue Handle is invalid
+template <> class Handle<JSValue>;
+
+// Forward declare WeakGCMap
+template<typename KeyType, typename MappedType, typename FinalizerCallback, typename HashArg, typename KeyTraitsArg> class WeakGCMap;
+
+class HandleBase {
+    friend class HandleHeap;
+    friend struct JSCallbackObjectData;
+    template <typename KeyType, typename MappedType, typename FinalizerCallback, typename HashArg, typename KeyTraitsArg> friend class WeakGCMap;
+
+public:
+    bool operator!() const { return !m_slot || !*m_slot; }
+
+    // This conversion operator allows implicit conversion to bool but not to other integer types.
+    typedef JSValue (HandleBase::*UnspecifiedBoolType);
+    operator UnspecifiedBoolType*() const { return (m_slot && *m_slot) ? reinterpret_cast<UnspecifiedBoolType*>(1) : 0; }
+
+protected:
+    HandleBase(HandleSlot slot)
+        : m_slot(slot)
+    {
+    }
+    
+    void swap(HandleBase& other) { std::swap(m_slot, other.m_slot); }
+
+    HandleSlot slot() const { return m_slot; }
+    void setSlot(HandleSlot slot)
+    {
+        m_slot = slot;
+    }
+
+private:
+    HandleSlot m_slot;
+};
+
+template <typename T> struct HandleTypes {
+    typedef T* ExternalType;
+    static ExternalType getFromSlot(HandleSlot slot) { return (slot && *slot) ? reinterpret_cast<ExternalType>(slot->asCell()) : 0; }
+    static JSValue toJSValue(T* cell) { return reinterpret_cast<JSCell*>(cell); }
+    template <typename U> static void validateUpcast() { T* temp; temp = (U*)0; }
+};
+
+template <> struct HandleTypes<Unknown> {
+    typedef JSValue ExternalType;
+    static ExternalType getFromSlot(HandleSlot slot) { return slot ? *slot : JSValue(); }
+    static JSValue toJSValue(const JSValue& v) { return v; }
+    template <typename U> static void validateUpcast() {}
+};
+
+template <typename Base, typename T> struct HandleConverter {
+    T* operator->()
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!static_cast<const Base*>(this)->get() || !static_cast<const Base*>(this)->get()->isZombie());
+#endif
+        return static_cast<Base*>(this)->get();
+    }
+    const T* operator->() const
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!static_cast<const Base*>(this)->get() || !static_cast<const Base*>(this)->get()->isZombie());
+#endif
+        return static_cast<const Base*>(this)->get();
+    }
+
+    T* operator*()
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!static_cast<const Base*>(this)->get() || !static_cast<const Base*>(this)->get()->isZombie());
+#endif
+        return static_cast<Base*>(this)->get();
+    }
+    const T* operator*() const
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!static_cast<const Base*>(this)->get() || !static_cast<const Base*>(this)->get()->isZombie());
+#endif
+        return static_cast<const Base*>(this)->get();
+    }
+};
+
+template <typename Base> struct HandleConverter<Base, Unknown> {
+    Handle<JSObject> asObject() const;
+    bool isObject() const { return jsValue().isObject(); }
+    bool getNumber(double number) const { return jsValue().getNumber(number); }
+    UString getString(ExecState*) const;
+    bool isUndefinedOrNull() const { return jsValue().isUndefinedOrNull(); }
+
+private:
+    JSValue jsValue() const
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!static_cast<const Base*>(this)->get() || !static_cast<const Base*>(this)->get().isZombie());
+#endif
+        return static_cast<const Base*>(this)->get();
+    }
+};
+
+template <typename T> class Handle : public HandleBase, public HandleConverter<Handle<T>, T> {
+public:
+    template <typename A, typename B> friend class HandleConverter;
+    typedef typename HandleTypes<T>::ExternalType ExternalType;
+    template <typename U> Handle(Handle<U> o)
+    {
+        typename HandleTypes<T>::template validateUpcast<U>();
+        setSlot(o.slot());
+    }
+
+    void swap(Handle& other) { HandleBase::swap(other); }
+
+    ExternalType get() const { return HandleTypes<T>::getFromSlot(this->slot()); }
+
+protected:
+    Handle(HandleSlot slot = 0)
+        : HandleBase(slot)
+    {
+    }
+    
+private:
+    friend class HandleHeap;
+
+    static Handle<T> wrapSlot(HandleSlot slot)
+    {
+        return Handle<T>(slot);
+    }
+};
+
+template <typename Base> Handle<JSObject> HandleConverter<Base, Unknown>::asObject() const
+{
+    return Handle<JSObject>::wrapSlot(static_cast<const Base*>(this)->slot());
+}
+
+template <typename T, typename U> inline bool operator==(const Handle<T>& a, const Handle<U>& b)
+{ 
+    return a.get() == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator==(const Handle<T>& a, U* b)
+{ 
+    return a.get() == b; 
+}
+
+template <typename T, typename U> inline bool operator==(T* a, const Handle<U>& b) 
+{
+    return a == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const Handle<T>& a, const Handle<U>& b)
+{ 
+    return a.get() != b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const Handle<T>& a, U* b)
+{
+    return a.get() != b; 
+}
+
+template <typename T, typename U> inline bool operator!=(T* a, const Handle<U>& b)
+{ 
+    return a != b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const Handle<T>& a, JSValue b)
+{
+    return a.get() != b; 
+}
+
+template <typename T, typename U> inline bool operator!=(JSValue a, const Handle<U>& b)
+{ 
+    return a != b.get(); 
+}
+
+}
+
+#endif
diff --git a/Source/JavaScriptCore/heap/HandleHeap.cpp b/Source/JavaScriptCore/heap/HandleHeap.cpp
new file mode 100644
index 0000000..1a0051e
--- /dev/null
+++ b/Source/JavaScriptCore/heap/HandleHeap.cpp
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HandleHeap.h"
+
+#include "JSObject.h"
+
+namespace JSC {
+
+WeakHandleOwner::~WeakHandleOwner()
+{
+}
+
+bool WeakHandleOwner::isReachableFromOpaqueRoots(Handle<Unknown>, void*, MarkStack&)
+{
+    return false;
+}
+
+void WeakHandleOwner::finalize(Handle<Unknown>, void*)
+{
+}
+
+HandleHeap::HandleHeap(JSGlobalData* globalData)
+    : m_globalData(globalData)
+    , m_nextToFinalize(0)
+{
+    grow();
+}
+
+void HandleHeap::grow()
+{
+    Node* block = m_blockStack.grow();
+    for (int i = m_blockStack.blockLength - 1; i >= 0; --i) {
+        Node* node = &block[i];
+        new (node) Node(this);
+        m_freeList.push(node);
+    }
+}
+
+void HandleHeap::markStrongHandles(HeapRootMarker& heapRootMarker)
+{
+    Node* end = m_strongList.end();
+    for (Node* node = m_strongList.begin(); node != end; node = node->next())
+        heapRootMarker.mark(node->slot());
+}
+
+void HandleHeap::markWeakHandles(HeapRootMarker& heapRootMarker)
+{
+    MarkStack& markStack = heapRootMarker.markStack();
+
+    Node* end = m_weakList.end();
+    for (Node* node = m_weakList.begin(); node != end; node = node->next()) {
+        ASSERT(isValidWeakNode(node));
+        JSCell* cell = node->slot()->asCell();
+        if (Heap::isMarked(cell))
+            continue;
+
+        WeakHandleOwner* weakOwner = node->weakOwner();
+        if (!weakOwner)
+            continue;
+
+        if (!weakOwner->isReachableFromOpaqueRoots(Handle<Unknown>::wrapSlot(node->slot()), node->weakOwnerContext(), markStack))
+            continue;
+
+        heapRootMarker.mark(node->slot());
+    }
+}
+
+void HandleHeap::finalizeWeakHandles()
+{
+    Node* end = m_weakList.end();
+    for (Node* node = m_weakList.begin(); node != end; node = m_nextToFinalize) {
+        m_nextToFinalize = node->next();
+
+        ASSERT(isValidWeakNode(node));
+        JSCell* cell = node->slot()->asCell();
+        if (Heap::isMarked(cell))
+            continue;
+
+        if (WeakHandleOwner* weakOwner = node->weakOwner()) {
+            weakOwner->finalize(Handle<Unknown>::wrapSlot(node->slot()), node->weakOwnerContext());
+            if (m_nextToFinalize != node->next()) // Owner deallocated node.
+                continue;
+        }
+
+        *node->slot() = JSValue();
+        SentinelLinkedList<Node>::remove(node);
+        m_immediateList.push(node);
+    }
+    
+    m_nextToFinalize = 0;
+}
+
+void HandleHeap::writeBarrier(HandleSlot slot, const JSValue& value)
+{
+    ASSERT(!m_nextToFinalize); // Forbid assignment to handles during the finalization phase, since it would violate many GC invariants.
+
+    if (!value == !*slot && slot->isCell() == value.isCell())
+        return;
+
+    Node* node = toNode(slot);
+    SentinelLinkedList<Node>::remove(node);
+    if (!value || !value.isCell()) {
+        m_immediateList.push(node);
+        return;
+    }
+
+    if (node->isWeak()) {
+        m_weakList.push(node);
+        return;
+    }
+
+    m_strongList.push(node);
+}
+
+unsigned HandleHeap::protectedGlobalObjectCount()
+{
+    unsigned count = 0;
+    Node* end = m_strongList.end();
+    for (Node* node = m_strongList.begin(); node != end; node = node->next()) {
+        JSValue value = *node->slot();
+        if (value.isObject() && asObject(value.asCell())->isGlobalObject())
+            count++;
+    }
+    return count;
+}
+
+#if !ASSERT_DISABLED
+bool HandleHeap::isValidWeakNode(Node* node)
+{
+    if (!node->isWeak())
+        return false;
+
+    JSValue value = *node->slot();
+    if (!value || !value.isCell())
+        return false;
+
+    JSCell* cell = value.asCell();
+    if (!cell || !cell->structure())
+        return false;
+
+#if ENABLE(JSC_ZOMBIES)
+    if (cell->isZombie())
+        return false;
+#endif
+
+    return true;
+}
+#endif
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/heap/HandleHeap.h b/Source/JavaScriptCore/heap/HandleHeap.h
new file mode 100644
index 0000000..886c94a
--- /dev/null
+++ b/Source/JavaScriptCore/heap/HandleHeap.h
@@ -0,0 +1,276 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HandleHeap_h
+#define HandleHeap_h
+
+#include "BlockStack.h"
+#include "Handle.h"
+#include "SentinelLinkedList.h"
+#include "SinglyLinkedList.h"
+
+namespace JSC {
+
+class HandleHeap;
+class HeapRootMarker;
+class JSGlobalData;
+class JSValue;
+class MarkStack;
+class TypeCounter;
+
+class WeakHandleOwner {
+public:
+    virtual ~WeakHandleOwner();
+    virtual bool isReachableFromOpaqueRoots(Handle<Unknown>, void* context, MarkStack&);
+    virtual void finalize(Handle<Unknown>, void* context);
+};
+
+class HandleHeap {
+public:
+    static HandleHeap* heapFor(HandleSlot);
+
+    HandleHeap(JSGlobalData*);
+    
+    JSGlobalData* globalData();
+
+    HandleSlot allocate();
+    void deallocate(HandleSlot);
+
+    void makeWeak(HandleSlot, WeakHandleOwner* = 0, void* context = 0);
+    HandleSlot copyWeak(HandleSlot);
+
+    void markStrongHandles(HeapRootMarker&);
+    void markWeakHandles(HeapRootMarker&);
+    void finalizeWeakHandles();
+
+    void writeBarrier(HandleSlot, const JSValue&);
+
+#if !ASSERT_DISABLED
+    bool hasWeakOwner(HandleSlot, WeakHandleOwner*);
+#endif
+
+    unsigned protectedGlobalObjectCount();
+    void protectedObjectTypeCounts(TypeCounter&);
+
+private:
+    class Node {
+    public:
+        Node(WTF::SentinelTag);
+        Node(HandleHeap*);
+        
+        HandleSlot slot();
+        HandleHeap* handleHeap();
+
+        void makeWeak(WeakHandleOwner*, void* context);
+        bool isWeak();
+        
+        WeakHandleOwner* weakOwner();
+        void* weakOwnerContext();
+
+        void setPrev(Node*);
+        Node* prev();
+
+        void setNext(Node*);
+        Node* next();
+
+    private:
+        WeakHandleOwner* emptyWeakOwner();
+
+        JSValue m_value;
+        HandleHeap* m_handleHeap;
+        WeakHandleOwner* m_weakOwner;
+        void* m_weakOwnerContext;
+        Node* m_prev;
+        Node* m_next;
+    };
+
+    static HandleSlot toHandle(Node*);
+    static Node* toNode(HandleSlot);
+
+    void grow();
+    
+#if !ASSERT_DISABLED
+    bool isValidWeakNode(Node*);
+#endif
+
+    JSGlobalData* m_globalData;
+    BlockStack<Node> m_blockStack;
+
+    SentinelLinkedList<Node> m_strongList;
+    SentinelLinkedList<Node> m_weakList;
+    SentinelLinkedList<Node> m_immediateList;
+    SinglyLinkedList<Node> m_freeList;
+    Node* m_nextToFinalize;
+};
+
+inline HandleHeap* HandleHeap::heapFor(HandleSlot handle)
+{
+    return toNode(handle)->handleHeap();
+}
+
+inline JSGlobalData* HandleHeap::globalData()
+{
+    return m_globalData;
+}
+
+inline HandleSlot HandleHeap::toHandle(Node* node)
+{
+    return reinterpret_cast<HandleSlot>(node);
+}
+
+inline HandleHeap::Node* HandleHeap::toNode(HandleSlot handle)
+{
+    return reinterpret_cast<Node*>(handle);
+}
+
+inline HandleSlot HandleHeap::allocate()
+{
+    if (m_freeList.isEmpty())
+        grow();
+
+    Node* node = m_freeList.pop();
+    new (node) Node(this);
+    m_immediateList.push(node);
+    return toHandle(node);
+}
+
+inline void HandleHeap::deallocate(HandleSlot handle)
+{
+    Node* node = toNode(handle);
+    if (node == m_nextToFinalize) {
+        m_nextToFinalize = node->next();
+        ASSERT(m_nextToFinalize->next());
+    }
+
+    SentinelLinkedList<Node>::remove(node);
+    m_freeList.push(node);
+}
+
+inline HandleSlot HandleHeap::copyWeak(HandleSlot other)
+{
+    Node* node = toNode(allocate());
+    node->makeWeak(toNode(other)->weakOwner(), toNode(other)->weakOwnerContext());
+    writeBarrier(node->slot(), *other);
+    *node->slot() = *other;
+    return toHandle(node);
+}
+
+inline void HandleHeap::makeWeak(HandleSlot handle, WeakHandleOwner* weakOwner, void* context)
+{
+    Node* node = toNode(handle);
+    node->makeWeak(weakOwner, context);
+
+    SentinelLinkedList<Node>::remove(node);
+    if (!*handle || !handle->isCell()) {
+        m_immediateList.push(node);
+        return;
+    }
+
+    m_weakList.push(node);
+}
+
+#if !ASSERT_DISABLED
+inline bool HandleHeap::hasWeakOwner(HandleSlot handle, WeakHandleOwner* weakOwner)
+{
+    return toNode(handle)->weakOwner() == weakOwner;
+}
+#endif
+
+inline HandleHeap::Node::Node(HandleHeap* handleHeap)
+    : m_handleHeap(handleHeap)
+    , m_weakOwner(0)
+    , m_weakOwnerContext(0)
+{
+}
+
+inline HandleHeap::Node::Node(WTF::SentinelTag)
+    : m_handleHeap(0)
+    , m_weakOwner(0)
+    , m_weakOwnerContext(0)
+{
+}
+
+inline HandleSlot HandleHeap::Node::slot()
+{
+    return &m_value;
+}
+
+inline HandleHeap* HandleHeap::Node::handleHeap()
+{
+    return m_handleHeap;
+}
+
+inline void HandleHeap::Node::makeWeak(WeakHandleOwner* weakOwner, void* context)
+{
+    m_weakOwner = weakOwner ? weakOwner : emptyWeakOwner();
+    m_weakOwnerContext = context;
+}
+
+inline bool HandleHeap::Node::isWeak()
+{
+    return m_weakOwner; // True for emptyWeakOwner().
+}
+
+inline WeakHandleOwner* HandleHeap::Node::weakOwner()
+{
+    return m_weakOwner == emptyWeakOwner() ? 0 : m_weakOwner; // 0 for emptyWeakOwner().
+}
+
+inline void* HandleHeap::Node::weakOwnerContext()
+{
+    ASSERT(weakOwner());
+    return m_weakOwnerContext;
+}
+
+inline void HandleHeap::Node::setPrev(Node* prev)
+{
+    m_prev = prev;
+}
+
+inline HandleHeap::Node* HandleHeap::Node::prev()
+{
+    return m_prev;
+}
+
+inline void HandleHeap::Node::setNext(Node* next)
+{
+    m_next = next;
+}
+
+inline HandleHeap::Node* HandleHeap::Node::next()
+{
+    return m_next;
+}
+
+// Sentinel to indicate that a node is weak, but its owner has no meaningful
+// callbacks. This allows us to optimize by skipping such nodes.
+inline WeakHandleOwner* HandleHeap::Node::emptyWeakOwner()
+{
+    return reinterpret_cast<WeakHandleOwner*>(-1);
+}
+
+}
+
+#endif
diff --git a/Source/JavaScriptCore/heap/HandleStack.cpp b/Source/JavaScriptCore/heap/HandleStack.cpp
new file mode 100644
index 0000000..1c151af
--- /dev/null
+++ b/Source/JavaScriptCore/heap/HandleStack.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "HandleStack.h"
+
+#include "MarkStack.h"
+
+namespace JSC {
+
+HandleStack::HandleStack()
+#ifndef NDEBUG
+    : m_scopeDepth(0)
+#endif
+{
+    grow();
+}
+
+void HandleStack::mark(HeapRootMarker& heapRootMarker)
+{
+    const Vector<HandleSlot>& blocks = m_blockStack.blocks();
+    size_t blockLength = m_blockStack.blockLength;
+
+    int end = blocks.size() - 1;
+    for (int i = 0; i < end; ++i) {
+        HandleSlot block = blocks[i];
+        heapRootMarker.mark(block, blockLength);
+    }
+    HandleSlot block = blocks[end];
+    heapRootMarker.mark(block, m_frame.m_next - block);
+}
+
+void HandleStack::grow()
+{
+    HandleSlot block = m_blockStack.grow();
+    m_frame.m_next = block;
+    m_frame.m_end = block + m_blockStack.blockLength;
+}
+
+}
diff --git a/Source/JavaScriptCore/heap/HandleStack.h b/Source/JavaScriptCore/heap/HandleStack.h
new file mode 100644
index 0000000..54e6c60
--- /dev/null
+++ b/Source/JavaScriptCore/heap/HandleStack.h
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HandleStack_h
+#define HandleStack_h
+
+#include "Assertions.h"
+#include "BlockStack.h"
+#include "Handle.h"
+
+#include <wtf/UnusedParam.h>
+
+namespace JSC {
+
+class LocalScope;
+class HeapRootMarker;
+
+class HandleStack {
+public:
+    class Frame {
+    public:
+        HandleSlot m_next;
+        HandleSlot m_end;
+    };
+
+    HandleStack();
+    
+    void enterScope(Frame&);
+    void leaveScope(Frame&);
+
+    HandleSlot push();
+
+    void mark(HeapRootMarker&);
+
+private:
+    void grow();
+    void zapTo(Frame&);
+    HandleSlot findFirstAfter(HandleSlot);
+
+#ifndef NDEBUG
+    size_t m_scopeDepth;
+#endif
+    BlockStack<JSValue> m_blockStack;
+    Frame m_frame;
+};
+
+inline void HandleStack::enterScope(Frame& lastFrame)
+{
+#ifndef NDEBUG
+    ++m_scopeDepth;
+#endif
+
+    lastFrame = m_frame;
+}
+
+
+
+inline void HandleStack::zapTo(Frame& lastFrame)
+{
+#ifdef NDEBUG
+    UNUSED_PARAM(lastFrame);
+#else
+    const Vector<HandleSlot>& blocks = m_blockStack.blocks();
+    
+    if (lastFrame.m_end != m_frame.m_end) { // Zapping to a frame in a different block.
+        int i = blocks.size() - 1;
+        for ( ; blocks[i] + m_blockStack.blockLength != lastFrame.m_end; --i) {
+            for (int j = m_blockStack.blockLength - 1; j >= 0; --j)
+                blocks[i][j] = JSValue();
+        }
+        
+        for (HandleSlot it = blocks[i] + m_blockStack.blockLength - 1; it != lastFrame.m_next - 1; --it)
+            *it = JSValue();
+        
+        return;
+    }
+    
+    for (HandleSlot it = m_frame.m_next - 1; it != lastFrame.m_next - 1; --it)
+        *it = JSValue();
+#endif
+}
+
+inline void HandleStack::leaveScope(Frame& lastFrame)
+{
+#ifndef NDEBUG
+    --m_scopeDepth;
+#endif
+
+    zapTo(lastFrame);
+
+    if (lastFrame.m_end != m_frame.m_end) // Popping to a frame in a different block.
+        m_blockStack.shrink(lastFrame.m_end);
+
+    m_frame = lastFrame;
+}
+
+inline HandleSlot HandleStack::push()
+{
+    ASSERT(m_scopeDepth); // Creating a Local outside of a LocalScope is a memory leak.
+    if (m_frame.m_next == m_frame.m_end)
+        grow();
+    return m_frame.m_next++;
+}
+
+}
+
+#endif
diff --git a/Source/JavaScriptCore/runtime/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index c05233c..11999b7 100644
--- a/Source/JavaScriptCore/runtime/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -22,9 +22,8 @@
 #include "Heap.h"
 
 #include "CodeBlock.h"
-#include "ConservativeSet.h"
+#include "ConservativeRoots.h"
 #include "GCActivityCallback.h"
-#include "GCHandle.h"
 #include "Interpreter.h"
 #include "JSGlobalData.h"
 #include "JSGlobalObject.h"
@@ -33,7 +32,7 @@
 #include "Tracing.h"
 #include <algorithm>
 
-#define COLLECT_ON_EVERY_ALLOCATION 0
+#define COLLECT_ON_EVERY_SLOW_ALLOCATION 0
 
 using namespace std;
 
@@ -47,10 +46,12 @@ Heap::Heap(JSGlobalData* globalData)
     , m_markListSet(0)
     , m_activityCallback(DefaultGCActivityCallback::create(this))
     , m_globalData(globalData)
-    , m_machineStackMarker(this)
+    , m_machineThreads(this)
     , m_markStack(globalData->jsArrayVPtr)
+    , m_handleHeap(globalData)
     , m_extraCost(0)
 {
+    m_markedSpace.setHighWaterMark(minBytesPerCycle);
     (*m_activityCallback)();
 }
 
@@ -74,9 +75,14 @@ void Heap::destroy()
     // (and thus the global data) before other objects that may use the global data.
     RefPtr<JSGlobalData> protect(m_globalData);
 
+#if ENABLE(JIT)
+    m_globalData->jitStubs->clearHostFunctionStubs();
+#endif
+
     delete m_markListSet;
     m_markListSet = 0;
-
+    m_markedSpace.clearMarks();
+    m_handleHeap.finalizeWeakHandles();
     m_markedSpace.destroy();
 
     m_globalData = 0;
@@ -95,69 +101,34 @@ void Heap::reportExtraMemoryCostSlowCase(size_t cost)
     // if a large value survives one garbage collection, there is not much point to
     // collecting more frequently as long as it stays alive.
 
-    if (m_extraCost > maxExtraCost && m_extraCost > m_markedSpace.capacity() / 2)
+    if (m_extraCost > maxExtraCost && m_extraCost > m_markedSpace.highWaterMark() / 2)
         collectAllGarbage();
     m_extraCost += cost;
 }
 
-void* Heap::allocate(size_t s)
+void* Heap::allocateSlowCase(size_t bytes)
 {
     ASSERT(globalData()->identifierTable == wtfThreadData().currentIdentifierTable());
     ASSERT(JSLock::lockCount() > 0);
     ASSERT(JSLock::currentThreadIsHoldingLock());
-    ASSERT_UNUSED(s, s <= MarkedBlock::CELL_SIZE);
+    ASSERT(bytes <= MarkedSpace::maxCellSize);
     ASSERT(m_operationInProgress == NoOperation);
 
-#if COLLECT_ON_EVERY_ALLOCATION
+#if COLLECT_ON_EVERY_SLOW_ALLOCATION
     collectAllGarbage();
     ASSERT(m_operationInProgress == NoOperation);
 #endif
 
+    reset(DoNotSweep);
+
     m_operationInProgress = Allocation;
-    void* result = m_markedSpace.allocate(s);
+    void* result = m_markedSpace.allocate(bytes);
     m_operationInProgress = NoOperation;
-    if (!result) {
-        reset(DoNotSweep);
-
-        m_operationInProgress = Allocation;
-        result = m_markedSpace.allocate(s);
-        m_operationInProgress = NoOperation;
-    }
 
     ASSERT(result);
     return result;
 }
 
-void Heap::updateWeakGCHandles()
-{
-    for (unsigned i = 0; i < m_weakGCHandlePools.size(); ++i)
-        weakGCHandlePool(i)->update();
-}
-
-void WeakGCHandlePool::update()
-{
-    for (unsigned i = 1; i < WeakGCHandlePool::numPoolEntries; ++i) {
-        if (m_entries[i].isValidPtr()) {
-            JSCell* cell = m_entries[i].get();
-            if (!cell || !Heap::isMarked(cell))
-                m_entries[i].invalidate();
-        }
-    }
-}
-
-WeakGCHandle* Heap::addWeakGCHandle(JSCell* ptr)
-{
-    for (unsigned i = 0; i < m_weakGCHandlePools.size(); ++i)
-        if (!weakGCHandlePool(i)->isFull())
-            return weakGCHandlePool(i)->allocate(ptr);
-
-    PageAllocationAligned allocation = PageAllocationAligned::allocate(WeakGCHandlePool::poolSize, WeakGCHandlePool::poolSize, OSAllocator::JSGCHeapPages);
-    m_weakGCHandlePools.append(allocation);
-
-    WeakGCHandlePool* pool = new (allocation.base()) WeakGCHandlePool();
-    return pool->allocate(ptr);
-}
-
 void Heap::protect(JSValue k)
 {
     ASSERT(k);
@@ -180,11 +151,11 @@ bool Heap::unprotect(JSValue k)
     return m_protectedValues.remove(k.asCell());
 }
 
-void Heap::markProtectedObjects(MarkStack& markStack)
+void Heap::markProtectedObjects(HeapRootMarker& heapRootMarker)
 {
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it)
-        markStack.deprecatedAppend(&it->first);
+        heapRootMarker.mark(&it->first);
 }
 
 void Heap::pushTempSortVector(Vector<ValueStringPair>* tempVector)
@@ -198,7 +169,7 @@ void Heap::popTempSortVector(Vector<ValueStringPair>* tempVector)
     m_tempSortingVectors.removeLast();
 }
     
-void Heap::markTempSortVectors(MarkStack& markStack)
+void Heap::markTempSortVectors(HeapRootMarker& heapRootMarker)
 {
     typedef Vector<Vector<ValueStringPair>* > VectorOfValueStringVectors;
 
@@ -209,7 +180,7 @@ void Heap::markTempSortVectors(MarkStack& markStack)
         Vector<ValueStringPair>::iterator vectorEnd = tempSortingVector->end();
         for (Vector<ValueStringPair>::iterator vectorIt = tempSortingVector->begin(); vectorIt != vectorEnd; ++vectorIt) {
             if (vectorIt->first)
-                markStack.deprecatedAppend(&vectorIt->first);
+                heapRootMarker.mark(&vectorIt->first);
         }
     }
 }
@@ -228,55 +199,69 @@ void Heap::markRoots()
     }
 #endif
 
+    void* dummy;
+
     ASSERT(m_operationInProgress == NoOperation);
     if (m_operationInProgress != NoOperation)
         CRASH();
 
     m_operationInProgress = Collection;
 
-    // We gather the conservative set before clearing mark bits, because
+    MarkStack& markStack = m_markStack;
+    HeapRootMarker heapRootMarker(markStack);
+    
+    // We gather conservative roots before clearing mark bits because
     // conservative gathering uses the mark bits from our last mark pass to
     // determine whether a reference is valid.
-    ConservativeSet conservativeSet(this);
-    m_machineStackMarker.markMachineStackConservatively(conservativeSet);
-    conservativeSet.add(registerFile().start(), registerFile().end());
+    ConservativeRoots machineThreadRoots(this);
+    m_machineThreads.gatherConservativeRoots(machineThreadRoots, &dummy);
+
+    ConservativeRoots registerFileRoots(this);
+    registerFile().gatherConservativeRoots(registerFileRoots);
 
     m_markedSpace.clearMarks();
 
-    MarkStack& markStack = m_markStack;
-    conservativeSet.mark(markStack);
+    markStack.append(machineThreadRoots);
     markStack.drain();
 
-    // Mark explicitly registered roots.
-    markProtectedObjects(markStack);
+    markStack.append(registerFileRoots);
     markStack.drain();
-    
-    // Mark temporary vector for Array sorting
-    markTempSortVectors(markStack);
+
+    markProtectedObjects(heapRootMarker);
     markStack.drain();
     
-    HashSet<GlobalCodeBlock*>::const_iterator end = m_codeBlocks.end();
-    for (HashSet<GlobalCodeBlock*>::const_iterator it = m_codeBlocks.begin(); it != end; ++it)
-        (*it)->markAggregate(markStack);
+    markTempSortVectors(heapRootMarker);
     markStack.drain();
 
-    // Mark misc. other roots.
     if (m_markListSet && m_markListSet->size())
-        MarkedArgumentBuffer::markLists(markStack, *m_markListSet);
+        MarkedArgumentBuffer::markLists(heapRootMarker, *m_markListSet);
     if (m_globalData->exception)
-        markStack.append(&m_globalData->exception);
-    if (m_globalData->firstStringifierToMark)
-        JSONObject::markStringifiers(markStack, m_globalData->firstStringifierToMark);
+        heapRootMarker.mark(&m_globalData->exception);
     markStack.drain();
 
-    // Mark the small strings cache last, since it will clear itself if nothing
-    // else has marked it.
-    m_globalData->smallStrings.markChildren(markStack);
+    m_handleHeap.markStrongHandles(heapRootMarker);
+    markStack.drain();
 
+    m_handleStack.mark(heapRootMarker);
     markStack.drain();
-    markStack.compact();
 
-    updateWeakGCHandles();
+    // Mark the small strings cache as late as possible, since it will clear
+    // itself if nothing else has marked it.
+    // FIXME: Change the small strings cache to use Weak<T>.
+    m_globalData->smallStrings.markChildren(heapRootMarker);
+    markStack.drain();
+    
+    // Weak handles must be marked last, because their owners use the set of
+    // opaque roots to determine reachability.
+    int lastOpaqueRootCount;
+    do {
+        lastOpaqueRootCount = markStack.opaqueRootCount();
+        m_handleHeap.markWeakHandles(heapRootMarker);
+        markStack.drain();
+    // If the set of opaque roots has grown, more weak handles may have become reachable.
+    } while (lastOpaqueRootCount != markStack.opaqueRootCount());
+
+    markStack.reset();
 
     m_operationInProgress = NoOperation;
 }
@@ -298,18 +283,17 @@ size_t Heap::capacity() const
 
 size_t Heap::globalObjectCount()
 {
-    return m_globalData->globalObjects.uncheckedSize();
+    return m_globalData->globalObjectCount;
 }
 
 size_t Heap::protectedGlobalObjectCount()
 {
-    size_t count = 0;
+    size_t count = m_handleHeap.protectedGlobalObjectCount();
 
-    GlobalObjectMap& map = m_globalData->globalObjects;
-    GlobalObjectMap::iterator end = map.uncheckedEnd();
-    for (GlobalObjectMap::iterator it = map.uncheckedBegin(); it != end; ++it) {
-        if (map.isValid(it) && m_protectedValues.contains(it->second.get()))
-            ++count;
+    ProtectCountSet::iterator end = m_protectedValues.end();
+    for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it) {
+        if (it->first->isObject() && asObject(it->first)->isGlobalObject())
+            count++;
     }
 
     return count;
@@ -346,10 +330,11 @@ inline const char* TypeCounter::typeName(JSCell* cell)
         return "API wrapper";
     if (cell->isPropertyNameIterator())
         return "For-in iterator";
+    if (const ClassInfo* info = cell->classInfo())
+        return info->className;
     if (!cell->isObject())
         return "[empty cell]";
-    const ClassInfo* info = cell->classInfo();
-    return info ? info->className : "Object";
+    return "Object";
 }
 
 inline void TypeCounter::operator()(JSCell* cell)
@@ -369,10 +354,21 @@ PassOwnPtr<TypeCountSet> Heap::protectedObjectTypeCounts()
     ProtectCountSet::iterator end = m_protectedValues.end();
     for (ProtectCountSet::iterator it = m_protectedValues.begin(); it != end; ++it)
         typeCounter(it->first);
+    m_handleHeap.protectedObjectTypeCounts(typeCounter);
 
     return typeCounter.take();
 }
 
+void HandleHeap::protectedObjectTypeCounts(TypeCounter& typeCounter)
+{
+    Node* end = m_strongList.end();
+    for (Node* node = m_strongList.begin(); node != end; node = node->next()) {
+        JSValue value = *node->slot();
+        if (value && value.isCell())
+            typeCounter(value.asCell());
+    }
+}
+
 PassOwnPtr<TypeCountSet> Heap::objectTypeCounts()
 {
     TypeCounter typeCounter;
@@ -396,18 +392,27 @@ void Heap::reset(SweepToggle sweepToggle)
     JAVASCRIPTCORE_GC_BEGIN();
 
     markRoots();
+    m_handleHeap.finalizeWeakHandles();
 
     JAVASCRIPTCORE_GC_MARKED();
 
     m_markedSpace.reset();
     m_extraCost = 0;
 
+#if ENABLE(JSC_ZOMBIES)
+    sweepToggle = DoSweep;
+#endif
+
     if (sweepToggle == DoSweep) {
         m_markedSpace.sweep();
         m_markedSpace.shrink();
     }
 
-    size_t proportionalBytes = static_cast<size_t>(1.5 * m_markedSpace.size());
+    // To avoid pathological GC churn in large heaps, we set the allocation high
+    // water mark to be proportional to the current size of the heap. The exact
+    // proportion is a bit arbitrary. A 2X multiplier gives a 1:1 (heap size :
+    // new bytes allocated) proportion, and seems to work well in benchmarks.
+    size_t proportionalBytes = 2 * m_markedSpace.size();
     m_markedSpace.setHighWaterMark(max(proportionalBytes, minBytesPerCycle));
 
     JAVASCRIPTCORE_GC_END();
diff --git a/Source/JavaScriptCore/runtime/Heap.h b/Source/JavaScriptCore/heap/Heap.h
index 6591a5b..c2d3bac 100644
--- a/Source/JavaScriptCore/runtime/Heap.h
+++ b/Source/JavaScriptCore/heap/Heap.h
@@ -22,19 +22,22 @@
 #ifndef Heap_h
 #define Heap_h
 
+#include "HandleHeap.h"
+#include "HandleStack.h"
 #include "MarkStack.h"
 #include "MarkedSpace.h"
 #include <wtf/Forward.h>
+#include <wtf/HashCountedSet.h>
 #include <wtf/HashSet.h>
 
 namespace JSC {
 
     class GCActivityCallback;
     class GlobalCodeBlock;
+    class HeapRootMarker;
     class JSCell;
     class JSGlobalData;
     class JSValue;
-    class JSValue;
     class LiveObjectIterator;
     class MarkStack;
     class MarkedArgumentBuffer;
@@ -64,7 +67,7 @@ namespace JSC {
 
         JSGlobalData* globalData() const { return m_globalData; }
         MarkedSpace& markedSpace() { return m_markedSpace; }
-        MachineStackMarker& machineStackMarker() { return m_machineStackMarker; }
+        MachineThreads& machineThreads() { return m_machineThreads; }
 
         GCActivityCallback* activityCallback();
         void setActivityCallback(PassOwnPtr<GCActivityCallback>);
@@ -89,32 +92,31 @@ namespace JSC {
         PassOwnPtr<TypeCountSet> protectedObjectTypeCounts();
         PassOwnPtr<TypeCountSet> objectTypeCounts();
 
-        WeakGCHandle* addWeakGCHandle(JSCell*);
-
         void pushTempSortVector(Vector<ValueStringPair>*);
         void popTempSortVector(Vector<ValueStringPair>*);
-        
-        HashSet<GlobalCodeBlock*>& codeBlocks() { return m_codeBlocks; }
-
+    
         HashSet<MarkedArgumentBuffer*>& markListSet() { if (!m_markListSet) m_markListSet = new HashSet<MarkedArgumentBuffer*>; return *m_markListSet; }
         
         template <typename Functor> void forEach(Functor&);
         
+        HandleSlot allocateGlobalHandle() { return m_handleHeap.allocate(); }
+        HandleSlot allocateLocalHandle() { return m_handleStack.push(); }
+
+        HandleStack* handleStack() { return &m_handleStack; }
+
     private:
         friend class JSGlobalData;
 
         static const size_t minExtraCost = 256;
         static const size_t maxExtraCost = 1024 * 1024;
 
+        void* allocateSlowCase(size_t);
         void reportExtraMemoryCostSlowCase(size_t);
 
         void markRoots();
-        void markProtectedObjects(MarkStack&);
-        void markTempSortVectors(MarkStack&);
+        void markProtectedObjects(HeapRootMarker&);
+        void markTempSortVectors(HeapRootMarker&);
 
-        void updateWeakGCHandles();
-        WeakGCHandlePool* weakGCHandlePool(size_t index);
-        
         enum SweepToggle { DoNotSweep, DoSweep };
         void reset(SweepToggle);
 
@@ -124,9 +126,7 @@ namespace JSC {
         MarkedSpace m_markedSpace;
 
         ProtectCountSet m_protectedValues;
-        Vector<PageAllocationAligned> m_weakGCHandlePools;
         Vector<Vector<ValueStringPair>* > m_tempSortingVectors;
-        HashSet<GlobalCodeBlock*> m_codeBlocks;
 
         HashSet<MarkedArgumentBuffer*>* m_markListSet;
 
@@ -134,9 +134,11 @@ namespace JSC {
 
         JSGlobalData* m_globalData;
         
-        MachineStackMarker m_machineStackMarker;
+        MachineThreads m_machineThreads;
         MarkStack m_markStack;
-        
+        HandleHeap m_handleHeap;
+        HandleStack m_handleStack;
+
         size_t m_extraCost;
     };
 
@@ -165,11 +167,6 @@ namespace JSC {
         if (cost > minExtraCost) 
             reportExtraMemoryCostSlowCase(cost);
     }
-    
-    inline WeakGCHandlePool* Heap::weakGCHandlePool(size_t index)
-    {
-        return static_cast<WeakGCHandlePool*>(m_weakGCHandlePools[index].base());
-    }
 
     template <typename Functor> inline void Heap::forEach(Functor& functor)
     {
diff --git a/Source/JavaScriptCore/heap/Local.h b/Source/JavaScriptCore/heap/Local.h
new file mode 100644
index 0000000..ac7d136
--- /dev/null
+++ b/Source/JavaScriptCore/heap/Local.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Local_h
+#define Local_h
+
+#include "Handle.h"
+#include "JSGlobalData.h"
+
+/*
+    A strongly referenced handle whose lifetime is temporary, limited to a given
+    LocalScope. Use Locals for local values on the stack. It is an error to
+    create a Local outside of any LocalScope.
+*/
+
+namespace JSC {
+
+template <typename T> class Local : public Handle<T> {
+    friend class LocalScope;
+    using Handle<T>::slot;
+
+public:
+    typedef typename Handle<T>::ExternalType ExternalType;
+
+    Local(JSGlobalData&, ExternalType = ExternalType());
+    Local(JSGlobalData&, Handle<T>);
+    Local(const Local<T>&); // Adopting constructor. Used to return a Local to a calling function.
+
+    Local& operator=(ExternalType);
+    Local& operator=(Handle<T>);
+
+private:
+    Local(HandleSlot, ExternalType); // Used by LocalScope::release() to move a Local to a containing scope.
+    void set(ExternalType);
+};
+
+template <typename T> inline Local<T>::Local(JSGlobalData& globalData, ExternalType value)
+    : Handle<T>(globalData.allocateLocalHandle())
+{
+    set(value);
+}
+
+template <typename T> inline Local<T>::Local(JSGlobalData& globalData, Handle<T> other)
+    : Handle<T>(globalData.allocateLocalHandle())
+{
+    set(other.get());
+}
+
+template <typename T> inline Local<T>::Local(const Local<T>& other)
+    : Handle<T>(other.slot())
+{
+    const_cast<Local<T>&>(other).setSlot(0); // Prevent accidental sharing.
+}
+
+template <typename T> inline Local<T>::Local(HandleSlot slot, ExternalType value)
+    : Handle<T>(slot, value)
+{
+}
+
+template <typename T> inline Local<T>& Local<T>::operator=(ExternalType value)
+{
+    set(value);
+    return *this;
+}
+
+template <typename T> inline Local<T>& Local<T>::operator=(Handle<T> other)
+{
+    set(other.get());
+    return *this;
+}
+
+template <typename T> inline void Local<T>::set(ExternalType externalType)
+{
+    ASSERT(slot());
+    ASSERT(!HandleTypes<T>::toJSValue(externalType) || !HandleTypes<T>::toJSValue(externalType).isCell() || Heap::isMarked(HandleTypes<T>::toJSValue(externalType).asCell()));
+    *slot() = externalType;
+}
+
+
+template <typename T, unsigned inlineCapacity = 0> class LocalStack {
+    typedef typename Handle<T>::ExternalType ExternalType;
+public:
+    LocalStack(JSGlobalData& globalData)
+        : m_globalData(&globalData)
+        , m_count(0)
+    {
+    }
+
+    ExternalType peek() const
+    {
+        ASSERT(m_count > 0);
+        return m_stack[m_count - 1].get();
+    }
+
+    ExternalType pop()
+    {
+        ASSERT(m_count > 0);
+        return m_stack[--m_count].get();
+    }
+
+    void push(ExternalType value)
+    {
+        if (m_count == m_stack.size())
+            m_stack.append(Local<T>(*m_globalData, value));
+        else
+            m_stack[m_count] = value;
+        m_count++;
+    }
+
+    bool isEmpty() const { return !m_count; }
+    unsigned size() const { return m_count; }
+
+private:
+    RefPtr<JSGlobalData> m_globalData;
+    Vector<Local<T>, inlineCapacity> m_stack;
+    unsigned m_count;
+};
+
+}
+
+namespace WTF {
+
+template<typename T> struct VectorTraits<JSC::Local<T> > : SimpleClassVectorTraits {
+    static const bool needsDestruction = false;
+    static const bool canInitializeWithMemset = false;
+    static const bool canCompareWithMemcmp = false;
+};
+
+}
+
+#endif
diff --git a/Source/JavaScriptCore/heap/LocalScope.h b/Source/JavaScriptCore/heap/LocalScope.h
new file mode 100644
index 0000000..cd27b32
--- /dev/null
+++ b/Source/JavaScriptCore/heap/LocalScope.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LocalScope_h
+#define LocalScope_h
+
+#include "HandleStack.h"
+#include "Local.h"
+
+namespace JSC {
+/*  
+    A LocalScope is a temporary scope in which Locals are allocated. When a
+    LocalScope goes out of scope, all the Locals created in it are destroyed.
+
+    LocalScope is similar in concept to NSAutoreleasePool.
+*/
+
+class JSGlobalData;
+
+class LocalScope {
+public:
+    explicit LocalScope(JSGlobalData&);
+    ~LocalScope();
+    
+    template <typename T> Local<T> release(Local<T>); // Destroys all other locals in the scope.
+
+private:
+    HandleStack* m_handleStack;
+    HandleStack::Frame m_lastFrame;
+};
+
+inline LocalScope::LocalScope(JSGlobalData& globalData)
+    : m_handleStack(globalData.heap.handleStack())
+{
+    m_handleStack->enterScope(m_lastFrame);
+}
+
+inline LocalScope::~LocalScope()
+{
+    m_handleStack->leaveScope(m_lastFrame);
+}
+
+template <typename T> Local<T> LocalScope::release(Local<T> local)
+{
+    typename Local<T>::ExternalType ptr = local.get();
+
+    m_handleStack->leaveScope(m_lastFrame);
+    HandleSlot slot = m_handleStack->push();
+    m_handleStack->enterScope(m_lastFrame);
+
+    return Local<T>(slot, ptr);
+}
+
+}
+
+#endif
diff --git a/Source/JavaScriptCore/runtime/MachineStackMarker.cpp b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
index 4430947..1f4f3ce 100644
--- a/Source/JavaScriptCore/runtime/MachineStackMarker.cpp
+++ b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
@@ -1,6 +1,7 @@
 /*
  *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ *  Copyright (C) 2009 Acision BV. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -21,12 +22,17 @@
 #include "config.h"
 #include "MachineStackMarker.h"
 
-#include "ConservativeSet.h"
+#include "ConservativeRoots.h"
 #include "Heap.h"
 #include "JSArray.h"
 #include "JSGlobalData.h"
 #include <setjmp.h>
 #include <stdlib.h>
+#include <wtf/StdLibExtras.h>
+
+#if USE(PTHREAD_BASED_QT) && !defined(WTF_USE_PTHREADS)
+#define WTF_USE_PTHREADS 1
+#endif
 
 #if OS(DARWIN)
 
@@ -70,8 +76,17 @@
 #include <errno.h>
 #endif
 
+#if USE(PTHREADS) && !OS(WINDOWS) && !OS(DARWIN)
+#include <signal.h>
+#ifndef SA_RESTART
+#error MachineThreads requires SA_RESTART
+#endif
+#endif
+
 #endif
 
+using namespace WTF;
+
 namespace JSC {
 
 static inline void swapIfBackwards(void*& begin, void*& end)
@@ -92,15 +107,38 @@ UNUSED_PARAM(end);
 typedef mach_port_t PlatformThread;
 #elif OS(WINDOWS)
 typedef HANDLE PlatformThread;
+#elif USE(PTHREADS)
+typedef pthread_t PlatformThread;
+static const int SigThreadSuspendResume = SIGUSR2;
+
+static void pthreadSignalHandlerSuspendResume(int signo)
+{
+    sigset_t signalSet;
+    sigemptyset(&signalSet);
+    sigaddset(&signalSet, SigThreadSuspendResume);
+    sigsuspend(&signalSet);
+}
 #endif
 
-class MachineStackMarker::Thread {
+class MachineThreads::Thread {
 public:
     Thread(pthread_t pthread, const PlatformThread& platThread, void* base) 
         : posixThread(pthread)
         , platformThread(platThread)
         , stackBase(base)
     {
+#if USE(PTHREADS) && !OS(WINDOWS) && !OS(DARWIN)
+        struct sigaction action;
+        action.sa_handler = pthreadSignalHandlerSuspendResume;
+        sigemptyset(&action.sa_mask);
+        action.sa_flags = SA_RESTART;
+        sigaction(SigThreadSuspendResume, &action, 0);
+
+        sigset_t mask;
+        sigemptyset(&mask);
+        sigaddset(&mask, SigThreadSuspendResume);
+        pthread_sigmask(SIG_UNBLOCK, &mask, 0);
+#endif
     }
 
     Thread* next;
@@ -111,20 +149,20 @@ public:
 
 #endif
 
-MachineStackMarker::MachineStackMarker(Heap* heap)
+MachineThreads::MachineThreads(Heap* heap)
     : m_heap(heap)
 #if ENABLE(JSC_MULTIPLE_THREADS)
     , m_registeredThreads(0)
-    , m_currentThreadRegistrar(0)
+    , m_threadSpecific(0)
 #endif
 {
 }
 
-MachineStackMarker::~MachineStackMarker()
+MachineThreads::~MachineThreads()
 {
 #if ENABLE(JSC_MULTIPLE_THREADS)
-    if (m_currentThreadRegistrar) {
-        int error = pthread_key_delete(m_currentThreadRegistrar);
+    if (m_threadSpecific) {
+        int error = pthread_key_delete(m_threadSpecific);
         ASSERT_UNUSED(error, !error);
     }
 
@@ -145,27 +183,29 @@ static inline PlatformThread getCurrentPlatformThread()
     return pthread_mach_thread_np(pthread_self());
 #elif OS(WINDOWS)
     return pthread_getw32threadhandle_np(pthread_self());
+#elif USE(PTHREADS)
+    return pthread_self();
 #endif
 }
 
-void MachineStackMarker::makeUsableFromMultipleThreads()
+void MachineThreads::makeUsableFromMultipleThreads()
 {
-    if (m_currentThreadRegistrar)
+    if (m_threadSpecific)
         return;
 
-    int error = pthread_key_create(&m_currentThreadRegistrar, unregisterThread);
+    int error = pthread_key_create(&m_threadSpecific, removeThread);
     if (error)
         CRASH();
 }
 
-void MachineStackMarker::registerThread()
+void MachineThreads::addCurrentThread()
 {
     ASSERT(!m_heap->globalData()->exclusiveThread || m_heap->globalData()->exclusiveThread == currentThread());
 
-    if (!m_currentThreadRegistrar || pthread_getspecific(m_currentThreadRegistrar))
+    if (!m_threadSpecific || pthread_getspecific(m_threadSpecific))
         return;
 
-    pthread_setspecific(m_currentThreadRegistrar, this);
+    pthread_setspecific(m_threadSpecific, this);
     Thread* thread = new Thread(pthread_self(), getCurrentPlatformThread(), m_heap->globalData()->stack().origin());
 
     MutexLocker lock(m_registeredThreadsMutex);
@@ -174,13 +214,13 @@ void MachineStackMarker::registerThread()
     m_registeredThreads = thread;
 }
 
-void MachineStackMarker::unregisterThread(void* p)
+void MachineThreads::removeThread(void* p)
 {
     if (p)
-        static_cast<MachineStackMarker*>(p)->unregisterThread();
+        static_cast<MachineThreads*>(p)->removeCurrentThread();
 }
 
-void MachineStackMarker::unregisterThread()
+void MachineThreads::removeCurrentThread()
 {
     pthread_t currentPosixThread = pthread_self();
 
@@ -207,21 +247,13 @@ void MachineStackMarker::unregisterThread()
 
 #endif
 
-void NEVER_INLINE MachineStackMarker::markCurrentThreadConservativelyInternal(ConservativeSet& conservativeSet)
-{
-    void* begin = m_heap->globalData()->stack().current();
-    void* end = m_heap->globalData()->stack().origin();
-    swapIfBackwards(begin, end);
-    conservativeSet.add(begin, end);
-}
-
 #if COMPILER(GCC)
 #define REGISTER_BUFFER_ALIGNMENT __attribute__ ((aligned (sizeof(void*))))
 #else
 #define REGISTER_BUFFER_ALIGNMENT
 #endif
 
-void MachineStackMarker::markCurrentThreadConservatively(ConservativeSet& conservativeSet)
+void MachineThreads::gatherFromCurrentThread(ConservativeRoots& conservativeRoots, void* stackCurrent)
 {
     // setjmp forces volatile registers onto the stack
     jmp_buf registers REGISTER_BUFFER_ALIGNMENT;
@@ -234,7 +266,15 @@ void MachineStackMarker::markCurrentThreadConservatively(ConservativeSet& conser
 #pragma warning(pop)
 #endif
 
-    markCurrentThreadConservativelyInternal(conservativeSet);
+    void* registersBegin = &registers;
+    void* registersEnd = reinterpret_cast<void*>(roundUpToMultipleOf<sizeof(void*)>(reinterpret_cast<uintptr_t>(&registers + 1)));
+    swapIfBackwards(registersBegin, registersEnd);
+    conservativeRoots.add(registersBegin, registersEnd);
+
+    void* stackBegin = stackCurrent;
+    void* stackEnd = m_heap->globalData()->stack().origin();
+    swapIfBackwards(stackBegin, stackEnd);
+    conservativeRoots.add(stackBegin, stackEnd);
 }
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
@@ -245,6 +285,8 @@ static inline void suspendThread(const PlatformThread& platformThread)
     thread_suspend(platformThread);
 #elif OS(WINDOWS)
     SuspendThread(platformThread);
+#elif USE(PTHREADS)
+    pthread_kill(platformThread, SigThreadSuspendResume);
 #else
 #error Need a way to suspend threads on this platform
 #endif
@@ -256,6 +298,8 @@ static inline void resumeThread(const PlatformThread& platformThread)
     thread_resume(platformThread);
 #elif OS(WINDOWS)
     ResumeThread(platformThread);
+#elif USE(PTHREADS)
+    pthread_kill(platformThread, SigThreadSuspendResume);
 #else
 #error Need a way to resume threads on this platform
 #endif
@@ -281,6 +325,8 @@ typedef arm_thread_state_t PlatformThreadRegisters;
 
 #elif OS(WINDOWS) && CPU(X86)
 typedef CONTEXT PlatformThreadRegisters;
+#elif USE(PTHREADS)
+typedef pthread_attr_t PlatformThreadRegisters;
 #else
 #error Need a thread register struct for this platform
 #endif
@@ -321,6 +367,16 @@ static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, P
     regs.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL | CONTEXT_SEGMENTS;
     GetThreadContext(platformThread, &regs);
     return sizeof(CONTEXT);
+#elif USE(PTHREADS)
+    pthread_attr_init(&regs);
+#if HAVE(PTHREAD_NP_H) || OS(NETBSD)
+    // e.g. on FreeBSD 5.4, neundorf@kde.org
+    pthread_attr_get_np(platformThread, &regs);
+#else
+    // FIXME: this function is non-portable; other POSIX systems may have different np alternatives
+    pthread_getattr_np(platformThread, &regs);
+#endif
+    return 0;
 #else
 #error Need a way to get thread registers on this platform
 #endif
@@ -361,52 +417,69 @@ static inline void* otherThreadStackPointer(const PlatformThreadRegisters& regs)
 // end OS(DARWIN)
 #elif CPU(X86) && OS(WINDOWS)
     return reinterpret_cast<void*>((uintptr_t) regs.Esp);
+#elif USE(PTHREADS)
+    void* stackBase = 0;
+    size_t stackSize = 0;
+    int rc = pthread_attr_getstack(&regs, &stackBase, &stackSize);
+    (void)rc; // FIXME: Deal with error code somehow? Seems fatal.
+    ASSERT(stackBase);
+    return static_cast<char*>(stackBase) + stackSize;
 #else
 #error Need a way to get the stack pointer for another thread on this platform
 #endif
 }
 
-void MachineStackMarker::markOtherThreadConservatively(ConservativeSet& conservativeSet, Thread* thread)
+static void freePlatformThreadRegisters(PlatformThreadRegisters& regs)
+{
+#if USE(PTHREADS) && !OS(WINDOWS) && !OS(DARWIN)
+    pthread_attr_destroy(&regs);
+#else
+    UNUSED_PARAM(regs);
+#endif
+}
+
+void MachineThreads::gatherFromOtherThread(ConservativeRoots& conservativeRoots, Thread* thread)
 {
     suspendThread(thread->platformThread);
 
     PlatformThreadRegisters regs;
     size_t regSize = getPlatformThreadRegisters(thread->platformThread, regs);
 
-    // mark the thread's registers
-    conservativeSet.add(static_cast<void*>(&regs), static_cast<void*>(reinterpret_cast<char*>(&regs) + regSize));
+    conservativeRoots.add(static_cast<void*>(&regs), static_cast<void*>(reinterpret_cast<char*>(&regs) + regSize));
 
     void* stackPointer = otherThreadStackPointer(regs);
     void* stackBase = thread->stackBase;
     swapIfBackwards(stackPointer, stackBase);
-    conservativeSet.add(stackPointer, stackBase);
+    conservativeRoots.add(stackPointer, stackBase);
 
     resumeThread(thread->platformThread);
+
+    freePlatformThreadRegisters(regs);
 }
 
 #endif
 
-void MachineStackMarker::markMachineStackConservatively(ConservativeSet& conservativeSet)
+void MachineThreads::gatherConservativeRoots(ConservativeRoots& conservativeRoots, void* stackCurrent)
 {
-    markCurrentThreadConservatively(conservativeSet);
+    gatherFromCurrentThread(conservativeRoots, stackCurrent);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
 
-    if (m_currentThreadRegistrar) {
+    if (m_threadSpecific) {
 
         MutexLocker lock(m_registeredThreadsMutex);
 
 #ifndef NDEBUG
-        // Forbid malloc during the mark phase. Marking a thread suspends it, so 
-        // a malloc inside markChildren() would risk a deadlock with a thread that had been 
-        // suspended while holding the malloc lock.
+        // Forbid malloc during the gather phase. The gather phase suspends
+        // threads, so a malloc during gather would risk a deadlock with a
+        // thread that had been suspended while holding the malloc lock.
         fastMallocForbid();
 #endif
         // It is safe to access the registeredThreads list, because we earlier asserted that locks are being held,
         // and since this is a shared heap, they are real locks.
         for (Thread* thread = m_registeredThreads; thread; thread = thread->next) {
             if (!pthread_equal(thread->posixThread, pthread_self()))
-                markOtherThreadConservatively(conservativeSet, thread);
+                gatherFromOtherThread(conservativeRoots, thread);
         }
 #ifndef NDEBUG
         fastMallocAllow();
diff --git a/Source/JavaScriptCore/runtime/MachineStackMarker.h b/Source/JavaScriptCore/heap/MachineStackMarker.h
index 8afdb46..c814ac5 100644
--- a/Source/JavaScriptCore/runtime/MachineStackMarker.h
+++ b/Source/JavaScriptCore/heap/MachineStackMarker.h
@@ -19,8 +19,8 @@
  *
  */
 
-#ifndef MachineStackMarker_h
-#define MachineStackMarker_h
+#ifndef MachineThreads_h
+#define MachineThreads_h
 
 #include <wtf/Noncopyable.h>
 #include <wtf/ThreadingPrimitives.h>
@@ -32,32 +32,31 @@
 namespace JSC {
 
     class Heap;
-    class ConservativeSet;
+    class ConservativeRoots;
 
-    class MachineStackMarker {
-        WTF_MAKE_NONCOPYABLE(MachineStackMarker);
+    class MachineThreads {
+        WTF_MAKE_NONCOPYABLE(MachineThreads);
     public:
-        MachineStackMarker(Heap*);
-        ~MachineStackMarker();
+        MachineThreads(Heap*);
+        ~MachineThreads();
 
-        void markMachineStackConservatively(ConservativeSet&);
+        void gatherConservativeRoots(ConservativeRoots&, void* stackCurrent);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
         void makeUsableFromMultipleThreads();
-        void registerThread(); // Only needs to be called by clients that can use the same heap from multiple threads.
+        void addCurrentThread(); // Only needs to be called by clients that can use the same heap from multiple threads.
 #endif
 
     private:
-        void markCurrentThreadConservatively(ConservativeSet&);
-        void markCurrentThreadConservativelyInternal(ConservativeSet&);
+        void gatherFromCurrentThread(ConservativeRoots&, void* stackCurrent);
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
         class Thread;
 
-        static void unregisterThread(void*);
+        static void removeThread(void*);
+        void removeCurrentThread();
 
-        void unregisterThread();
-        void markOtherThreadConservatively(ConservativeSet&, Thread*);
+        void gatherFromOtherThread(ConservativeRoots&, Thread*);
 #endif
 
         Heap* m_heap;
@@ -65,10 +64,10 @@ namespace JSC {
 #if ENABLE(JSC_MULTIPLE_THREADS)
         Mutex m_registeredThreadsMutex;
         Thread* m_registeredThreads;
-        pthread_key_t m_currentThreadRegistrar;
+        pthread_key_t m_threadSpecific;
 #endif
     };
 
 } // namespace JSC
 
-#endif // MachineStackMarker_h
+#endif // MachineThreads_h
diff --git a/Source/JavaScriptCore/heap/MarkStack.cpp b/Source/JavaScriptCore/heap/MarkStack.cpp
new file mode 100644
index 0000000..3fb1a98
--- /dev/null
+++ b/Source/JavaScriptCore/heap/MarkStack.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2009, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MarkStack.h"
+
+#include "ConservativeRoots.h"
+#include "Heap.h"
+#include "JSArray.h"
+#include "JSCell.h"
+#include "JSObject.h"
+#include "ScopeChain.h"
+#include "Structure.h"
+
+namespace JSC {
+
+size_t MarkStack::s_pageSize = 0;
+
+void MarkStack::reset()
+{
+    ASSERT(s_pageSize);
+    m_values.shrinkAllocation(s_pageSize);
+    m_markSets.shrinkAllocation(s_pageSize);
+    m_opaqueRoots.clear();
+}
+
+void MarkStack::append(ConservativeRoots& conservativeRoots)
+{
+    JSCell** roots = conservativeRoots.roots();
+    size_t size = conservativeRoots.size();
+    for (size_t i = 0; i < size; ++i)
+        internalAppend(roots[i]);
+}
+
+inline void MarkStack::markChildren(JSCell* cell)
+{
+    ASSERT(Heap::isMarked(cell));
+    if (cell->structure()->typeInfo().type() < CompoundType) {
+        cell->JSCell::markChildren(*this);
+        return;
+    }
+
+    if (!cell->structure()->typeInfo().overridesMarkChildren()) {
+        ASSERT(cell->isObject());
+#ifdef NDEBUG
+        asObject(cell)->markChildrenDirect(*this);
+#else
+        ASSERT(!m_isCheckingForDefaultMarkViolation);
+        m_isCheckingForDefaultMarkViolation = true;
+        cell->markChildren(*this);
+        ASSERT(m_isCheckingForDefaultMarkViolation);
+        m_isCheckingForDefaultMarkViolation = false;
+#endif
+        return;
+    }
+    if (cell->vptr() == m_jsArrayVPtr) {
+        asArray(cell)->markChildrenDirect(*this);
+        return;
+    }
+    cell->markChildren(*this);
+}
+
+void MarkStack::drain()
+{
+#if !ASSERT_DISABLED
+    ASSERT(!m_isDraining);
+    m_isDraining = true;
+#endif
+    while (!m_markSets.isEmpty() || !m_values.isEmpty()) {
+        while (!m_markSets.isEmpty() && m_values.size() < 50) {
+            ASSERT(!m_markSets.isEmpty());
+            MarkSet& current = m_markSets.last();
+            ASSERT(current.m_values);
+            JSValue* end = current.m_end;
+            ASSERT(current.m_values);
+            ASSERT(current.m_values != end);
+        findNextUnmarkedNullValue:
+            ASSERT(current.m_values != end);
+            JSValue value = *current.m_values;
+            current.m_values++;
+
+            JSCell* cell;
+            if (!value || !value.isCell() || Heap::testAndSetMarked(cell = value.asCell())) {
+                if (current.m_values == end) {
+                    m_markSets.removeLast();
+                    continue;
+                }
+                goto findNextUnmarkedNullValue;
+            }
+
+            if (cell->structure()->typeInfo().type() < CompoundType) {
+                cell->JSCell::markChildren(*this);
+                if (current.m_values == end) {
+                    m_markSets.removeLast();
+                    continue;
+                }
+                goto findNextUnmarkedNullValue;
+            }
+
+            if (current.m_values == end)
+                m_markSets.removeLast();
+
+            markChildren(cell);
+        }
+        while (!m_values.isEmpty())
+            markChildren(m_values.removeLast());
+    }
+#if !ASSERT_DISABLED
+    m_isDraining = false;
+#endif
+}
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/MarkStack.h b/Source/JavaScriptCore/heap/MarkStack.h
index 0b7941e..aba7647 100644
--- a/Source/JavaScriptCore/runtime/MarkStack.h
+++ b/Source/JavaScriptCore/heap/MarkStack.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,13 +27,16 @@
 #define MarkStack_h
 
 #include "JSValue.h"
+#include "Register.h"
 #include "WriteBarrier.h"
+#include <wtf/HashSet.h>
 #include <wtf/Vector.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OSAllocator.h>
 
 namespace JSC {
 
+    class ConservativeRoots;
     class JSGlobalData;
     class Register;
     
@@ -50,37 +53,38 @@ namespace JSC {
 #endif
         {
         }
-        
-        void deprecatedAppend(JSValue*);
-        void deprecatedAppend(JSCell**);
-        void deprecatedAppend(Register*);
-        template <typename T> void append(WriteBarrierBase<T>*);
-        template <typename T> void append(DeprecatedPtr<T>*);
-        
-        ALWAYS_INLINE void deprecatedAppendValues(Register* registers, size_t count, MarkSetProperties properties = NoNullValues)
+
+        ~MarkStack()
         {
-            JSValue* values = reinterpret_cast<JSValue*>(registers);
-            if (count)
-                m_markSets.append(MarkSet(values, values + count, properties));
+            ASSERT(m_markSets.isEmpty());
+            ASSERT(m_values.isEmpty());
         }
 
+        void deprecatedAppend(JSCell**);
+        template <typename T> void append(WriteBarrierBase<T>*);
+
         void appendValues(WriteBarrierBase<Unknown>* barriers, size_t count, MarkSetProperties properties = NoNullValues)
         {
             JSValue* values = barriers->slot();
             if (count)
                 m_markSets.append(MarkSet(values, values + count, properties));
         }
+        
+        void append(ConservativeRoots&);
 
-        inline void drain();
-        void compact();
+        bool addOpaqueRoot(void* root) { return m_opaqueRoots.add(root).second; }
+        bool containsOpaqueRoot(void* root) { return m_opaqueRoots.contains(root); }
+        int opaqueRootCount() { return m_opaqueRoots.size(); }
 
-        ~MarkStack()
-        {
-            ASSERT(m_markSets.isEmpty());
-            ASSERT(m_values.isEmpty());
-        }
+        void drain();
+        void reset();
 
     private:
+        friend class HeapRootMarker; // Allowed to mark a JSValue* or JSCell** directly.
+        void append(JSValue*);
+        void append(JSValue*, size_t count);
+        void append(JSCell**);
+
         void internalAppend(JSCell*);
         void internalAppend(JSValue);
         void markChildren(JSCell*);
@@ -189,6 +193,7 @@ namespace JSC {
         MarkStackArray<MarkSet> m_markSets;
         MarkStackArray<JSCell*> m_values;
         static size_t s_pageSize;
+        HashSet<void*> m_opaqueRoots; // Handle-owning data structures not visible to the garbage collector.
 
 #if !ASSERT_DISABLED
     public:
@@ -196,7 +201,95 @@ namespace JSC {
         bool m_isDraining;
 #endif
     };
+
+    inline void MarkStack::append(JSValue* slot, size_t count)
+    {
+        if (!count)
+            return;
+        m_markSets.append(MarkSet(slot, slot + count, NoNullValues));
+    }
     
-}
+    template <typename T> inline void MarkStack::append(WriteBarrierBase<T>* slot)
+    {
+        internalAppend(*slot->slot());
+    }
+
+    ALWAYS_INLINE void MarkStack::deprecatedAppend(JSCell** value)
+    {
+        ASSERT(value);
+        internalAppend(*value);
+    }
+
+    ALWAYS_INLINE void MarkStack::append(JSValue* value)
+    {
+        ASSERT(value);
+        internalAppend(*value);
+    }
+
+    ALWAYS_INLINE void MarkStack::append(JSCell** value)
+    {
+        ASSERT(value);
+        internalAppend(*value);
+    }
+
+    ALWAYS_INLINE void MarkStack::internalAppend(JSValue value)
+    {
+        ASSERT(value);
+        if (value.isCell())
+            internalAppend(value.asCell());
+    }
+
+    // Privileged class for marking JSValues directly. It is only safe to use
+    // this class to mark direct heap roots that are marked during every GC pass.
+    // All other references should be wrapped in WriteBarriers and marked through
+    // the MarkStack.
+    class HeapRootMarker {
+    private:
+        friend class Heap;
+        HeapRootMarker(MarkStack&);
+        
+    public:
+        void mark(JSValue*);
+        void mark(JSValue*, size_t);
+        void mark(JSString**);
+        void mark(JSCell**);
+        
+        MarkStack& markStack();
+
+    private:
+        MarkStack& m_markStack;
+    };
+
+    inline HeapRootMarker::HeapRootMarker(MarkStack& markStack)
+        : m_markStack(markStack)
+    {
+    }
+
+    inline void HeapRootMarker::mark(JSValue* slot)
+    {
+        m_markStack.append(slot);
+    }
+
+    inline void HeapRootMarker::mark(JSValue* slot, size_t count)
+    {
+        m_markStack.append(slot, count);
+    }
+
+    inline void HeapRootMarker::mark(JSString** slot)
+    {
+        m_markStack.append(reinterpret_cast<JSCell**>(slot));
+    }
+
+    inline void HeapRootMarker::mark(JSCell** slot)
+    {
+        m_markStack.append(slot);
+    }
+
+    inline MarkStack& HeapRootMarker::markStack()
+    {
+        return m_markStack;
+    }
+
+} // namespace JSC
 
 #endif
diff --git a/Source/JavaScriptCore/runtime/MarkStackPosix.cpp b/Source/JavaScriptCore/heap/MarkStackPosix.cpp
index 2a5b298..2a5b298 100644
--- a/Source/JavaScriptCore/runtime/MarkStackPosix.cpp
+++ b/Source/JavaScriptCore/heap/MarkStackPosix.cpp
diff --git a/Source/JavaScriptCore/runtime/MarkStackSymbian.cpp b/Source/JavaScriptCore/heap/MarkStackSymbian.cpp
index a3893d7..a3893d7 100644
--- a/Source/JavaScriptCore/runtime/MarkStackSymbian.cpp
+++ b/Source/JavaScriptCore/heap/MarkStackSymbian.cpp
diff --git a/Source/JavaScriptCore/runtime/MarkStackWin.cpp b/Source/JavaScriptCore/heap/MarkStackWin.cpp
index 2d2a1b3..2d2a1b3 100644
--- a/Source/JavaScriptCore/runtime/MarkStackWin.cpp
+++ b/Source/JavaScriptCore/heap/MarkStackWin.cpp
diff --git a/Source/JavaScriptCore/runtime/MarkedBlock.cpp b/Source/JavaScriptCore/heap/MarkedBlock.cpp
index 16053f2..a10a778 100644
--- a/Source/JavaScriptCore/runtime/MarkedBlock.cpp
+++ b/Source/JavaScriptCore/heap/MarkedBlock.cpp
@@ -27,56 +27,61 @@
 #include "MarkedBlock.h"
 
 #include "JSCell.h"
+#include "JSObject.h"
+#include "JSZombie.h"
+#include "ScopeChain.h"
 
 namespace JSC {
 
-MarkedBlock* MarkedBlock::create(JSGlobalData* globalData)
+MarkedBlock* MarkedBlock::create(JSGlobalData* globalData, size_t cellSize)
 {
-    PageAllocationAligned allocation = PageAllocationAligned::allocate(BLOCK_SIZE, BLOCK_SIZE, OSAllocator::JSGCHeapPages);
+    PageAllocationAligned allocation = PageAllocationAligned::allocate(blockSize, blockSize, OSAllocator::JSGCHeapPages);
     if (!static_cast<bool>(allocation))
         CRASH();
-    return new (allocation.base()) MarkedBlock(allocation, globalData);
+    return new (allocation.base()) MarkedBlock(allocation, globalData, cellSize);
 }
 
 void MarkedBlock::destroy(MarkedBlock* block)
 {
-    for (size_t i = 0; i < CELLS_PER_BLOCK; ++i)
-        reinterpret_cast<JSCell*>(&block->cells[i])->~JSCell();
+    for (size_t i = block->firstAtom(); i < block->m_endAtom; i += block->m_atomsPerCell)
+        reinterpret_cast<JSCell*>(&block->atoms()[i])->~JSCell();
     block->m_allocation.deallocate();
 }
 
-MarkedBlock::MarkedBlock(const PageAllocationAligned& allocation, JSGlobalData* globalData)
-    : m_allocation(allocation)
+MarkedBlock::MarkedBlock(const PageAllocationAligned& allocation, JSGlobalData* globalData, size_t cellSize)
+    : m_nextAtom(firstAtom())
+    , m_allocation(allocation)
     , m_heap(&globalData->heap)
+    , m_prev(0)
+    , m_next(0)
 {
-    marked.set(CELLS_PER_BLOCK - 1);
+    m_atomsPerCell = (cellSize + atomSize - 1) / atomSize;
+    m_endAtom = atomsPerBlock - m_atomsPerCell + 1;
 
     Structure* dummyMarkableCellStructure = globalData->dummyMarkableCellStructure.get();
-    for (size_t i = 0; i < CELLS_PER_BLOCK; ++i)
-        new (&cells[i]) JSCell(dummyMarkableCellStructure);
+    for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell)
+        new (&atoms()[i]) JSCell(*globalData, dummyMarkableCellStructure);
 }
 
 void MarkedBlock::sweep()
 {
-#if !ENABLE(JSC_ZOMBIES)
     Structure* dummyMarkableCellStructure = m_heap->globalData()->dummyMarkableCellStructure.get();
-#endif
 
-    for (size_t i = 0; i < CELLS_PER_BLOCK; ++i) {
-        if (marked.get(i))
+    for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell) {
+        if (m_marks.get(i))
             continue;
 
-        JSCell* cell = reinterpret_cast<JSCell*>(&cells[i]);
+        JSCell* cell = reinterpret_cast<JSCell*>(&atoms()[i]);
 #if ENABLE(JSC_ZOMBIES)
-        if (!cell->isZombie()) {
+        if (cell->structure() && cell->structure() != dummyMarkableCellStructure && !cell->isZombie()) {
             const ClassInfo* info = cell->classInfo();
             cell->~JSCell();
-            new (cell) JSZombie(info, JSZombie::leakedZombieStructure());
-            marked.set(i);
+            new (cell) JSZombie(*m_heap->globalData(), info, m_heap->globalData()->zombieStructure.get());
+            m_marks.set(i);
         }
 #else
         cell->~JSCell();
-        new (cell) JSCell(dummyMarkableCellStructure);
+        new (cell) JSCell(*m_heap->globalData(), dummyMarkableCellStructure);
 #endif
     }
 }
diff --git a/Source/JavaScriptCore/heap/MarkedBlock.h b/Source/JavaScriptCore/heap/MarkedBlock.h
new file mode 100644
index 0000000..0e2b59c
--- /dev/null
+++ b/Source/JavaScriptCore/heap/MarkedBlock.h
@@ -0,0 +1,224 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifndef MarkedBlock_h
+#define MarkedBlock_h
+
+#include <wtf/Bitmap.h>
+#include <wtf/PageAllocationAligned.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+    class Heap;
+    class JSCell;
+    class JSGlobalData;
+
+    typedef uintptr_t Bits;
+
+    static const size_t KB = 1024;
+
+    class MarkedBlock {
+    public:
+        static const size_t atomSize = sizeof(double); // Ensures natural alignment for all built-in types.
+
+        static MarkedBlock* create(JSGlobalData*, size_t cellSize);
+        static void destroy(MarkedBlock*);
+
+        static bool isAtomAligned(const void*);
+        static MarkedBlock* blockFor(const void*);
+        static size_t firstAtom();
+        
+        Heap* heap() const;
+
+        void setPrev(MarkedBlock*);
+        void setNext(MarkedBlock*);
+        MarkedBlock* prev() const;
+        MarkedBlock* next() const;
+        
+        void* allocate();
+        void reset();
+        void sweep();
+        
+        bool isEmpty();
+
+        void clearMarks();
+        size_t markCount();
+
+        size_t cellSize();
+
+        size_t size();
+        size_t capacity();
+
+        bool contains(const void*);
+        size_t atomNumber(const void*);
+        bool isMarked(const void*);
+        bool testAndSetMarked(const void*);
+        void setMarked(const void*);
+        
+        template <typename Functor> void forEach(Functor&);
+
+    private:
+        static const size_t blockSize = 16 * KB;
+        static const size_t blockMask = ~(blockSize - 1); // blockSize must be a power of two.
+
+        static const size_t atomMask = ~(atomSize - 1); // atomSize must be a power of two.
+        
+        static const size_t atomsPerBlock = blockSize / atomSize;
+
+        typedef char Atom[atomSize];
+
+        MarkedBlock(const PageAllocationAligned&, JSGlobalData*, size_t cellSize);
+        Atom* atoms();
+
+        size_t m_nextAtom;
+        size_t m_endAtom; // This is a fuzzy end. Always test for < m_endAtom.
+        size_t m_atomsPerCell;
+        WTF::Bitmap<blockSize / atomSize> m_marks;
+        PageAllocationAligned m_allocation;
+        Heap* m_heap;
+        MarkedBlock* m_prev;
+        MarkedBlock* m_next;
+    };
+
+    inline size_t MarkedBlock::firstAtom()
+    {
+        return WTF::roundUpToMultipleOf<atomSize>(sizeof(MarkedBlock)) / atomSize;
+    }
+
+    inline MarkedBlock::Atom* MarkedBlock::atoms()
+    {
+        return reinterpret_cast<Atom*>(this);
+    }
+
+    inline bool MarkedBlock::isAtomAligned(const void* p)
+    {
+        return !((intptr_t)(p) & ~atomMask);
+    }
+
+    inline MarkedBlock* MarkedBlock::blockFor(const void* p)
+    {
+        return reinterpret_cast<MarkedBlock*>(reinterpret_cast<uintptr_t>(p) & blockMask);
+    }
+
+    inline Heap* MarkedBlock::heap() const
+    {
+        return m_heap;
+    }
+
+    inline void MarkedBlock::setPrev(MarkedBlock* prev)
+    {
+        m_prev = prev;
+    }
+
+    inline void MarkedBlock::setNext(MarkedBlock* next)
+    {
+        m_next = next;
+    }
+
+    inline MarkedBlock* MarkedBlock::prev() const
+    {
+        return m_prev;
+    }
+
+    inline MarkedBlock* MarkedBlock::next() const
+    {
+        return m_next;
+    }
+
+    inline void MarkedBlock::reset()
+    {
+        m_nextAtom = firstAtom();
+    }
+
+    inline bool MarkedBlock::isEmpty()
+    {
+        return m_marks.isEmpty();
+    }
+
+    inline void MarkedBlock::clearMarks()
+    {
+        m_marks.clearAll();
+    }
+    
+    inline size_t MarkedBlock::markCount()
+    {
+        return m_marks.count();
+    }
+
+    inline size_t MarkedBlock::cellSize()
+    {
+        return m_atomsPerCell * atomSize;
+    }
+
+    inline size_t MarkedBlock::size()
+    {
+        return markCount() * cellSize();
+    }
+
+    inline size_t MarkedBlock::capacity()
+    {
+        return m_allocation.size();
+    }
+
+    inline bool MarkedBlock::contains(const void* p)
+    {
+        // Since we mark the first atom of every cell when allocating and/or
+        // marking, any pointer to a marked atom points to the head of a valid,
+        // live cell. Checking the mark bit guards against reviving an object
+        // in a zombie state.
+
+        ASSERT(p && isAtomAligned(p));
+        return isMarked(p);
+    }
+
+    inline size_t MarkedBlock::atomNumber(const void* p)
+    {
+        return (reinterpret_cast<uintptr_t>(p) - reinterpret_cast<uintptr_t>(this)) / atomSize;
+    }
+
+    inline bool MarkedBlock::isMarked(const void* p)
+    {
+        return m_marks.get(atomNumber(p));
+    }
+
+    inline bool MarkedBlock::testAndSetMarked(const void* p)
+    {
+        return m_marks.testAndSet(atomNumber(p));
+    }
+
+    inline void MarkedBlock::setMarked(const void* p)
+    {
+        m_marks.set(atomNumber(p));
+    }
+
+    template <typename Functor> inline void MarkedBlock::forEach(Functor& functor)
+    {
+        for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell) {
+            if (!m_marks.get(i))
+                continue;
+            functor(reinterpret_cast<JSCell*>(&atoms()[i]));
+        }
+    }
+
+} // namespace JSC
+
+#endif // MarkedSpace_h
diff --git a/Source/JavaScriptCore/heap/MarkedSpace.cpp b/Source/JavaScriptCore/heap/MarkedSpace.cpp
new file mode 100644
index 0000000..d9a1e42
--- /dev/null
+++ b/Source/JavaScriptCore/heap/MarkedSpace.cpp
@@ -0,0 +1,166 @@
+/*
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "MarkedSpace.h"
+
+#include "JSCell.h"
+#include "JSGlobalData.h"
+#include "JSLock.h"
+#include "JSObject.h"
+#include "ScopeChain.h"
+
+namespace JSC {
+
+class Structure;
+
+MarkedSpace::MarkedSpace(JSGlobalData* globalData)
+    : m_waterMark(0)
+    , m_highWaterMark(0)
+    , m_globalData(globalData)
+{
+    for (size_t cellSize = preciseStep; cellSize < preciseCutoff; cellSize += preciseStep)
+        sizeClassFor(cellSize).cellSize = cellSize;
+
+    for (size_t cellSize = impreciseStep; cellSize < impreciseCutoff; cellSize += impreciseStep)
+        sizeClassFor(cellSize).cellSize = cellSize;
+}
+
+void MarkedSpace::destroy()
+{
+    clearMarks();
+    shrink();
+    ASSERT(!size());
+}
+
+MarkedBlock* MarkedSpace::allocateBlock(SizeClass& sizeClass)
+{
+    MarkedBlock* block = MarkedBlock::create(globalData(), sizeClass.cellSize);
+    sizeClass.blockList.append(block);
+    sizeClass.nextBlock = block;
+    m_blocks.add(block);
+
+    return block;
+}
+
+void MarkedSpace::freeBlocks(DoublyLinkedList<MarkedBlock>& blocks)
+{
+    MarkedBlock* next;
+    for (MarkedBlock* block = blocks.head(); block; block = next) {
+        next = block->next();
+
+        blocks.remove(block);
+        m_blocks.remove(block);
+        MarkedBlock::destroy(block);
+    }
+}
+
+void* MarkedSpace::allocateFromSizeClass(SizeClass& sizeClass)
+{
+    for (MarkedBlock*& block = sizeClass.nextBlock ; block; block = block->next()) {
+        if (void* result = block->allocate())
+            return result;
+
+        m_waterMark += block->capacity();
+    }
+
+    if (m_waterMark < m_highWaterMark)
+        return allocateBlock(sizeClass)->allocate();
+
+    return 0;
+}
+
+void MarkedSpace::shrink()
+{
+    // We record a temporary list of empties to avoid modifying m_blocks while iterating it.
+    DoublyLinkedList<MarkedBlock> empties;
+
+    BlockIterator end = m_blocks.end();
+    for (BlockIterator it = m_blocks.begin(); it != end; ++it) {
+        MarkedBlock* block = *it;
+        if (block->isEmpty()) {
+            SizeClass& sizeClass = sizeClassFor(block->cellSize());
+            sizeClass.blockList.remove(block);
+            sizeClass.nextBlock = sizeClass.blockList.head();
+            empties.append(block);
+        }
+    }
+    
+    freeBlocks(empties);
+    ASSERT(empties.isEmpty());
+}
+
+void MarkedSpace::clearMarks()
+{
+    BlockIterator end = m_blocks.end();
+    for (BlockIterator it = m_blocks.begin(); it != end; ++it)
+        (*it)->clearMarks();
+}
+
+void MarkedSpace::sweep()
+{
+    BlockIterator end = m_blocks.end();
+    for (BlockIterator it = m_blocks.begin(); it != end; ++it)
+        (*it)->sweep();
+}
+
+size_t MarkedSpace::objectCount() const
+{
+    size_t result = 0;
+    BlockIterator end = m_blocks.end();
+    for (BlockIterator it = m_blocks.begin(); it != end; ++it)
+        result += (*it)->markCount();
+    return result;
+}
+
+size_t MarkedSpace::size() const
+{
+    size_t result = 0;
+    BlockIterator end = m_blocks.end();
+    for (BlockIterator it = m_blocks.begin(); it != end; ++it)
+        result += (*it)->size();
+    return result;
+}
+
+size_t MarkedSpace::capacity() const
+{
+    size_t result = 0;
+    BlockIterator end = m_blocks.end();
+    for (BlockIterator it = m_blocks.begin(); it != end; ++it)
+        result += (*it)->capacity();
+    return result;
+}
+
+void MarkedSpace::reset()
+{
+    m_waterMark = 0;
+
+    for (size_t cellSize = preciseStep; cellSize < preciseCutoff; cellSize += preciseStep)
+        sizeClassFor(cellSize).reset();
+
+    for (size_t cellSize = impreciseStep; cellSize < impreciseCutoff; cellSize += impreciseStep)
+        sizeClassFor(cellSize).reset();
+
+    BlockIterator end = m_blocks.end();
+    for (BlockIterator it = m_blocks.begin(); it != end; ++it)
+        (*it)->reset();
+}
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/MarkedSpace.h b/Source/JavaScriptCore/heap/MarkedSpace.h
index fcb93b7..29a8cd0 100644
--- a/Source/JavaScriptCore/runtime/MarkedSpace.h
+++ b/Source/JavaScriptCore/heap/MarkedSpace.h
@@ -26,11 +26,14 @@
 #include "MarkedBlock.h"
 #include "PageAllocationAligned.h"
 #include <wtf/Bitmap.h>
+#include <wtf/DoublyLinkedList.h>
 #include <wtf/FixedArray.h>
-#include <wtf/HashCountedSet.h>
+#include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/Vector.h>
 
+#define ASSERT_CLASS_FITS_IN_CELL(class) COMPILE_ASSERT(sizeof(class) < MarkedSpace::maxCellSize, class_fits_in_cell)
+
 namespace JSC {
 
     class Heap;
@@ -40,26 +43,12 @@ namespace JSC {
     class MarkStack;
     class WeakGCHandle;
 
-    struct CollectorHeap {
-        CollectorHeap()
-            : nextBlock(0)
-            , nextCell(0)
-        {
-        }
-        
-        MarkedBlock* collectorBlock(size_t index) const
-        {
-            return blocks[index];
-        }
-
-        size_t nextBlock;
-        size_t nextCell;
-        Vector<MarkedBlock*> blocks;
-    };
-
     class MarkedSpace {
         WTF_MAKE_NONCOPYABLE(MarkedSpace);
     public:
+        // Currently public for use in assertions.
+        static const size_t maxCellSize = 1024;
+
         static Heap* heap(JSCell*);
 
         static bool isMarked(const JSCell*);
@@ -91,12 +80,38 @@ namespace JSC {
         template<typename Functor> void forEach(Functor&);
 
     private:
-        NEVER_INLINE MarkedBlock* allocateBlock();
-        NEVER_INLINE void freeBlock(size_t);
+        // [ 8, 16... 128 )
+        static const size_t preciseStep = MarkedBlock::atomSize;
+        static const size_t preciseCutoff = 128;
+        static const size_t preciseCount = preciseCutoff / preciseStep - 1;
+
+        // [ 128, 256... 1024 )
+        static const size_t impreciseStep = preciseCutoff;
+        static const size_t impreciseCutoff = maxCellSize;
+        static const size_t impreciseCount = impreciseCutoff / impreciseStep - 1;
+
+        typedef HashSet<MarkedBlock*>::iterator BlockIterator;
+
+        struct SizeClass {
+            SizeClass();
+            void reset();
+
+            MarkedBlock* nextBlock;
+            DoublyLinkedList<MarkedBlock> blockList;
+            size_t cellSize;
+        };
+
+        MarkedBlock* allocateBlock(SizeClass&);
+        void freeBlocks(DoublyLinkedList<MarkedBlock>&);
+
+        SizeClass& sizeClassFor(size_t);
+        void* allocateFromSizeClass(SizeClass&);
 
         void clearMarks(MarkedBlock*);
 
-        CollectorHeap m_heap;
+        SizeClass m_preciseSizeClasses[preciseCount];
+        SizeClass m_impreciseSizeClasses[impreciseCount];
+        HashSet<MarkedBlock*> m_blocks;
         size_t m_waterMark;
         size_t m_highWaterMark;
         JSGlobalData* m_globalData;
@@ -124,31 +139,32 @@ namespace JSC {
 
     inline bool MarkedSpace::contains(const void* x)
     {
-        if (!MarkedBlock::isCellAligned(x))
+        if (!MarkedBlock::isAtomAligned(x))
             return false;
 
         MarkedBlock* block = MarkedBlock::blockFor(x);
-        if (!block)
+        if (!block || !m_blocks.contains(block))
             return false;
 
-        size_t size = m_heap.blocks.size();
-        for (size_t i = 0; i < size; i++) {
-            if (block != m_heap.collectorBlock(i))
-                continue;
-
-            // x is a pointer into the heap. Now, verify that the cell it
-            // points to is live. (If the cell is dead, we must not mark it,
-            // since that would revive it in a zombie state.)
-            return block->isMarked(x);
-        }
-        
-        return false;
+        return block->contains(x);
     }
 
     template <typename Functor> inline void MarkedSpace::forEach(Functor& functor)
     {
-        for (size_t i = 0; i < m_heap.blocks.size(); ++i)
-            m_heap.collectorBlock(i)->forEach(functor);
+        BlockIterator end = m_blocks.end();
+        for (BlockIterator it = m_blocks.begin(); it != end; ++it)
+            (*it)->forEach(functor);
+    }
+    
+    inline MarkedSpace::SizeClass::SizeClass()
+        : nextBlock(0)
+        , cellSize(0)
+    {
+    }
+
+    inline void MarkedSpace::SizeClass::reset()
+    {
+        nextBlock = blockList.head();
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/Strong.h b/Source/JavaScriptCore/heap/Strong.h
new file mode 100644
index 0000000..9f2aa05
--- /dev/null
+++ b/Source/JavaScriptCore/heap/Strong.h
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Strong_h
+#define Strong_h
+
+#include "Assertions.h"
+#include "Handle.h"
+#include "HandleHeap.h"
+
+namespace JSC {
+
+class JSGlobalData;
+HandleSlot allocateGlobalHandle(JSGlobalData&);
+
+// A strongly referenced handle that prevents the object it points to from being garbage collected.
+template <typename T> class Strong : public Handle<T> {
+    using Handle<T>::slot;
+    using Handle<T>::setSlot;
+
+public:
+    typedef typename Handle<T>::ExternalType ExternalType;
+    
+    Strong()
+        : Handle<T>()
+    {
+    }
+    
+    Strong(JSGlobalData& globalData, ExternalType value = ExternalType())
+        : Handle<T>(allocateGlobalHandle(globalData))
+    {
+        set(value);
+    }
+
+    Strong(JSGlobalData& globalData, Handle<T> handle)
+        : Handle<T>(allocateGlobalHandle(globalData))
+    {
+        set(handle.get());
+    }
+    
+    Strong(const Strong& other)
+        : Handle<T>()
+    {
+        if (!other.slot())
+            return;
+        setSlot(HandleHeap::heapFor(other.slot())->allocate());
+        set(other.get());
+    }
+
+    template <typename U> Strong(const Strong<U>& other)
+        : Handle<T>()
+    {
+        if (!other.slot())
+            return;
+        setSlot(HandleHeap::heapFor(other.slot())->allocate());
+        set(other.get());
+    }
+    
+    enum HashTableDeletedValueTag { HashTableDeletedValue };
+    bool isHashTableDeletedValue() const { return slot() == hashTableDeletedValue(); }
+    Strong(HashTableDeletedValueTag)
+        : Handle<T>(hashTableDeletedValue())
+    {
+    }
+
+    ~Strong()
+    {
+        clear();
+    }
+
+    void swap(Strong& other)
+    {
+        Handle<T>::swap(other);
+    }
+
+    void set(JSGlobalData& globalData, ExternalType value)
+    {
+        if (!slot())
+            setSlot(allocateGlobalHandle(globalData));
+        set(value);
+    }
+
+    template <typename U> Strong& operator=(const Strong<U>& other)
+    {
+        if (!other.slot()) {
+            clear();
+            return *this;
+        }
+
+        set(*HandleHeap::heapFor(other.slot())->globalData(), other.get());
+        return *this;
+    }
+    
+    Strong& operator=(const Strong& other)
+    {
+        if (!other.slot()) {
+            clear();
+            return *this;
+        }
+
+        set(*HandleHeap::heapFor(other.slot())->globalData(), other.get());
+        return *this;
+    }
+
+    void clear()
+    {
+        if (!slot())
+            return;
+        HandleHeap::heapFor(slot())->deallocate(slot());
+        setSlot(0);
+    }
+
+private:
+    static HandleSlot hashTableDeletedValue() { return reinterpret_cast<HandleSlot>(-1); }
+
+    void set(ExternalType externalType)
+    {
+        ASSERT(slot());
+        JSValue value = HandleTypes<T>::toJSValue(externalType);
+        HandleHeap::heapFor(slot())->writeBarrier(slot(), value);
+        *slot() = value;
+    }
+};
+
+template<class T> inline void swap(Strong<T>& a, Strong<T>& b)
+{
+    a.swap(b);
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct VectorTraits<JSC::Strong<T> > : SimpleClassVectorTraits {
+    static const bool canCompareWithMemcmp = false;
+};
+
+template<typename P> struct HashTraits<JSC::Strong<P> > : SimpleClassHashTraits<JSC::Strong<P> > { };
+
+}
+
+#endif // Strong_h
diff --git a/Source/JavaScriptCore/heap/Weak.h b/Source/JavaScriptCore/heap/Weak.h
new file mode 100644
index 0000000..62e2596
--- /dev/null
+++ b/Source/JavaScriptCore/heap/Weak.h
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Weak_h
+#define Weak_h
+
+#include "Assertions.h"
+#include "Handle.h"
+#include "HandleHeap.h"
+#include "JSGlobalData.h"
+
+namespace JSC {
+
+// A weakly referenced handle that becomes 0 when the value it points to is garbage collected.
+template <typename T> class Weak : public Handle<T> {
+    using Handle<T>::slot;
+    using Handle<T>::setSlot;
+
+public:
+    typedef typename Handle<T>::ExternalType ExternalType;
+
+    Weak()
+        : Handle<T>()
+    {
+    }
+
+    Weak(JSGlobalData& globalData, ExternalType value = ExternalType(), WeakHandleOwner* weakOwner = 0, void* context = 0)
+        : Handle<T>(globalData.allocateGlobalHandle())
+    {
+        HandleHeap::heapFor(slot())->makeWeak(slot(), weakOwner, context);
+        set(value);
+    }
+
+    Weak(const Weak& other)
+        : Handle<T>()
+    {
+        if (!other.slot())
+            return;
+        setSlot(HandleHeap::heapFor(other.slot())->copyWeak(other.slot()));
+    }
+
+    template <typename U> Weak(const Weak<U>& other)
+        : Handle<T>()
+    {
+        if (!other.slot())
+            return;
+        setSlot(HandleHeap::heapFor(other.slot())->copyWeak(other.slot()));
+    }
+    
+    enum HashTableDeletedValueTag { HashTableDeletedValue };
+    bool isHashTableDeletedValue() const { return slot() == hashTableDeletedValue(); }
+    Weak(HashTableDeletedValueTag)
+        : Handle<T>(hashTableDeletedValue())
+    {
+    }
+
+    ~Weak()
+    {
+        clear();
+    }
+
+    void swap(Weak& other)
+    {
+        Handle<T>::swap(other);
+    }
+
+    ExternalType get() const { return  HandleTypes<T>::getFromSlot(slot()); }
+    
+    void clear()
+    {
+        if (!slot())
+            return;
+        HandleHeap::heapFor(slot())->deallocate(slot());
+        setSlot(0);
+    }
+    
+    void set(JSGlobalData& globalData, ExternalType value, WeakHandleOwner* weakOwner = 0, void* context = 0)
+    {
+        if (!slot()) {
+            setSlot(globalData.allocateGlobalHandle());
+            HandleHeap::heapFor(slot())->makeWeak(slot(), weakOwner, context);
+        }
+        ASSERT(HandleHeap::heapFor(slot())->hasWeakOwner(slot(), weakOwner));
+        set(value);
+    }
+
+    template <typename U> Weak& operator=(const Weak<U>& other)
+    {
+        clear();
+        if (other.slot())
+            setSlot(HandleHeap::heapFor(other.slot())->copyWeak(other.slot()));
+        return *this;
+    }
+
+    Weak& operator=(const Weak& other)
+    {
+        clear();
+        if (other.slot())
+            setSlot(HandleHeap::heapFor(other.slot())->copyWeak(other.slot()));
+        return *this;
+    }
+
+private:
+    static HandleSlot hashTableDeletedValue() { return reinterpret_cast<HandleSlot>(-1); }
+
+    void set(ExternalType externalType)
+    {
+        ASSERT(slot());
+        JSValue value = HandleTypes<T>::toJSValue(externalType);
+        ASSERT(!value || !value.isCell() || Heap::isMarked(value.asCell()));
+        HandleHeap::heapFor(slot())->writeBarrier(slot(), value);
+        *slot() = value;
+    }
+};
+
+template<class T> inline void swap(Weak<T>& a, Weak<T>& b)
+{
+    a.swap(b);
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct VectorTraits<JSC::Weak<T> > : SimpleClassVectorTraits {
+    static const bool canCompareWithMemcmp = false;
+};
+
+template<typename P> struct HashTraits<JSC::Weak<P> > : SimpleClassHashTraits<JSC::Weak<P> > { };
+
+}
+
+#endif // Weak_h
diff --git a/Source/JavaScriptCore/interpreter/CachedCall.h b/Source/JavaScriptCore/interpreter/CachedCall.h
index 740001d..04f2210 100644
--- a/Source/JavaScriptCore/interpreter/CachedCall.h
+++ b/Source/JavaScriptCore/interpreter/CachedCall.h
@@ -38,10 +38,10 @@ namespace JSC {
         CachedCall(CallFrame* callFrame, JSFunction* function, int argCount)
             : m_valid(false)
             , m_interpreter(callFrame->interpreter())
-            , m_globalObjectScope(callFrame, function->scope().globalObject())
+            , m_globalObjectScope(callFrame->globalData(), function->scope()->globalObject.get())
         {
             ASSERT(!function->isHostFunction());
-            m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argCount, function->scope().node());
+            m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argCount, function->scope());
             m_valid = !callFrame->hadException();
         }
         
diff --git a/Source/JavaScriptCore/interpreter/CallFrame.h b/Source/JavaScriptCore/interpreter/CallFrame.h
index 190a7c1..28832e0 100644
--- a/Source/JavaScriptCore/interpreter/CallFrame.h
+++ b/Source/JavaScriptCore/interpreter/CallFrame.h
@@ -26,13 +26,13 @@
 #include "JSGlobalData.h"
 #include "MacroAssemblerCodeRef.h"
 #include "RegisterFile.h"
-#include "ScopeChain.h"
 
 namespace JSC  {
 
     class Arguments;
     class JSActivation;
     class Interpreter;
+    class ScopeChainNode;
 
     // Represents the current state of script execution.
     // Passed as the first argument to most functions.
@@ -51,23 +51,13 @@ namespace JSC  {
 
         // Global object in which the currently executing code was defined.
         // Differs from dynamicGlobalObject() during function calls across web browser frames.
-        JSGlobalObject* lexicalGlobalObject() const
-        {
-            return scopeChain()->globalObject;
-        }
+        inline JSGlobalObject* lexicalGlobalObject() const;
 
         // Differs from lexicalGlobalObject because this will have DOM window shell rather than
         // the actual DOM window, which can't be "this" for security reasons.
-        JSObject* globalThisValue() const
-        {
-            return scopeChain()->globalThis;
-        }
+        inline JSObject* globalThisValue() const;
 
-        JSGlobalData& globalData() const
-        {
-            ASSERT(scopeChain()->globalData);
-            return *scopeChain()->globalData;
-        }
+        inline JSGlobalData& globalData() const;
 
         // Convenience functions for access to global data.
         // It takes a few memory references to get from a call frame to the global data
@@ -75,7 +65,7 @@ namespace JSC  {
         // But they're used in many places in legacy code, so they're not going away any time soon.
 
         void clearException() { globalData().exception = JSValue(); }
-        JSValue exception() const { return globalData().exception.get(); }
+        JSValue exception() const { return globalData().exception; }
         bool hadException() const { return globalData().exception; }
 
         const CommonIdentifiers& propertyNames() const { return *globalData().propertyNames; }
@@ -90,6 +80,7 @@ namespace JSC  {
         static const HashTable* jsonTable(CallFrame* callFrame) { return callFrame->globalData().jsonTable; }
         static const HashTable* mathTable(CallFrame* callFrame) { return callFrame->globalData().mathTable; }
         static const HashTable* numberTable(CallFrame* callFrame) { return callFrame->globalData().numberTable; }
+        static const HashTable* objectConstructorTable(CallFrame* callFrame) { return callFrame->globalData().objectConstructorTable; }
         static const HashTable* regExpTable(CallFrame* callFrame) { return callFrame->globalData().regExpTable; }
         static const HashTable* regExpConstructorTable(CallFrame* callFrame) { return callFrame->globalData().regExpConstructorTable; }
         static const HashTable* stringTable(CallFrame* callFrame) { return callFrame->globalData().stringTable; }
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index c2612ac..4a6ffb6 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -42,7 +42,6 @@
 #include "EvalCodeCache.h"
 #include "ExceptionHelpers.h"
 #include "GetterSetter.h"
-#include "GlobalEvalFunction.h"
 #include "JSActivation.h"
 #include "JSArray.h"
 #include "JSByteArray.h"
@@ -77,11 +76,11 @@ using namespace std;
 namespace JSC {
 
 // Returns the depth of the scope chain within a given call frame.
-static int depth(CodeBlock* codeBlock, ScopeChain& sc)
+static int depth(CodeBlock* codeBlock, ScopeChainNode* sc)
 {
     if (!codeBlock->needsFullScopeChain())
         return 0;
-    return sc.localDepth();
+    return sc->localDepth();
 }
 
 #if ENABLE(INTERPRETER) 
@@ -107,7 +106,7 @@ NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, J
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
             JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception.get();
+            exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
             callFrame->uncheckedR(dst) = JSValue(result);
@@ -146,7 +145,7 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
             JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception.get();
+            exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
             ASSERT(result);
@@ -165,7 +164,7 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     JSGlobalObject* globalObject = codeBlock->globalObject();
     ASSERT(globalObject->isGlobalObject());
     int property = vPC[2].u.operand;
-    Structure* structure = vPC[3].u.structure;
+    Structure* structure = vPC[3].u.structure.get();
     int offset = vPC[4].u.operand;
 
     if (structure == globalObject->structure()) {
@@ -178,16 +177,13 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
         if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
-            if (vPC[3].u.structure)
-                vPC[3].u.structure->deref();
-            globalObject->structure()->ref();
-            vPC[3] = globalObject->structure();
+            vPC[3].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), globalObject->structure());
             vPC[4] = slot.cachedOffset();
             callFrame->uncheckedR(dst) = JSValue(result);
             return true;
         }
 
-        exceptionValue = callFrame->globalData().exception.get();
+        exceptionValue = callFrame->globalData().exception;
         if (exceptionValue)
             return false;
         callFrame->uncheckedR(dst) = JSValue(result);
@@ -205,7 +201,7 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
     JSGlobalObject* globalObject = codeBlock->globalObject();
     ASSERT(globalObject->isGlobalObject());
     int property = vPC[2].u.operand;
-    Structure* structure = vPC[3].u.structure;
+    Structure* structure = vPC[3].u.structure.get();
     int offset = vPC[4].u.operand;
     int skip = vPC[5].u.operand;
     
@@ -227,7 +223,7 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
                 PropertySlot slot(o);
                 if (o->getPropertySlot(callFrame, ident, slot)) {
                     JSValue result = slot.getValue(callFrame, ident);
-                    exceptionValue = callFrame->globalData().exception.get();
+                    exceptionValue = callFrame->globalData().exception;
                     if (exceptionValue)
                         return false;
                     ASSERT(result);
@@ -256,17 +252,14 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
         if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
-            if (vPC[3].u.structure)
-                vPC[3].u.structure->deref();
-            globalObject->structure()->ref();
-            vPC[3] = globalObject->structure();
+            vPC[3].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), globalObject->structure());
             vPC[4] = slot.cachedOffset();
             ASSERT(result);
             callFrame->uncheckedR(dst) = JSValue(result);
             return true;
         }
         
-        exceptionValue = callFrame->globalData().exception.get();
+        exceptionValue = callFrame->globalData().exception;
         if (exceptionValue)
             return false;
         ASSERT(result);
@@ -314,7 +307,7 @@ NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Inst
         PropertySlot slot(base);
         if (base->getPropertySlot(callFrame, ident, slot)) {
             JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception.get();
+            exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
             callFrame->uncheckedR(propDst) = JSValue(result);
@@ -410,18 +403,19 @@ NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* r
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     JSValue exceptionValue;
-    RefPtr<EvalExecutable> eval = codeBlock->evalCodeCache().get(callFrame, codeBlock->isStrictMode(), programSource, scopeChain, exceptionValue);
+    EvalExecutable* eval = codeBlock->evalCodeCache().get(callFrame, codeBlock->ownerExecutable(), codeBlock->isStrictMode(), programSource, scopeChain, exceptionValue);
 
     ASSERT(!eval == exceptionValue);
     if (UNLIKELY(!eval))
         return throwError(callFrame, exceptionValue);
 
-    return callFrame->globalData().interpreter->execute(eval.get(), callFrame, callFrame->uncheckedR(codeBlock->thisRegister()).jsValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain);
+    return callFrame->globalData().interpreter->execute(eval, callFrame, callFrame->uncheckedR(codeBlock->thisRegister()).jsValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain);
 }
 
-Interpreter::Interpreter()
+Interpreter::Interpreter(JSGlobalData& globalData)
     : m_sampleEntryDepth(0)
     , m_reentryDepth(0)
+    , m_registerFile(globalData)
 {
 #if ENABLE(COMPUTED_GOTO_INTERPRETER)
     privateExecute(InitializeAndReturn, 0, 0);
@@ -564,24 +558,21 @@ NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue ex
             oldCodeBlock->createActivation(callFrame);
             scopeChain = callFrame->scopeChain();
         }
-        while (!scopeChain->object->inherits(&JSActivation::info))
+        while (!scopeChain->object->inherits(&JSActivation::s_info))
             scopeChain = scopeChain->pop();
 
         callFrame->setScopeChain(scopeChain);
         JSActivation* activation = asActivation(scopeChain->object.get());
-        activation->copyRegisters();
+        activation->copyRegisters(*scopeChain->globalData);
         if (JSValue arguments = callFrame->uncheckedR(unmodifiedArgumentsRegister(oldCodeBlock->argumentsRegister())).jsValue()) {
             if (!oldCodeBlock->isStrictMode())
                 asArguments(arguments)->setActivation(callFrame->globalData(), activation);
         }
     } else if (oldCodeBlock->usesArguments() && !oldCodeBlock->isStrictMode()) {
         if (JSValue arguments = callFrame->uncheckedR(unmodifiedArgumentsRegister(oldCodeBlock->argumentsRegister())).jsValue())
-            asArguments(arguments)->copyRegisters();
+            asArguments(arguments)->copyRegisters(callFrame->globalData());
     }
 
-    if (oldCodeBlock->needsFullScopeChain())
-        scopeChain->deref();
-
     CallFrame* callerFrame = callFrame->callerFrame();
     if (callerFrame->hasHostCallFrameFlag())
         return false;
@@ -623,7 +614,7 @@ static void appendSourceToError(CallFrame* callFrame, ErrorInstance* exception,
         return;
 
     JSGlobalData* globalData = &callFrame->globalData();
-    JSValue jsMessage = exception->getDirect(globalData->propertyNames->message);
+    JSValue jsMessage = exception->getDirect(*globalData, globalData->propertyNames->message);
     if (!jsMessage || !jsMessage.isString())
         return;
 
@@ -645,7 +636,7 @@ static void appendSourceToError(CallFrame* callFrame, ErrorInstance* exception,
             start++;
         while (stop < dataLength && (stop - expressionStart < 20) && data[stop] != '\n')
             stop++;
-        while (stop > expressionStart && isStrWhiteSpace(data[stop]))
+        while (stop > expressionStart && isStrWhiteSpace(data[stop - 1]))
             stop--;
         message = makeUString(message, " (near '...", codeBlock->source()->getRange(start, stop), "...')");
     }
@@ -710,11 +701,10 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
 
     // Unwind the scope chain within the exception handler's call frame.
     ScopeChainNode* scopeChain = callFrame->scopeChain();
-    ScopeChain sc(scopeChain);
     int scopeDelta = 0;
     if (!codeBlock->needsFullScopeChain() || codeBlock->codeType() != FunctionCode 
         || callFrame->uncheckedR(codeBlock->activationRegister()).jsValue())
-        scopeDelta = depth(codeBlock, sc) - handler->scopeDepth;
+        scopeDelta = depth(codeBlock, scopeChain) - handler->scopeDepth;
     ASSERT(scopeDelta >= 0);
     while (scopeDelta--)
         scopeChain = scopeChain->pop();
@@ -742,6 +732,8 @@ JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, S
     if (m_reentryDepth >= MaxSmallThreadReentryDepth && m_reentryDepth >= callFrame->globalData().maxReentryDepth)
         return checkedReturn(throwStackOverflowError(callFrame));
 
+    DynamicGlobalObjectScope globalObjectScope(*scopeChain->globalData, scopeChain->globalObject.get());
+
     JSObject* error = program->compile(callFrame, scopeChain);
     if (error)
         return checkedReturn(throwError(callFrame, error));
@@ -761,11 +753,6 @@ JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, S
     newCallFrame->init(codeBlock, 0, scopeChain, CallFrame::noCaller(), codeBlock->m_numParameters, 0);
     newCallFrame->uncheckedR(newCallFrame->hostThisRegister()) = JSValue(thisObj);
 
-    if (codeBlock->needsFullScopeChain())
-        scopeChain->ref();
-
-    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
-
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
         (*profiler)->willExecute(callFrame, program->sourceURL(), program->lineNo());
@@ -820,6 +807,8 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
     if (callType == CallTypeJS) {
         ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
 
+        DynamicGlobalObjectScope globalObjectScope(*callDataScopeChain->globalData, callDataScopeChain->globalObject.get());
+
         JSObject* compileError = callData.js.functionExecutable->compileForCall(callFrame, callDataScopeChain);
         if (UNLIKELY(!!compileError)) {
             m_registerFile.shrink(oldEnd);
@@ -835,8 +824,6 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
 
         newCallFrame->init(newCodeBlock, 0, callDataScopeChain, callFrame->addHostCallFrameFlag(), argCount, function);
 
-        DynamicGlobalObjectScope globalObjectScope(newCallFrame, callDataScopeChain->globalObject);
-
         Profiler** profiler = Profiler::enabledProfilerReference();
         if (*profiler)
             (*profiler)->willExecute(callFrame, function);
@@ -867,7 +854,7 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
     newCallFrame = CallFrame::create(newCallFrame->registers() + registerOffset);
     newCallFrame->init(0, 0, scopeChain, callFrame->addHostCallFrameFlag(), argCount, function);
 
-    DynamicGlobalObjectScope globalObjectScope(newCallFrame, scopeChain->globalObject);
+    DynamicGlobalObjectScope globalObjectScope(*scopeChain->globalData, scopeChain->globalObject.get());
 
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
@@ -909,6 +896,8 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
     if (constructType == ConstructTypeJS) {
         ScopeChainNode* constructDataScopeChain = constructData.js.scopeChain;
 
+        DynamicGlobalObjectScope globalObjectScope(*constructDataScopeChain->globalData, constructDataScopeChain->globalObject.get());
+
         JSObject* compileError = constructData.js.functionExecutable->compileForConstruct(callFrame, constructDataScopeChain);
         if (UNLIKELY(!!compileError)) {
             m_registerFile.shrink(oldEnd);
@@ -924,8 +913,6 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
 
         newCallFrame->init(newCodeBlock, 0, constructDataScopeChain, callFrame->addHostCallFrameFlag(), argCount, constructor);
 
-        DynamicGlobalObjectScope globalObjectScope(newCallFrame, constructDataScopeChain->globalObject);
-
         Profiler** profiler = Profiler::enabledProfilerReference();
         if (*profiler)
             (*profiler)->willExecute(callFrame, constructor);
@@ -959,7 +946,7 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
     newCallFrame = CallFrame::create(newCallFrame->registers() + registerOffset);
     newCallFrame->init(0, 0, scopeChain, callFrame->addHostCallFrameFlag(), argCount, constructor);
 
-    DynamicGlobalObjectScope globalObjectScope(newCallFrame, scopeChain->globalObject);
+    DynamicGlobalObjectScope globalObjectScope(*scopeChain->globalData, scopeChain->globalObject.get());
 
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
@@ -1001,9 +988,10 @@ CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* FunctionE
     }
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
+    // We initialise |this| unnecessarily here for the sake of code clarity
     size_t dst = 0;
     for (int i = 0; i < argc; ++i)
-        newCallFrame->uncheckedR(++dst) = jsUndefined();
+        newCallFrame->uncheckedR(dst++) = jsUndefined();
     
     JSObject* error = FunctionExecutable->compileForCall(callFrame, scopeChain);
     if (error) {
@@ -1073,18 +1061,18 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
 {
     ASSERT(!scopeChain->globalData->exception);
 
+    DynamicGlobalObjectScope globalObjectScope(*scopeChain->globalData, scopeChain->globalObject.get());
+
     if (m_reentryDepth >= MaxSmallThreadReentryDepth && m_reentryDepth >= callFrame->globalData().maxReentryDepth)
         return checkedReturn(throwStackOverflowError(callFrame));
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
-
     JSObject* compileError = eval->compile(callFrame, scopeChain);
     if (UNLIKELY(!!compileError))
         return checkedReturn(throwError(callFrame, compileError));
     EvalCodeBlock* codeBlock = &eval->generatedBytecode();
 
     JSObject* variableObject;
-    for (ScopeChainNode* node = scopeChain; ; node = node->next) {
+    for (ScopeChainNode* node = scopeChain; ; node = node->next.get()) {
         ASSERT(node);
         if (node->object->isVariableObject()) {
             variableObject = static_cast<JSVariableObject*>(node->object.get());
@@ -1133,9 +1121,6 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
     newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), codeBlock->m_numParameters, 0);
     newCallFrame->uncheckedR(newCallFrame->hostThisRegister()) = JSValue(thisObj);
 
-    if (codeBlock->needsFullScopeChain())
-        scopeChain->ref();
-
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
         (*profiler)->willExecute(callFrame, eval->sourceURL(), eval->lineNo());
@@ -1235,11 +1220,11 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
     }
 
     // Cache miss: record Structure to compare against next time.
-    Structure* lastStructure = vPC[4].u.structure;
+    Structure* lastStructure = vPC[4].u.structure.get();
     if (structure != lastStructure) {
         // First miss: record Structure to compare against next time.
         if (!lastStructure) {
-            vPC[4] = structure;
+            vPC[4].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), structure);
             return;
         }
 
@@ -1265,24 +1250,23 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
 
         // put_by_id_transition checks the prototype chain for setters.
         normalizePrototypeChain(callFrame, baseCell);
-
+        JSCell* owner = codeBlock->ownerExecutable();
+        JSGlobalData& globalData = callFrame->globalData();
         vPC[0] = getOpcode(op_put_by_id_transition);
-        vPC[4] = structure->previousID();
-        vPC[5] = structure;
-        vPC[6] = structure->prototypeChain(callFrame);
+        vPC[4].u.structure.set(globalData, owner, structure->previousID());
+        vPC[5].u.structure.set(globalData, owner, structure);
+        vPC[6].u.structureChain.set(callFrame->globalData(), codeBlock->ownerExecutable(), structure->prototypeChain(callFrame));
+        ASSERT(vPC[6].u.structureChain);
         vPC[7] = slot.cachedOffset();
-        codeBlock->refStructures(vPC);
         return;
     }
 
     vPC[0] = getOpcode(op_put_by_id_replace);
     vPC[5] = slot.cachedOffset();
-    codeBlock->refStructures(vPC);
 }
 
-NEVER_INLINE void Interpreter::uncachePutByID(CodeBlock* codeBlock, Instruction* vPC)
+NEVER_INLINE void Interpreter::uncachePutByID(CodeBlock*, Instruction* vPC)
 {
-    codeBlock->derefStructures(vPC);
     vPC[0] = getOpcode(op_put_by_id);
     vPC[4] = 0;
 }
@@ -1324,11 +1308,11 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
     }
 
     // Cache miss
-    Structure* lastStructure = vPC[4].u.structure;
+    Structure* lastStructure = vPC[4].u.structure.get();
     if (structure != lastStructure) {
         // First miss: record Structure to compare against next time.
         if (!lastStructure) {
-            vPC[4] = structure;
+            vPC[4].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), structure);
             return;
         }
 
@@ -1354,8 +1338,6 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
             vPC[5] = slot.cachedOffset();
             break;
         }
-
-        codeBlock->refStructures(vPC);
         return;
     }
 
@@ -1374,7 +1356,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         // should not be treated as a dictionary.
         if (baseObject->structure()->isDictionary()) {
             baseObject->flattenDictionaryObject(callFrame->globalData());
-            offset = baseObject->structure()->get(propertyName);
+            offset = baseObject->structure()->get(callFrame->globalData(), propertyName);
         }
 
         ASSERT(!baseObject->structure()->isUncacheableDictionary());
@@ -1393,9 +1375,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
             vPC[6] = offset;
             break;
         }
-        vPC[5] = baseObject->structure();
-
-        codeBlock->refStructures(vPC);
+        vPC[5].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), baseObject->structure());
         return;
     }
 
@@ -1421,15 +1401,13 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         vPC[7] = offset;
         break;
     }
-    vPC[4] = structure;
-    vPC[5] = structure->prototypeChain(callFrame);
+    vPC[4].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), structure);
+    vPC[5].u.structureChain.set(callFrame->globalData(), codeBlock->ownerExecutable(), structure->prototypeChain(callFrame));
     vPC[6] = count;
-    codeBlock->refStructures(vPC);
 }
 
-NEVER_INLINE void Interpreter::uncacheGetByID(CodeBlock* codeBlock, Instruction* vPC)
+NEVER_INLINE void Interpreter::uncacheGetByID(CodeBlock*, Instruction* vPC)
 {
-    codeBlock->derefStructures(vPC);
     vPC[0] = getOpcode(op_get_by_id);
     vPC[4] = 0;
 }
@@ -1477,8 +1455,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
-        if (UNLIKELY(globalData->exception.get() != JSValue())) { \
-            exceptionValue = globalData->exception.get(); \
+        if (UNLIKELY(globalData->exception != JSValue())) { \
+            exceptionValue = globalData->exception; \
             goto vm_throw; \
         } \
     } while (0)
@@ -1559,8 +1537,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register dst.
         */
         int dst = vPC[1].u.operand;
-        int regExp = vPC[2].u.operand;
-        callFrame->uncheckedR(dst) = JSValue(new (globalData) RegExpObject(callFrame->lexicalGlobalObject(), callFrame->scopeChain()->globalObject->regExpStructure(), codeBlock->regexp(regExp)));
+        RegExp* regExp = codeBlock->regexp(vPC[2].u.operand);
+        if (!regExp->isValid()) {
+            exceptionValue = createSyntaxError(callFrame, "Invalid flags supplied to RegExp constructor.");
+            goto vm_throw;
+        }
+        callFrame->uncheckedR(dst) = JSValue(new (globalData) RegExpObject(callFrame->lexicalGlobalObject(), callFrame->scopeChain()->globalObject->regExpStructure(), regExp));
 
         vPC += OPCODE_LENGTH(op_new_regexp);
         NEXT_INSTRUCTION();
@@ -2366,7 +2348,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT(scope->isGlobalObject());
         int index = vPC[2].u.operand;
 
-        callFrame->uncheckedR(dst) = scope->registerAt(index);
+        callFrame->uncheckedR(dst) = scope->registerAt(index).get();
         vPC += OPCODE_LENGTH(op_get_global_var);
         NEXT_INSTRUCTION();
     }
@@ -2380,7 +2362,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int index = vPC[1].u.operand;
         int value = vPC[2].u.operand;
         
-        scope->registerAt(index) = JSValue(callFrame->r(value).jsValue());
+        scope->registerAt(index).set(*globalData, scope, callFrame->r(value).jsValue());
         vPC += OPCODE_LENGTH(op_put_global_var);
         NEXT_INSTRUCTION();
     }
@@ -2411,7 +2393,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         }
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(iter->get());
-        callFrame->uncheckedR(dst) = scope->registerAt(index);
+        callFrame->uncheckedR(dst) = scope->registerAt(index).get();
         ASSERT(callFrame->r(dst).jsValue());
         vPC += OPCODE_LENGTH(op_get_scoped_var);
         NEXT_INSTRUCTION();
@@ -2443,19 +2425,21 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(iter->get());
         ASSERT(callFrame->r(value).jsValue());
-        scope->registerAt(index) = JSValue(callFrame->r(value).jsValue());
+        scope->registerAt(index).set(*globalData, scope, callFrame->r(value).jsValue());
         vPC += OPCODE_LENGTH(op_put_scoped_var);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_base) {
-        /* resolve_base dst(r) property(id)
+        /* resolve_base dst(r) property(id) isStrict(bool)
 
            Searches the scope chain for an object containing
            identifier property, and if one is found, writes it to
-           register dst. If none is found, the outermost scope (which
-           will be the global object) is stored in register dst.
+           register dst. If none is found and isStrict is false, the
+           outermost scope (which will be the global object) is
+           stored in register dst.
         */
         resolveBase(callFrame, vPC);
+        CHECK_FOR_EXCEPTION();
 
         vPC += OPCODE_LENGTH(op_resolve_base);
         NEXT_INSTRUCTION();
@@ -2476,6 +2460,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             exceptionValue = createErrorForInvalidGlobalAssignment(callFrame, ident.ustring());
             goto vm_throw;
         }
+
+        vPC += OPCODE_LENGTH(op_ensure_property_exists);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_with_base) {
@@ -2530,7 +2516,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
 
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(baseCell->isObject());
@@ -2561,12 +2547,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
 
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(structure->prototypeForLookup(callFrame).isObject());
                 JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-                Structure* prototypeStructure = vPC[5].u.structure;
+                Structure* prototypeStructure = vPC[5].u.structure.get();
 
                 if (LIKELY(protoObject->structure() == prototypeStructure)) {
                     int dst = vPC[1].u.operand;
@@ -2600,12 +2586,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
             
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(structure->prototypeForLookup(callFrame).isObject());
                 JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-                Structure* prototypeStructure = vPC[5].u.structure;
+                Structure* prototypeStructure = vPC[5].u.structure.get();
                 
                 if (LIKELY(protoObject->structure() == prototypeStructure)) {
                     int dst = vPC[1].u.operand;
@@ -2645,12 +2631,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
             
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(structure->prototypeForLookup(callFrame).isObject());
                 JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-                Structure* prototypeStructure = vPC[5].u.structure;
+                Structure* prototypeStructure = vPC[5].u.structure.get();
                 
                 if (LIKELY(protoObject->structure() == prototypeStructure)) {
                     int dst = vPC[1].u.operand;
@@ -2714,6 +2700,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
         NEXT_INSTRUCTION();
     }
+#if USE(GCC_COMPUTED_GOTO_WORKAROUND)
+    goto *(&&skip_get_by_id_chain);
+#endif
     DEFINE_OPCODE(op_get_by_id_chain) {
         /* op_get_by_id_chain dst(r) base(r) property(id) structure(sID) structureChain(chain) count(n) offset(n)
 
@@ -2726,12 +2715,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
 
             if (LIKELY(baseCell->structure() == structure)) {
-                RefPtr<Structure>* it = vPC[5].u.structureChain->head();
+                WriteBarrier<Structure>* it = vPC[5].u.structureChain->head();
                 size_t count = vPC[6].u.operand;
-                RefPtr<Structure>* end = it + count;
+                WriteBarrier<Structure>* end = it + count;
 
                 while (true) {
                     JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
@@ -2761,6 +2750,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         NEXT_INSTRUCTION();
     }
 #if USE(GCC_COMPUTED_GOTO_WORKAROUND)
+    skip_get_by_id_chain:
     goto *(&&skip_id_getter_self);
 #endif
     DEFINE_OPCODE(op_get_by_id_getter_self) {
@@ -2775,7 +2765,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
             
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(baseCell->isObject());
@@ -2818,7 +2808,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
             
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(baseCell->isObject());
@@ -2875,12 +2865,12 @@ skip_id_custom_self:
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
             
             if (LIKELY(baseCell->structure() == structure)) {
-                RefPtr<Structure>* it = vPC[5].u.structureChain->head();
+                WriteBarrier<Structure>* it = vPC[5].u.structureChain->head();
                 size_t count = vPC[6].u.operand;
-                RefPtr<Structure>* end = it + count;
+                WriteBarrier<Structure>* end = it + count;
                 
                 while (true) {
                     JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
@@ -2930,12 +2920,12 @@ skip_id_custom_self:
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
             
             if (LIKELY(baseCell->structure() == structure)) {
-                RefPtr<Structure>* it = vPC[5].u.structureChain->head();
+                WriteBarrier<Structure>* it = vPC[5].u.structureChain->head();
                 size_t count = vPC[6].u.operand;
-                RefPtr<Structure>* end = it + count;
+                WriteBarrier<Structure>* end = it + count;
                 
                 while (true) {
                     JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
@@ -2966,6 +2956,7 @@ skip_id_custom_self:
     }
 #if USE(GCC_COMPUTED_GOTO_WORKAROUND)
     skip_id_custom_chain:
+    goto *(&&skip_get_array_length);
 #endif
     DEFINE_OPCODE(op_get_array_length) {
         /* op_get_array_length dst(r) base(r) property(id) nop(sID) nop(n) nop(n) nop(n)
@@ -2987,6 +2978,10 @@ skip_id_custom_self:
         uncacheGetByID(codeBlock, vPC);
         NEXT_INSTRUCTION();
     }
+#if USE(GCC_COMPUTED_GOTO_WORKAROUND)
+    skip_get_array_length:
+    goto *(&&skip_get_string_length);
+#endif
     DEFINE_OPCODE(op_get_string_length) {
         /* op_get_string_length dst(r) base(r) property(id) nop(sID) nop(n) nop(n) nop(n)
 
@@ -3007,6 +3002,10 @@ skip_id_custom_self:
         uncacheGetByID(codeBlock, vPC);
         NEXT_INSTRUCTION();
     }
+#if USE(GCC_COMPUTED_GOTO_WORKAROUND)
+    skip_get_string_length:
+    goto *(&&skip_put_by_id);
+#endif
     DEFINE_OPCODE(op_put_by_id) {
         /* put_by_id base(r) property(id) value(r) nop(n) nop(n) nop(n) nop(n) direct(b)
 
@@ -3040,6 +3039,9 @@ skip_id_custom_self:
         vPC += OPCODE_LENGTH(op_put_by_id);
         NEXT_INSTRUCTION();
     }
+#if USE(GCC_COMPUTED_GOTO_WORKAROUND)
+      skip_put_by_id:
+#endif
     DEFINE_OPCODE(op_put_by_id_transition) {
         /* op_put_by_id_transition base(r) property(id) value(r) oldStructure(sID) newStructure(sID) structureChain(chain) offset(n) direct(b)
          
@@ -3056,8 +3058,8 @@ skip_id_custom_self:
         
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* oldStructure = vPC[4].u.structure;
-            Structure* newStructure = vPC[5].u.structure;
+            Structure* oldStructure = vPC[4].u.structure.get();
+            Structure* newStructure = vPC[5].u.structure.get();
             
             if (LIKELY(baseCell->structure() == oldStructure)) {
                 ASSERT(baseCell->isObject());
@@ -3065,7 +3067,7 @@ skip_id_custom_self:
                 int direct = vPC[8].u.operand;
                 
                 if (!direct) {
-                    RefPtr<Structure>* it = vPC[6].u.structureChain->head();
+                    WriteBarrier<Structure>* it = vPC[6].u.structureChain->head();
 
                     JSValue proto = baseObject->structure()->prototypeForLookup(callFrame);
                     while (!proto.isNull()) {
@@ -3077,11 +3079,11 @@ skip_id_custom_self:
                         proto = asObject(proto)->structure()->prototypeForLookup(callFrame);
                     }
                 }
-                baseObject->transitionTo(newStructure);
+                baseObject->transitionTo(*globalData, newStructure);
 
                 int value = vPC[3].u.operand;
                 unsigned offset = vPC[7].u.operand;
-                ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(codeBlock->identifier(vPC[2].u.operand))) == offset);
+                ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(*globalData, codeBlock->identifier(vPC[2].u.operand))) == offset);
                 baseObject->putDirectOffset(callFrame->globalData(), offset, callFrame->r(value).jsValue());
 
                 vPC += OPCODE_LENGTH(op_put_by_id_transition);
@@ -3108,7 +3110,7 @@ skip_id_custom_self:
 
         if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = baseValue.asCell();
-            Structure* structure = vPC[4].u.structure;
+            Structure* structure = vPC[4].u.structure.get();
 
             if (LIKELY(baseCell->structure() == structure)) {
                 ASSERT(baseCell->isObject());
@@ -3116,7 +3118,7 @@ skip_id_custom_self:
                 int value = vPC[3].u.operand;
                 unsigned offset = vPC[5].u.operand;
                 
-                ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(codeBlock->identifier(vPC[2].u.operand))) == offset);
+                ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(*globalData, codeBlock->identifier(vPC[2].u.operand))) == offset);
                 baseObject->putDirectOffset(callFrame->globalData(), offset, callFrame->r(value).jsValue());
 
                 vPC += OPCODE_LENGTH(op_put_by_id_replace);
@@ -3539,10 +3541,9 @@ skip_id_custom_self:
            to ptr, using pointer equality.
          */
         int src = vPC[1].u.operand;
-        JSValue ptr = JSValue(vPC[2].u.jsCell);
         int target = vPC[3].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
-        if (srcValue != ptr) {
+        if (srcValue != vPC[2].u.jsCell.get()) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3803,7 +3804,7 @@ skip_id_custom_self:
          */
         if (!function->name().isNull()) {
             JSStaticScopeObject* functionScopeObject = new (callFrame) JSStaticScopeObject(callFrame, function->name(), func, ReadOnly | DontDelete);
-            func->scope().push(functionScopeObject);
+            func->setScope(*globalData, func->scope()->push(functionScopeObject));
         }
 
         callFrame->uncheckedR(dst) = JSValue(func);
@@ -3833,11 +3834,11 @@ skip_id_custom_self:
         Register* newCallFrame = callFrame->registers() + registerOffset;
         Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
         JSValue thisValue = argv[0].jsValue();
-        JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject;
+        JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject.get();
 
         if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
             JSValue result = callEval(callFrame, registerFile, argv, argCount, registerOffset);
-            if ((exceptionValue = globalData->exception.get()))
+            if ((exceptionValue = globalData->exception))
                 goto vm_throw;
             functionReturnValue = result;
 
@@ -3959,7 +3960,7 @@ skip_id_custom_self:
                 exceptionValue = createInvalidParamError(callFrame, "Function.prototype.apply", arguments);
                 goto vm_throw;
             }
-            if (asObject(arguments)->classInfo() == &Arguments::info) {
+            if (asObject(arguments)->classInfo() == &Arguments::s_info) {
                 Arguments* args = asArguments(arguments);
                 argCount = args->numProvidedArguments(callFrame);
                 argCount = min<uint32_t>(argCount, Arguments::MaxArguments);
@@ -3981,7 +3982,7 @@ skip_id_custom_self:
                     goto vm_throw;
                 }
                 array->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
-            } else if (asObject(arguments)->inherits(&JSArray::info)) {
+            } else if (asObject(arguments)->inherits(&JSArray::s_info)) {
                 JSObject* argObject = asObject(arguments);
                 argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
                 argCount = min<uint32_t>(argCount, Arguments::MaxArguments);
@@ -4101,7 +4102,7 @@ skip_id_custom_self:
         ASSERT(codeBlock->needsFullScopeChain());
         JSValue activationValue = callFrame->r(activation).jsValue();
         if (activationValue) {
-            asActivation(activationValue)->copyRegisters();
+            asActivation(activationValue)->copyRegisters(*globalData);
 
             if (JSValue argumentsValue = callFrame->r(unmodifiedArgumentsRegister(arguments)).jsValue()) {
                 if (!codeBlock->isStrictMode())
@@ -4109,7 +4110,7 @@ skip_id_custom_self:
             }
         } else if (JSValue argumentsValue = callFrame->r(unmodifiedArgumentsRegister(arguments)).jsValue()) {
             if (!codeBlock->isStrictMode())
-                asArguments(argumentsValue)->copyRegisters();
+                asArguments(argumentsValue)->copyRegisters(*globalData);
         }
 
         vPC += OPCODE_LENGTH(op_tear_off_activation);
@@ -4131,7 +4132,7 @@ skip_id_custom_self:
         ASSERT(!codeBlock->needsFullScopeChain() && codeBlock->ownerExecutable()->usesArguments());
 
         if (JSValue arguments = callFrame->r(unmodifiedArgumentsRegister(src1)).jsValue())
-            asArguments(arguments)->copyRegisters();
+            asArguments(arguments)->copyRegisters(*globalData);
 
         vPC += OPCODE_LENGTH(op_tear_off_arguments);
         NEXT_INSTRUCTION();
@@ -4148,9 +4149,6 @@ skip_id_custom_self:
 
         int result = vPC[1].u.operand;
 
-        if (callFrame->codeBlock()->needsFullScopeChain() && callFrame->r(codeBlock->activationRegister()).jsValue())
-            callFrame->scopeChain()->deref();
-
         JSValue returnValue = callFrame->r(result).jsValue();
 
         vPC = callFrame->returnVPC();
@@ -4189,9 +4187,6 @@ skip_id_custom_self:
 
         int result = vPC[1].u.operand;
 
-        if (codeBlock->needsFullScopeChain() && callFrame->r(codeBlock->activationRegister()).jsValue())
-            callFrame->scopeChain()->deref();
-
         JSValue returnValue = callFrame->r(result).jsValue();
 
         if (UNLIKELY(!returnValue.isObject()))
@@ -4236,7 +4231,7 @@ skip_id_custom_self:
         if (!callFrame->r(activationReg).jsValue()) {
             JSActivation* activation = new (globalData) JSActivation(callFrame, static_cast<FunctionExecutable*>(codeBlock->ownerExecutable()));
             callFrame->r(activationReg) = JSValue(activation);
-            callFrame->setScopeChain(callFrame->scopeChain()->copy()->push(activation));
+            callFrame->setScopeChain(callFrame->scopeChain()->push(activation));
         }
         vPC += OPCODE_LENGTH(op_create_activation);
         NEXT_INSTRUCTION();
@@ -4273,10 +4268,10 @@ skip_id_custom_self:
         Structure* structure;
         JSValue proto = callFrame->r(protoRegister).jsValue();
         if (proto.isObject())
-            structure = asObject(proto)->inheritorID();
+            structure = asObject(proto)->inheritorID(callFrame->globalData());
         else
-            structure = constructor->scope().node()->globalObject->emptyObjectStructure();
-        callFrame->uncheckedR(thisRegister) = JSValue(new (&callFrame->globalData()) JSObject(structure));
+            structure = constructor->scope()->globalObject->emptyObjectStructure();
+        callFrame->uncheckedR(thisRegister) = constructEmptyObject(callFrame, structure);
 
         vPC += OPCODE_LENGTH(op_create_this);
         NEXT_INSTRUCTION();
@@ -4641,11 +4636,6 @@ skip_id_custom_self:
            program. Return control to the calling native code.
         */
 
-        if (codeBlock->needsFullScopeChain()) {
-            ScopeChainNode* scopeChain = callFrame->scopeChain();
-            ASSERT(scopeChain->refCount > 1);
-            scopeChain->deref();
-        }
         int result = vPC[1].u.operand;
         return callFrame->r(result).jsValue();
     }
@@ -4775,9 +4765,13 @@ skip_id_custom_self:
             // cannot fathom if we don't assign to the exceptionValue before branching)
             exceptionValue = createInterruptedExecutionException(globalData);
         }
+        JSGlobalObject* globalObject = callFrame->lexicalGlobalObject();
         handler = throwException(callFrame, exceptionValue, vPC - codeBlock->instructions().begin());
-        if (!handler)
-            return throwError(callFrame, exceptionValue);
+        if (!handler) {
+            // Can't use the callframe at this point as the scopechain, etc have
+            // been released.
+            return throwError(globalObject->globalExec(), exceptionValue);
+        }
 
         codeBlock = callFrame->codeBlock();
         vPC = codeBlock->instructions().begin() + handler->target;
@@ -4814,7 +4808,7 @@ JSValue Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* functio
     }
 
     Arguments* arguments = new (functionCallFrame) Arguments(functionCallFrame);
-    arguments->copyRegisters();
+    arguments->copyRegisters(functionCallFrame->globalData());
     return arguments;
 }
 
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.h b/Source/JavaScriptCore/interpreter/Interpreter.h
index 753d90e..8f29f60 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.h
+++ b/Source/JavaScriptCore/interpreter/Interpreter.h
@@ -69,7 +69,7 @@ namespace JSC {
         friend class JIT;
         friend class CachedCall;
     public:
-        Interpreter();
+        Interpreter(JSGlobalData&);
 
         RegisterFile& registerFile() { return m_registerFile; }
         
diff --git a/Source/JavaScriptCore/interpreter/Register.h b/Source/JavaScriptCore/interpreter/Register.h
index 3944642..fb02c12 100644
--- a/Source/JavaScriptCore/interpreter/Register.h
+++ b/Source/JavaScriptCore/interpreter/Register.h
@@ -54,11 +54,10 @@ namespace JSC {
         Register(const JSValue&);
         Register& operator=(const JSValue&);
         JSValue jsValue() const;
+        EncodedJSValue encodedJSValue() const;
         
-        Register& operator=(JSActivation*);
         Register& operator=(CallFrame*);
         Register& operator=(CodeBlock*);
-        Register& operator=(JSPropertyNameIterator*);
         Register& operator=(ScopeChainNode*);
         Register& operator=(Instruction*);
 
@@ -73,29 +72,17 @@ namespace JSC {
 
         static Register withInt(int32_t i)
         {
-            Register r;
-            r.u.i = i;
+            Register r = jsNumber(i);
             return r;
         }
 
-        static Register withCallee(JSObject* callee)
-        {
-            Register r;
-            r.u.function = callee;
-            return r;
-        }
+        static inline Register withCallee(JSObject* callee);
 
     private:
         union {
-            int32_t i;
             EncodedJSValue value;
-
-            JSActivation* activation;
             CallFrame* callFrame;
             CodeBlock* codeBlock;
-            JSObject* function;
-            JSPropertyNameIterator* propertyNameIterator;
-            ScopeChainNode* scopeChain;
             Instruction* vPC;
         } u;
     };
@@ -129,14 +116,13 @@ namespace JSC {
         return JSValue::decode(u.value);
     }
 
-    // Interpreter functions
-
-    ALWAYS_INLINE Register& Register::operator=(JSActivation* activation)
+    ALWAYS_INLINE EncodedJSValue Register::encodedJSValue() const
     {
-        u.activation = activation;
-        return *this;
+        return u.value;
     }
 
+    // Interpreter functions
+
     ALWAYS_INLINE Register& Register::operator=(CallFrame* callFrame)
     {
         u.callFrame = callFrame;
@@ -155,28 +141,11 @@ namespace JSC {
         return *this;
     }
 
-    ALWAYS_INLINE Register& Register::operator=(ScopeChainNode* scopeChain)
-    {
-        u.scopeChain = scopeChain;
-        return *this;
-    }
-
-    ALWAYS_INLINE Register& Register::operator=(JSPropertyNameIterator* propertyNameIterator)
-    {
-        u.propertyNameIterator = propertyNameIterator;
-        return *this;
-    }
-
     ALWAYS_INLINE int32_t Register::i() const
     {
-        return u.i;
+        return jsValue().asInt32();
     }
-    
-    ALWAYS_INLINE JSActivation* Register::activation() const
-    {
-        return u.activation;
-    }
-    
+
     ALWAYS_INLINE CallFrame* Register::callFrame() const
     {
         return u.callFrame;
@@ -186,22 +155,7 @@ namespace JSC {
     {
         return u.codeBlock;
     }
-    
-    ALWAYS_INLINE JSObject* Register::function() const
-    {
-        return u.function;
-    }
-    
-    ALWAYS_INLINE JSPropertyNameIterator* Register::propertyNameIterator() const
-    {
-        return u.propertyNameIterator;
-    }
-    
-    ALWAYS_INLINE ScopeChainNode* Register::scopeChain() const
-    {
-        return u.scopeChain;
-    }
-    
+
     ALWAYS_INLINE Instruction* Register::vPC() const
     {
         return u.vPC;
diff --git a/Source/JavaScriptCore/interpreter/RegisterFile.cpp b/Source/JavaScriptCore/interpreter/RegisterFile.cpp
index 4c37676..e3b34bb 100644
--- a/Source/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/Source/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -29,6 +29,9 @@
 #include "config.h"
 #include "RegisterFile.h"
 
+#include "ConservativeRoots.h"
+#include "Interpreter.h"
+#include "JSGlobalData.h"
 #include "JSGlobalObject.h"
 
 namespace JSC {
@@ -49,6 +52,16 @@ RegisterFile::~RegisterFile()
     m_reservation.deallocate();
 }
 
+void RegisterFile::gatherConservativeRoots(ConservativeRoots& conservativeRoots)
+{
+    for (Register* it = start(); it != end(); ++it) {
+        JSValue v = it->jsValue();
+        if (!v.isCell())
+            continue;
+        conservativeRoots.add(v.asCell());
+    }
+}
+
 void RegisterFile::releaseExcessCapacity()
 {
     m_reservation.decommit(m_start, reinterpret_cast<intptr_t>(m_commitEnd) - reinterpret_cast<intptr_t>(m_start));
@@ -59,12 +72,7 @@ void RegisterFile::releaseExcessCapacity()
 
 void RegisterFile::setGlobalObject(JSGlobalObject* globalObject)
 {
-    m_globalObject = globalObject;
-}
-
-bool RegisterFile::clearGlobalObject(JSGlobalObject* globalObject)
-{
-    return m_globalObject.clear(globalObject);
+    m_globalObject.set(globalObject->globalData(), globalObject, &m_globalObjectOwner, this);
 }
 
 JSGlobalObject* RegisterFile::globalObject()
diff --git a/Source/JavaScriptCore/interpreter/RegisterFile.h b/Source/JavaScriptCore/interpreter/RegisterFile.h
index e9c6df1..f59c13a 100644
--- a/Source/JavaScriptCore/interpreter/RegisterFile.h
+++ b/Source/JavaScriptCore/interpreter/RegisterFile.h
@@ -32,7 +32,7 @@
 #include "Heap.h"
 #include "ExecutableAllocator.h"
 #include "Register.h"
-#include "WeakGCPtr.h"
+#include "Weak.h"
 #include <stdio.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PageReservation.h>
@@ -91,7 +91,6 @@ namespace JSC {
 
     class RegisterFile {
         WTF_MAKE_NONCOPYABLE(RegisterFile);
-        friend class JIT;
     public:
         enum CallFrameHeaderEntry {
             CallFrameHeaderSize = 6,
@@ -112,15 +111,16 @@ namespace JSC {
         // Allow 8k of excess registers before we start trying to reap the registerfile
         static const ptrdiff_t maxExcessCapacity = 8 * 1024;
 
-        RegisterFile(size_t capacity = defaultCapacity, size_t maxGlobals = defaultMaxGlobals);
+        RegisterFile(JSGlobalData&, size_t capacity = defaultCapacity, size_t maxGlobals = defaultMaxGlobals);
         ~RegisterFile();
+        
+        void gatherConservativeRoots(ConservativeRoots&);
 
         Register* start() const { return m_start; }
         Register* end() const { return m_end; }
         size_t size() const { return m_end - m_start; }
 
         void setGlobalObject(JSGlobalObject*);
-        bool clearGlobalObject(JSGlobalObject*);
         JSGlobalObject* globalObject();
 
         bool grow(Register* newEnd);
@@ -135,6 +135,11 @@ namespace JSC {
         static size_t committedByteCount();
         static void initializeThreading();
 
+        Register* const * addressOfEnd() const
+        {
+            return &m_end;
+        }
+
     private:
         void releaseExcessCapacity();
         void addToCommittedByteCount(long);
@@ -147,19 +152,25 @@ namespace JSC {
         Register* m_commitEnd;
         PageReservation m_reservation;
 
-        WeakGCPtr<JSGlobalObject> m_globalObject; // The global object whose vars are currently stored in the register file.
+        Weak<JSGlobalObject> m_globalObject; // The global object whose vars are currently stored in the register file.
+        class GlobalObjectOwner : public WeakHandleOwner {
+            virtual void finalize(Handle<Unknown>, void* context)
+            {
+                static_cast<RegisterFile*>(context)->setNumGlobals(0);
+            }
+        } m_globalObjectOwner;
     };
 
-    inline RegisterFile::RegisterFile(size_t capacity, size_t maxGlobals)
+    inline RegisterFile::RegisterFile(JSGlobalData& globalData, size_t capacity, size_t maxGlobals)
         : m_numGlobals(0)
         , m_maxGlobals(maxGlobals)
         , m_start(0)
         , m_end(0)
         , m_max(0)
+        , m_globalObject(globalData, 0, &m_globalObjectOwner, this)
     {
         ASSERT(maxGlobals && isPageAligned(maxGlobals));
         ASSERT(capacity && isPageAligned(capacity));
-
         size_t bufferLength = (capacity + maxGlobals) * sizeof(Register);
         m_reservation = PageReservation::reserve(roundUpAllocationSize(bufferLength, commitSize), OSAllocator::JSVMStackPages);
         void* base = m_reservation.base();
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocator.h b/Source/JavaScriptCore/jit/ExecutableAllocator.h
index 57ee054..77a2567 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/Source/JavaScriptCore/jit/ExecutableAllocator.h
@@ -47,6 +47,13 @@
 #include <sys/cachectl.h>
 #endif
 
+#if CPU(SH4) && OS(LINUX)
+#include <asm/cachectl.h>
+#include <asm/unistd.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+#endif
+
 #if OS(WINCE)
 // From pkfuncs.h (private header file from the Platform Builder)
 #define CACHE_SYNC_ALL 0x07F
@@ -310,6 +317,15 @@ public:
         IMemCache1_ClearCache(memCache.get(), reinterpret_cast<uint32>(code), size, MEMSPACE_CACHE_FLUSH, MEMSPACE_DATACACHE);
         IMemCache1_ClearCache(memCache.get(), reinterpret_cast<uint32>(code), size, MEMSPACE_CACHE_INVALIDATE, MEMSPACE_INSTCACHE);
     }
+#elif CPU(SH4) && OS(LINUX)
+    static void cacheFlush(void* code, size_t size)
+    {
+#ifdef CACHEFLUSH_D_L2
+        syscall(__NR_cacheflush, reinterpret_cast<unsigned>(code), size, CACHEFLUSH_D_WB | CACHEFLUSH_I | CACHEFLUSH_D_L2);
+#else
+        syscall(__NR_cacheflush, reinterpret_cast<unsigned>(code), size, CACHEFLUSH_D_WB | CACHEFLUSH_I);
+#endif
+    }
 #else
     #error "The cacheFlush support is missing on this platform."
 #endif
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index 29e3778..b983427 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -44,6 +44,7 @@ JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse
 #include "RepatchBuffer.h"
 #include "ResultType.h"
 #include "SamplingTool.h"
+#include "dfg/DFGNode.h" // for DFG_SUCCESS_STATS
 
 using namespace std;
 
@@ -92,7 +93,7 @@ JIT::JIT(JSGlobalData* globalData, CodeBlock* codeBlock, void* linkerOffset)
 #if USE(JSVALUE32_64)
 void JIT::emitTimeoutCheck()
 {
-    Jump skipTimeout = branchSub32(NonZero, Imm32(1), timeoutCheckRegister);
+    Jump skipTimeout = branchSub32(NonZero, TrustedImm32(1), timeoutCheckRegister);
     JITStubCall stubCall(this, cti_timeout_check);
     stubCall.addArgument(regT1, regT0); // save last result registers.
     stubCall.call(timeoutCheckRegister);
@@ -102,7 +103,7 @@ void JIT::emitTimeoutCheck()
 #else
 void JIT::emitTimeoutCheck()
 {
-    Jump skipTimeout = branchSub32(NonZero, Imm32(1), timeoutCheckRegister);
+    Jump skipTimeout = branchSub32(NonZero, TrustedImm32(1), timeoutCheckRegister);
     JITStubCall(this, cti_timeout_check).call(timeoutCheckRegister);
     skipTimeout.link(this);
 
@@ -471,11 +472,16 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
 
     Jump registerFileCheck;
     if (m_codeBlock->codeType() == FunctionCode) {
+#if DFG_SUCCESS_STATS
+        static SamplingCounter counter("orignalJIT");
+        emitCount(counter);
+#endif
+
         // In the case of a fast linked call, we do not set this up in the caller.
         emitPutImmediateToCallFrameHeader(m_codeBlock, RegisterFile::CodeBlock);
 
         addPtr(Imm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, regT1);
-        registerFileCheck = branchPtr(Below, AbsoluteAddress(&m_globalData->interpreter->registerFile().m_end), regT1);
+        registerFileCheck = branchPtr(Below, AbsoluteAddress(m_globalData->interpreter->registerFile().addressOfEnd()), regT1);
     }
 
     Label functionBody = label();
@@ -497,7 +503,7 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
         arityCheck = label();
         preserveReturnAddressAfterCall(regT2);
         emitPutToCallFrameHeader(regT2, RegisterFile::ReturnPC);
-        branch32(Equal, regT1, Imm32(m_codeBlock->m_numParameters)).linkTo(beginLabel, this);
+        branch32(Equal, regT1, TrustedImm32(m_codeBlock->m_numParameters)).linkTo(beginLabel, this);
         restoreArgumentReference();
 
         JITStubCall(this, m_codeBlock->m_isConstructor ? cti_op_construct_arityCheck : cti_op_call_arityCheck).call(callFrameRegister);
@@ -567,7 +573,6 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
 #if ENABLE(JIT_OPTIMIZE_CALL)
     for (unsigned i = 0; i < m_codeBlock->numberOfCallLinkInfos(); ++i) {
         CallLinkInfo& info = m_codeBlock->callLinkInfo(i);
-        info.ownerCodeBlock = m_codeBlock;
         info.callReturnLocation = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].callReturnLocation);
         info.hotPathBegin = patchBuffer.locationOf(m_callStructureStubCompilationInfo[i].hotPathBegin);
         info.hotPathOther = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].hotPathOther);
@@ -588,18 +593,6 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
 }
 
 #if ENABLE(JIT_OPTIMIZE_CALL)
-void JIT::unlinkCallOrConstruct(CallLinkInfo* callLinkInfo)
-{
-    // When the JSFunction is deleted the pointer embedded in the instruction stream will no longer be valid
-    // (and, if a new JSFunction happened to be constructed at the same location, we could get a false positive
-    // match).  Reset the check so it no longer matches.
-    RepatchBuffer repatchBuffer(callLinkInfo->ownerCodeBlock);
-#if USE(JSVALUE32_64)
-    repatchBuffer.repatch(callLinkInfo->hotPathBegin, 0);
-#else
-    repatchBuffer.repatch(callLinkInfo->hotPathBegin, JSValue::encode(JSValue()));
-#endif
-}
 
 void JIT::linkCall(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBlock* calleeCodeBlock, JIT::CodePtr code, CallLinkInfo* callLinkInfo, int callerArgCount, JSGlobalData* globalData)
 {
@@ -609,10 +602,7 @@ void JIT::linkCall(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBlock* ca
     // If this is a native call calleeCodeBlock is null so the number of parameters is unimportant
     if (!calleeCodeBlock || (callerArgCount == calleeCodeBlock->m_numParameters)) {
         ASSERT(!callLinkInfo->isLinked());
-    
-        if (calleeCodeBlock)
-            calleeCodeBlock->addCaller(callLinkInfo);
-    
+        callLinkInfo->callee.set(*globalData, callerCodeBlock->ownerExecutable(), callee);
         repatchBuffer.repatch(callLinkInfo->hotPathBegin, callee);
         repatchBuffer.relink(callLinkInfo->hotPathOther, code);
     }
@@ -629,10 +619,7 @@ void JIT::linkConstruct(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBloc
     // If this is a native call calleeCodeBlock is null so the number of parameters is unimportant
     if (!calleeCodeBlock || (callerArgCount == calleeCodeBlock->m_numParameters)) {
         ASSERT(!callLinkInfo->isLinked());
-    
-        if (calleeCodeBlock)
-            calleeCodeBlock->addCaller(callLinkInfo);
-    
+        callLinkInfo->callee.set(*globalData, callerCodeBlock->ownerExecutable(), callee);
         repatchBuffer.repatch(callLinkInfo->hotPathBegin, callee);
         repatchBuffer.relink(callLinkInfo->hotPathOther, code);
     }
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index dc1650d..6b8c6dd 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -36,7 +36,7 @@
 #define JIT_CLASS_ALIGNMENT
 #endif
 
-#define ASSERT_JIT_OFFSET(actual, expected) ASSERT_WITH_MESSAGE(actual == expected, "JIT Offset \"%s\" should be %d, not %d.\n", #expected, static_cast<int>(actual), static_cast<int>(expected));
+#define ASSERT_JIT_OFFSET(actual, expected) ASSERT_WITH_MESSAGE(actual == expected, "JIT Offset \"%s\" should be %d, not %d.\n", #expected, static_cast<int>(expected), static_cast<int>(actual));
 
 #include "CodeBlock.h"
 #include "Interpreter.h"
@@ -235,7 +235,7 @@ namespace JSC {
 
         static void patchGetByIdSelf(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress);
         static void patchPutByIdReplace(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress, bool direct);
-        static void patchMethodCallProto(CodeBlock* codeblock, MethodCallLinkInfo&, JSFunction*, Structure*, JSObject*, ReturnAddressPtr);
+        static void patchMethodCallProto(JSGlobalData&, CodeBlock* codeblock, MethodCallLinkInfo&, JSFunction*, Structure*, JSObject*, ReturnAddressPtr);
 
         static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, ReturnAddressPtr returnAddress)
         {
@@ -245,7 +245,6 @@ namespace JSC {
 
         static void linkCall(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBlock* calleeCodeBlock, CodePtr, CallLinkInfo*, int callerArgCount, JSGlobalData*);
         static void linkConstruct(JSFunction* callee, CodeBlock* callerCodeBlock, CodeBlock* calleeCodeBlock, CodePtr, CallLinkInfo*, int callerArgCount, JSGlobalData*);
-        static void unlinkCallOrConstruct(CallLinkInfo*);
 
     private:
         struct JSRInfo {
@@ -310,9 +309,9 @@ namespace JSC {
         void emitStore(unsigned index, RegisterID tag, RegisterID payload, RegisterID base = callFrameRegister);
         void emitStore(unsigned index, const JSValue constant, RegisterID base = callFrameRegister);
         void emitStoreInt32(unsigned index, RegisterID payload, bool indexIsInt32 = false);
-        void emitStoreInt32(unsigned index, Imm32 payload, bool indexIsInt32 = false);
+        void emitStoreInt32(unsigned index, TrustedImm32 payload, bool indexIsInt32 = false);
         void emitStoreCell(unsigned index, RegisterID payload, bool indexIsCell = false);
-        void emitStoreBool(unsigned index, RegisterID tag, bool indexIsBool = false);
+        void emitStoreBool(unsigned index, RegisterID payload, bool indexIsBool = false);
         void emitStoreDouble(unsigned index, FPRegisterID value);
 
         bool isLabeled(unsigned bytecodeOffset);
@@ -332,8 +331,8 @@ namespace JSC {
         void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck = false);
 #endif
         void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset);
-        void compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset);
-        void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset);
+        void compileGetDirectOffset(JSObject* base, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset);
+        void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID offset);
         void compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, Structure* structure, size_t cachedOffset);
 
         // Arithmetic opcode helpers
@@ -344,15 +343,11 @@ namespace JSC {
 #if CPU(X86)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 7;
-        static const int patchOffsetPutByIdExternalLoad = 13;
-        static const int patchLengthPutByIdExternalLoad = 3;
         static const int patchOffsetPutByIdPropertyMapOffset1 = 22;
         static const int patchOffsetPutByIdPropertyMapOffset2 = 28;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 7;
         static const int patchOffsetGetByIdBranchToSlowCase = 13;
-        static const int patchOffsetGetByIdExternalLoad = 13;
-        static const int patchLengthGetByIdExternalLoad = 3;
         static const int patchOffsetGetByIdPropertyMapOffset1 = 22;
         static const int patchOffsetGetByIdPropertyMapOffset2 = 28;
         static const int patchOffsetGetByIdPutResult = 28;
@@ -369,15 +364,11 @@ namespace JSC {
 #elif CPU(ARM_TRADITIONAL)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 4;
-        static const int patchOffsetPutByIdExternalLoad = 16;
-        static const int patchLengthPutByIdExternalLoad = 4;
         static const int patchOffsetPutByIdPropertyMapOffset1 = 20;
         static const int patchOffsetPutByIdPropertyMapOffset2 = 28;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 4;
         static const int patchOffsetGetByIdBranchToSlowCase = 16;
-        static const int patchOffsetGetByIdExternalLoad = 16;
-        static const int patchLengthGetByIdExternalLoad = 4;
         static const int patchOffsetGetByIdPropertyMapOffset1 = 20;
         static const int patchOffsetGetByIdPropertyMapOffset2 = 28;
         static const int patchOffsetGetByIdPutResult = 36;
@@ -410,18 +401,14 @@ namespace JSC {
 #elif CPU(ARM_THUMB2)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
-        static const int patchOffsetPutByIdExternalLoad = 26;
-        static const int patchLengthPutByIdExternalLoad = 12;
-        static const int patchOffsetPutByIdPropertyMapOffset1 = 46;
-        static const int patchOffsetPutByIdPropertyMapOffset2 = 58;
+        static const int patchOffsetPutByIdPropertyMapOffset1 = 36;
+        static const int patchOffsetPutByIdPropertyMapOffset2 = 48;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 10;
         static const int patchOffsetGetByIdBranchToSlowCase = 26;
-        static const int patchOffsetGetByIdExternalLoad = 26;
-        static const int patchLengthGetByIdExternalLoad = 12;
-        static const int patchOffsetGetByIdPropertyMapOffset1 = 46;
-        static const int patchOffsetGetByIdPropertyMapOffset2 = 58;
-        static const int patchOffsetGetByIdPutResult = 62;
+        static const int patchOffsetGetByIdPropertyMapOffset1 = 36;
+        static const int patchOffsetGetByIdPropertyMapOffset2 = 48;
+        static const int patchOffsetGetByIdPutResult = 52;
 #if ENABLE(OPCODE_SAMPLING)
         #error "OPCODE_SAMPLING is not yet supported"
 #else
@@ -451,17 +438,13 @@ namespace JSC {
 #elif CPU(MIPS)
 #if WTF_MIPS_ISA(1)
         static const int patchOffsetPutByIdStructure = 16;
-        static const int patchOffsetPutByIdExternalLoad = 48;
-        static const int patchLengthPutByIdExternalLoad = 20;
-        static const int patchOffsetPutByIdPropertyMapOffset1 = 68;
-        static const int patchOffsetPutByIdPropertyMapOffset2 = 84;
+        static const int patchOffsetPutByIdPropertyMapOffset1 = 56;
+        static const int patchOffsetPutByIdPropertyMapOffset2 = 72;
         static const int patchOffsetGetByIdStructure = 16;
         static const int patchOffsetGetByIdBranchToSlowCase = 48;
-        static const int patchOffsetGetByIdExternalLoad = 48;
-        static const int patchLengthGetByIdExternalLoad = 20;
-        static const int patchOffsetGetByIdPropertyMapOffset1 = 68;
-        static const int patchOffsetGetByIdPropertyMapOffset2 = 88;
-        static const int patchOffsetGetByIdPutResult = 108;
+        static const int patchOffsetGetByIdPropertyMapOffset1 = 56;
+        static const int patchOffsetGetByIdPropertyMapOffset2 = 76;
+        static const int patchOffsetGetByIdPutResult = 96;
 #if ENABLE(OPCODE_SAMPLING)
         #error "OPCODE_SAMPLING is not yet supported"
 #else
@@ -473,17 +456,13 @@ namespace JSC {
         static const int patchOffsetMethodCheckPutFunction = 88;
 #else // WTF_MIPS_ISA(1)
         static const int patchOffsetPutByIdStructure = 12;
-        static const int patchOffsetPutByIdExternalLoad = 44;
-        static const int patchLengthPutByIdExternalLoad = 16;
-        static const int patchOffsetPutByIdPropertyMapOffset1 = 60;
-        static const int patchOffsetPutByIdPropertyMapOffset2 = 76;
+        static const int patchOffsetPutByIdPropertyMapOffset1 = 48;
+        static const int patchOffsetPutByIdPropertyMapOffset2 = 64;
         static const int patchOffsetGetByIdStructure = 12;
         static const int patchOffsetGetByIdBranchToSlowCase = 44;
-        static const int patchOffsetGetByIdExternalLoad = 44;
-        static const int patchLengthGetByIdExternalLoad = 16;
-        static const int patchOffsetGetByIdPropertyMapOffset1 = 60;
-        static const int patchOffsetGetByIdPropertyMapOffset2 = 76;
-        static const int patchOffsetGetByIdPutResult = 92;
+        static const int patchOffsetGetByIdPropertyMapOffset1 = 48;
+        static const int patchOffsetGetByIdPropertyMapOffset2 = 64;
+        static const int patchOffsetGetByIdPutResult = 80;
 #if ENABLE(OPCODE_SAMPLING)
         #error "OPCODE_SAMPLING is not yet supported"
 #else
@@ -494,6 +473,48 @@ namespace JSC {
         static const int patchOffsetMethodCheckProtoStruct = 52;
         static const int patchOffsetMethodCheckPutFunction = 84;
 #endif
+#elif CPU(SH4)
+       // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetGetByIdStructure = 6;
+        static const int patchOffsetPutByIdPropertyMapOffset = 24;
+        static const int patchOffsetPutByIdStructure = 6;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdBranchToSlowCase = 10;
+        static const int patchOffsetGetByIdPropertyMapOffset = 24;
+        static const int patchOffsetGetByIdPutResult = 32;
+
+        // sequenceOpCall
+        static const int sequenceOpCallInstructionSpace = 12;
+        static const int sequenceOpCallConstantSpace = 2;
+        // sequenceMethodCheck
+        static const int sequenceMethodCheckInstructionSpace = 40;
+        static const int sequenceMethodCheckConstantSpace = 6;
+        // sequenceGetByIdHotPath
+        static const int sequenceGetByIdHotPathInstructionSpace = 36;
+        static const int sequenceGetByIdHotPathConstantSpace = 5;
+        // sequenceGetByIdSlowCase
+        static const int sequenceGetByIdSlowCaseInstructionSpace = 26;
+        static const int sequenceGetByIdSlowCaseConstantSpace = 2;
+        // sequencePutById
+        static const int sequencePutByIdInstructionSpace = 36;
+        static const int sequencePutByIdConstantSpace = 5;
+
+        static const int patchOffsetGetByIdPropertyMapOffset1 = 20;
+        static const int patchOffsetGetByIdPropertyMapOffset2 = 26;
+
+        static const int patchOffsetPutByIdPropertyMapOffset1 = 20;
+        static const int patchOffsetPutByIdPropertyMapOffset2 = 26;
+
+#if ENABLE(OPCODE_SAMPLING)
+        static const int patchOffsetGetByIdSlowCaseCall = 0; // FIMXE
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 22;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 4;
+
+        static const int patchOffsetMethodCheckProtoObj = 12;
+        static const int patchOffsetMethodCheckProtoStruct = 20;
+        static const int patchOffsetMethodCheckPutFunction = 32;
 #else
 #error "JSVALUE32_64 not supported on this platform."
 #endif
@@ -551,21 +572,17 @@ namespace JSC {
         void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck = false);
 #endif
         void compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset);
-        void compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID result, size_t cachedOffset);
-        void compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch);
+        void compileGetDirectOffset(JSObject* base, RegisterID result, size_t cachedOffset);
+        void compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID offset, RegisterID scratch);
         void compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset);
 
 #if CPU(X86_64)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
-        static const int patchOffsetPutByIdExternalLoad = 20;
-        static const int patchLengthPutByIdExternalLoad = 4;
         static const int patchOffsetPutByIdPropertyMapOffset = 31;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 10;
         static const int patchOffsetGetByIdBranchToSlowCase = 20;
-        static const int patchOffsetGetByIdExternalLoad = 20;
-        static const int patchLengthGetByIdExternalLoad = 4;
         static const int patchOffsetGetByIdPropertyMapOffset = 31;
         static const int patchOffsetGetByIdPutResult = 31;
 #if ENABLE(OPCODE_SAMPLING)
@@ -581,14 +598,10 @@ namespace JSC {
 #elif CPU(X86)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 7;
-        static const int patchOffsetPutByIdExternalLoad = 13;
-        static const int patchLengthPutByIdExternalLoad = 3;
         static const int patchOffsetPutByIdPropertyMapOffset = 22;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 7;
         static const int patchOffsetGetByIdBranchToSlowCase = 13;
-        static const int patchOffsetGetByIdExternalLoad = 13;
-        static const int patchLengthGetByIdExternalLoad = 3;
         static const int patchOffsetGetByIdPropertyMapOffset = 22;
         static const int patchOffsetGetByIdPutResult = 22;
 #if ENABLE(OPCODE_SAMPLING)
@@ -604,14 +617,10 @@ namespace JSC {
 #elif CPU(ARM_THUMB2)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
-        static const int patchOffsetPutByIdExternalLoad = 26;
-        static const int patchLengthPutByIdExternalLoad = 12;
         static const int patchOffsetPutByIdPropertyMapOffset = 46;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 10;
         static const int patchOffsetGetByIdBranchToSlowCase = 26;
-        static const int patchOffsetGetByIdExternalLoad = 26;
-        static const int patchLengthGetByIdExternalLoad = 12;
         static const int patchOffsetGetByIdPropertyMapOffset = 46;
         static const int patchOffsetGetByIdPutResult = 50;
 #if ENABLE(OPCODE_SAMPLING)
@@ -627,14 +636,10 @@ namespace JSC {
 #elif CPU(ARM_TRADITIONAL)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 4;
-        static const int patchOffsetPutByIdExternalLoad = 16;
-        static const int patchLengthPutByIdExternalLoad = 4;
         static const int patchOffsetPutByIdPropertyMapOffset = 20;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 4;
         static const int patchOffsetGetByIdBranchToSlowCase = 16;
-        static const int patchOffsetGetByIdExternalLoad = 16;
-        static const int patchLengthGetByIdExternalLoad = 4;
         static const int patchOffsetGetByIdPropertyMapOffset = 20;
         static const int patchOffsetGetByIdPutResult = 28;
 #if ENABLE(OPCODE_SAMPLING)
@@ -666,13 +671,9 @@ namespace JSC {
 #elif CPU(MIPS)
 #if WTF_MIPS_ISA(1)
         static const int patchOffsetPutByIdStructure = 16;
-        static const int patchOffsetPutByIdExternalLoad = 48;
-        static const int patchLengthPutByIdExternalLoad = 20;
         static const int patchOffsetPutByIdPropertyMapOffset = 68;
         static const int patchOffsetGetByIdStructure = 16;
         static const int patchOffsetGetByIdBranchToSlowCase = 48;
-        static const int patchOffsetGetByIdExternalLoad = 48;
-        static const int patchLengthGetByIdExternalLoad = 20;
         static const int patchOffsetGetByIdPropertyMapOffset = 68;
         static const int patchOffsetGetByIdPutResult = 88;
 #if ENABLE(OPCODE_SAMPLING)
@@ -686,13 +687,9 @@ namespace JSC {
         static const int patchOffsetMethodCheckPutFunction = 88;
 #else // WTF_MIPS_ISA(1)
         static const int patchOffsetPutByIdStructure = 12;
-        static const int patchOffsetPutByIdExternalLoad = 44;
-        static const int patchLengthPutByIdExternalLoad = 16;
         static const int patchOffsetPutByIdPropertyMapOffset = 60;
         static const int patchOffsetGetByIdStructure = 12;
         static const int patchOffsetGetByIdBranchToSlowCase = 44;
-        static const int patchOffsetGetByIdExternalLoad = 44;
-        static const int patchLengthGetByIdExternalLoad = 16;
         static const int patchOffsetGetByIdPropertyMapOffset = 60;
         static const int patchOffsetGetByIdPutResult = 76;
 #if ENABLE(OPCODE_SAMPLING)
@@ -710,14 +707,16 @@ namespace JSC {
 
 #if (defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL)
 #define BEGIN_UNINTERRUPTED_SEQUENCE(name) do { beginUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace); } while (false)
-#define END_UNINTERRUPTED_SEQUENCE(name) do { endUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace); } while (false)
+#define END_UNINTERRUPTED_SEQUENCE_FOR_PUT(name, dst) do { endUninterruptedSequence(name ## InstructionSpace, name ## ConstantSpace, dst); } while (false)
+#define END_UNINTERRUPTED_SEQUENCE(name) END_UNINTERRUPTED_SEQUENCE_FOR_PUT(name, 0)
 
         void beginUninterruptedSequence(int, int);
-        void endUninterruptedSequence(int, int);
+        void endUninterruptedSequence(int, int, int);
 
 #else
 #define BEGIN_UNINTERRUPTED_SEQUENCE(name)  do { beginUninterruptedSequence(); } while (false)
 #define END_UNINTERRUPTED_SEQUENCE(name)  do { endUninterruptedSequence(); } while (false)
+#define END_UNINTERRUPTED_SEQUENCE_FOR_PUT(name, dst) do { endUninterruptedSequence(); } while (false)
 #endif
 
         void emit_op_add(Instruction*);
@@ -898,6 +897,8 @@ namespace JSC {
         void emitInitRegister(unsigned dst);
 
         void emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry);
+        void emitPutCellToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry);
+        void emitPutIntToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry);
         void emitPutImmediateToCallFrameHeader(void* value, RegisterFile::CallFrameHeaderEntry entry);
         void emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from = callFrameRegister);
         void emitGetFromCallFrameHeader32(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from = callFrameRegister);
diff --git a/Source/JavaScriptCore/jit/JITArithmetic.cpp b/Source/JavaScriptCore/jit/JITArithmetic.cpp
index cd05f51..734cc1d 100644
--- a/Source/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/Source/JavaScriptCore/jit/JITArithmetic.cpp
@@ -167,7 +167,7 @@ void JIT::emit_op_urshift(Instruction* currentInstruction)
         // a toUint conversion, which can result in a value we can represent
         // as an immediate int.
         if (shift < 0 || !(shift & 31))
-            addSlowCase(branch32(LessThan, regT0, Imm32(0)));
+            addSlowCase(branch32(LessThan, regT0, TrustedImm32(0)));
         emitFastArithReTagImmediate(regT0, regT0);
         emitPutVirtualRegister(dst, regT0);
         return;
@@ -179,7 +179,7 @@ void JIT::emit_op_urshift(Instruction* currentInstruction)
     emitFastArithImmToInt(regT0);
     emitFastArithImmToInt(regT1);
     urshift32(regT1, regT0);
-    addSlowCase(branch32(LessThan, regT0, Imm32(0)));
+    addSlowCase(branch32(LessThan, regT0, TrustedImm32(0)));
     emitFastArithReTagImmediate(regT0, regT0);
     emitPutVirtualRegister(dst, regT0);
 }
@@ -202,7 +202,7 @@ void JIT::emitSlow_op_urshift(Instruction* currentInstruction, Vector<SlowCaseEn
             if (shift)
                 urshift32(Imm32(shift & 0x1f), regT0);
             if (shift < 0 || !(shift & 31))
-                failures.append(branch32(LessThan, regT0, Imm32(0)));
+                failures.append(branch32(LessThan, regT0, TrustedImm32(0)));
             emitFastArithReTagImmediate(regT0, regT0);
             emitPutVirtualRegister(dst, regT0);
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_rshift));
@@ -224,7 +224,7 @@ void JIT::emitSlow_op_urshift(Instruction* currentInstruction, Vector<SlowCaseEn
                 failures.append(emitJumpIfNotImmediateInteger(regT1)); // op2 is not an int
                 emitFastArithImmToInt(regT1);
                 urshift32(regT1, regT0);
-                failures.append(branch32(LessThan, regT0, Imm32(0)));
+                failures.append(branch32(LessThan, regT0, TrustedImm32(0)));
                 emitFastArithReTagImmediate(regT0, regT0);
                 emitPutVirtualRegister(dst, regT0);
                 emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_rshift));
@@ -773,7 +773,7 @@ void JIT::emit_op_post_inc(Instruction* currentInstruction)
     emitGetVirtualRegister(srcDst, regT0);
     move(regT0, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-    addSlowCase(branchAdd32(Overflow, Imm32(1), regT1));
+    addSlowCase(branchAdd32(Overflow, TrustedImm32(1), regT1));
     emitFastArithIntToImmNoCheck(regT1, regT1);
     emitPutVirtualRegister(srcDst, regT1);
     emitPutVirtualRegister(result);
@@ -800,7 +800,7 @@ void JIT::emit_op_post_dec(Instruction* currentInstruction)
     emitGetVirtualRegister(srcDst, regT0);
     move(regT0, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-    addSlowCase(branchSub32(Zero, Imm32(1), regT1));
+    addSlowCase(branchSub32(Zero, TrustedImm32(1), regT1));
     emitFastArithIntToImmNoCheck(regT1, regT1);
     emitPutVirtualRegister(srcDst, regT1);
     emitPutVirtualRegister(result);
@@ -825,7 +825,7 @@ void JIT::emit_op_pre_inc(Instruction* currentInstruction)
 
     emitGetVirtualRegister(srcDst, regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-    addSlowCase(branchAdd32(Overflow, Imm32(1), regT0));
+    addSlowCase(branchAdd32(Overflow, TrustedImm32(1), regT0));
     emitFastArithIntToImmNoCheck(regT0, regT0);
     emitPutVirtualRegister(srcDst);
 }
@@ -849,7 +849,7 @@ void JIT::emit_op_pre_dec(Instruction* currentInstruction)
 
     emitGetVirtualRegister(srcDst, regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-    addSlowCase(branchSub32(Zero, Imm32(1), regT0));
+    addSlowCase(branchSub32(Zero, TrustedImm32(1), regT0));
     emitFastArithIntToImmNoCheck(regT0, regT0);
     emitPutVirtualRegister(srcDst);
 }
@@ -888,7 +888,7 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT2);
 
-    addSlowCase(branchPtr(Equal, regT2, ImmPtr(JSValue::encode(jsNumber(0)))));
+    addSlowCase(branchPtr(Equal, regT2, TrustedImmPtr(JSValue::encode(jsNumber(0)))));
     m_assembler.cdq();
     m_assembler.idivl_r(regT2);
     emitFastArithReTagImmediate(regT1, regT0);
@@ -966,7 +966,7 @@ void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned, unsigned op1, unsign
 void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, unsigned result, unsigned op1, unsigned op2, OperandTypes types, bool op1HasImmediateIntFastCase, bool op2HasImmediateIntFastCase)
 {
     // We assume that subtracting TagTypeNumber is equivalent to adding DoubleEncodeOffset.
-    COMPILE_ASSERT(((JSImmediate::TagTypeNumber + JSImmediate::DoubleEncodeOffset) == 0), TagTypeNumber_PLUS_DoubleEncodeOffset_EQUALS_0);
+    COMPILE_ASSERT(((TagTypeNumber + DoubleEncodeOffset) == 0), TagTypeNumber_PLUS_DoubleEncodeOffset_EQUALS_0);
 
     Jump notImm1;
     Jump notImm2;
diff --git a/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp b/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp
index e0b31f0..6865489 100644
--- a/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITArithmetic32_64.cpp
@@ -54,17 +54,17 @@ void JIT::emit_op_negate(Instruction* currentInstruction)
 
     emitLoad(src, regT1, regT0);
 
-    Jump srcNotInt = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    addSlowCase(branchTest32(Zero, regT0, Imm32(0x7fffffff)));
+    Jump srcNotInt = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
+    addSlowCase(branchTest32(Zero, regT0, TrustedImm32(0x7fffffff)));
     neg32(regT0);
     emitStoreInt32(dst, regT0, (dst == src));
 
     Jump end = jump();
 
     srcNotInt.link(this);
-    addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+    addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
 
-    xor32(Imm32(1 << 31), regT1);
+    xor32(TrustedImm32(1 << 31), regT1);
     store32(regT1, tagFor(dst));
     if (dst != src)
         store32(regT0, payloadFor(dst));
@@ -96,7 +96,7 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
     // Character less.
     if (isOperandConstantImmediateChar(op1)) {
         emitLoad(op2, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
         JumpList failures;
         emitLoadCharacterString(regT0, regT0, failures);
         addSlowCase(failures);
@@ -105,7 +105,7 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
     }
     if (isOperandConstantImmediateChar(op2)) {
         emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
         JumpList failures;
         emitLoadCharacterString(regT0, regT0, failures);
         addSlowCase(failures);
@@ -115,16 +115,16 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         // Int32 less.
         emitLoad(op2, regT3, regT2);
-        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(LessThanOrEqual, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
-        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(GreaterThanOrEqual, regT0, regT2), target);
     }
 
@@ -185,7 +185,7 @@ void JIT::emit_op_jless(Instruction* currentInstruction)
     // Character less.
     if (isOperandConstantImmediateChar(op1)) {
         emitLoad(op2, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
         JumpList failures;
         emitLoadCharacterString(regT0, regT0, failures);
         addSlowCase(failures);
@@ -194,7 +194,7 @@ void JIT::emit_op_jless(Instruction* currentInstruction)
     }
     if (isOperandConstantImmediateChar(op2)) {
         emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
         JumpList failures;
         emitLoadCharacterString(regT0, regT0, failures);
         addSlowCase(failures);
@@ -203,16 +203,16 @@ void JIT::emit_op_jless(Instruction* currentInstruction)
     } 
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT3, regT2);
-        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(GreaterThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
-        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(LessThan, regT0, regT2), target);
     }
 
@@ -272,7 +272,7 @@ void JIT::emit_op_jlesseq(Instruction* currentInstruction, bool invert)
     // Character less.
     if (isOperandConstantImmediateChar(op1)) {
         emitLoad(op2, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
         JumpList failures;
         emitLoadCharacterString(regT0, regT0, failures);
         addSlowCase(failures);
@@ -281,7 +281,7 @@ void JIT::emit_op_jlesseq(Instruction* currentInstruction, bool invert)
     }
     if (isOperandConstantImmediateChar(op2)) {
         emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
         JumpList failures;
         emitLoadCharacterString(regT0, regT0, failures);
         addSlowCase(failures);
@@ -290,16 +290,16 @@ void JIT::emit_op_jlesseq(Instruction* currentInstruction, bool invert)
     }
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT3, regT2);
-        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(invert ? LessThan : GreaterThanOrEqual, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
-        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(invert ? GreaterThan : LessThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-        notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(invert ? GreaterThan : LessThanOrEqual, regT0, regT2), target);
     }
 
@@ -368,7 +368,7 @@ void JIT::emit_op_lshift(Instruction* currentInstruction)
 
     if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         lshift32(Imm32(getConstantOperand(op2).asInt32()), regT0);
         emitStoreInt32(dst, regT0, dst == op1);
         return;
@@ -376,8 +376,8 @@ void JIT::emit_op_lshift(Instruction* currentInstruction)
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
     if (!isOperandConstantImmediateInt(op1))
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     lshift32(regT2, regT0);
     emitStoreInt32(dst, regT0, dst == op1 || dst == op2);
 }
@@ -410,7 +410,7 @@ void JIT::emitRightShift(Instruction* currentInstruction, bool isUnsigned)
     // shift arguments, so any changes must be updated there as well.
     if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         int shift = getConstantOperand(op2).asInt32();
         if (isUnsigned) {
             if (shift)
@@ -419,7 +419,7 @@ void JIT::emitRightShift(Instruction* currentInstruction, bool isUnsigned)
             // a toUint conversion, which can result in a value we can represent
             // as an immediate int.
             if (shift < 0 || !(shift & 31))
-                addSlowCase(branch32(LessThan, regT0, Imm32(0)));
+                addSlowCase(branch32(LessThan, regT0, TrustedImm32(0)));
         } else if (shift) { // signed right shift by zero is simply toInt conversion
             rshift32(Imm32(shift & 0x1f), regT0);
         }
@@ -429,11 +429,11 @@ void JIT::emitRightShift(Instruction* currentInstruction, bool isUnsigned)
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
     if (!isOperandConstantImmediateInt(op1))
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     if (isUnsigned) {
         urshift32(regT2, regT0);
-        addSlowCase(branch32(LessThan, regT0, Imm32(0)));
+        addSlowCase(branch32(LessThan, regT0, TrustedImm32(0)));
     } else
         rshift32(regT2, regT0);
     emitStoreInt32(dst, regT0, dst == op1 || dst == op2);
@@ -450,14 +450,14 @@ void JIT::emitRightShiftSlowCase(Instruction* currentInstruction, Vector<SlowCas
         linkSlowCase(iter); // int32 check
         if (supportsFloatingPointTruncate()) {
             JumpList failures;
-            failures.append(branch32(AboveOrEqual, regT1, Imm32(JSValue::LowestTag)));
+            failures.append(branch32(AboveOrEqual, regT1, TrustedImm32(JSValue::LowestTag)));
             emitLoadDouble(op1, fpRegT0);
             failures.append(branchTruncateDoubleToInt32(fpRegT0, regT0));
             if (isUnsigned) {
                 if (shift)
                     urshift32(Imm32(shift & 0x1f), regT0);
                 if (shift < 0 || !(shift & 31))
-                    failures.append(branch32(LessThan, regT0, Imm32(0)));
+                    failures.append(branch32(LessThan, regT0, TrustedImm32(0)));
             } else if (shift)
                 rshift32(Imm32(shift & 0x1f), regT0);
             emitStoreInt32(dst, regT0, false);
@@ -472,9 +472,9 @@ void JIT::emitRightShiftSlowCase(Instruction* currentInstruction, Vector<SlowCas
         if (!isOperandConstantImmediateInt(op1)) {
             linkSlowCase(iter); // int32 check -- op1 is not an int
             if (supportsFloatingPointTruncate()) {
-                Jump notDouble = branch32(Above, regT1, Imm32(JSValue::LowestTag)); // op1 is not a double
+                Jump notDouble = branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)); // op1 is not a double
                 emitLoadDouble(op1, fpRegT0);
-                Jump notInt = branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)); // op2 is not an int
+                Jump notInt = branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)); // op2 is not an int
                 Jump cantTruncate = branchTruncateDoubleToInt32(fpRegT0, regT0);
                 if (isUnsigned)
                     urshift32(regT2, regT0);
@@ -535,15 +535,15 @@ void JIT::emit_op_bitand(Instruction* currentInstruction)
     int32_t constant;
     if (getOperandConstantImmediateInt(op1, op2, op, constant)) {
         emitLoad(op, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         and32(Imm32(constant), regT0);
         emitStoreInt32(dst, regT0, (op == dst));
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     and32(regT2, regT0);
     emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
 }
@@ -576,15 +576,15 @@ void JIT::emit_op_bitor(Instruction* currentInstruction)
     int32_t constant;
     if (getOperandConstantImmediateInt(op1, op2, op, constant)) {
         emitLoad(op, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         or32(Imm32(constant), regT0);
         emitStoreInt32(dst, regT0, (op == dst));
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     or32(regT2, regT0);
     emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
 }
@@ -617,15 +617,15 @@ void JIT::emit_op_bitxor(Instruction* currentInstruction)
     int32_t constant;
     if (getOperandConstantImmediateInt(op1, op2, op, constant)) {
         emitLoad(op, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         xor32(Imm32(constant), regT0);
         emitStoreInt32(dst, regT0, (op == dst));
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     xor32(regT2, regT0);
     emitStoreInt32(dst, regT0, (op1 == dst || op2 == dst));
 }
@@ -654,7 +654,7 @@ void JIT::emit_op_bitnot(Instruction* currentInstruction)
     unsigned src = currentInstruction[2].u.operand;
 
     emitLoad(src, regT1, regT0);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
 
     not32(regT0);
     emitStoreInt32(dst, regT0, (dst == src));
@@ -679,14 +679,14 @@ void JIT::emit_op_post_inc(Instruction* currentInstruction)
     unsigned srcDst = currentInstruction[2].u.operand;
 
     emitLoad(srcDst, regT1, regT0);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
 
     if (dst == srcDst) // x = x++ is a noop for ints.
         return;
 
     emitStoreInt32(dst, regT0);
 
-    addSlowCase(branchAdd32(Overflow, Imm32(1), regT0));
+    addSlowCase(branchAdd32(Overflow, TrustedImm32(1), regT0));
     emitStoreInt32(srcDst, regT0, true);
 }
 
@@ -713,14 +713,14 @@ void JIT::emit_op_post_dec(Instruction* currentInstruction)
     unsigned srcDst = currentInstruction[2].u.operand;
 
     emitLoad(srcDst, regT1, regT0);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
 
     if (dst == srcDst) // x = x-- is a noop for ints.
         return;
 
     emitStoreInt32(dst, regT0);
 
-    addSlowCase(branchSub32(Overflow, Imm32(1), regT0));
+    addSlowCase(branchSub32(Overflow, TrustedImm32(1), regT0));
     emitStoreInt32(srcDst, regT0, true);
 }
 
@@ -735,7 +735,7 @@ void JIT::emitSlow_op_post_dec(Instruction* currentInstruction, Vector<SlowCaseE
 
     JITStubCall stubCall(this, cti_op_post_dec);
     stubCall.addArgument(srcDst);
-    stubCall.addArgument(Imm32(srcDst));
+    stubCall.addArgument(TrustedImm32(srcDst));
     stubCall.call(dst);
 }
 
@@ -747,8 +747,8 @@ void JIT::emit_op_pre_inc(Instruction* currentInstruction)
 
     emitLoad(srcDst, regT1, regT0);
 
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branchAdd32(Overflow, Imm32(1), regT0));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branchAdd32(Overflow, TrustedImm32(1), regT0));
     emitStoreInt32(srcDst, regT0, true);
 }
 
@@ -772,8 +772,8 @@ void JIT::emit_op_pre_dec(Instruction* currentInstruction)
 
     emitLoad(srcDst, regT1, regT0);
 
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branchSub32(Overflow, Imm32(1), regT0));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branchSub32(Overflow, TrustedImm32(1), regT0));
     emitStoreInt32(srcDst, regT0, true);
 }
 
@@ -817,8 +817,8 @@ void JIT::emit_op_add(Instruction* currentInstruction)
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
     // Int32 case.
     addSlowCase(branchAdd32(Overflow, regT2, regT0));
@@ -840,7 +840,7 @@ void JIT::emitAdd32Constant(unsigned dst, unsigned op, int32_t constant, ResultT
 {
     // Int32 case.
     emitLoad(op, regT1, regT0);
-    Jump notInt32 = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
+    Jump notInt32 = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
     addSlowCase(branchAdd32(Overflow, Imm32(constant), regT0));
     emitStoreInt32(dst, regT0, (op == dst));
 
@@ -853,7 +853,7 @@ void JIT::emitAdd32Constant(unsigned dst, unsigned op, int32_t constant, ResultT
 
     notInt32.link(this);
     if (!opType.definitelyIsNumber())
-        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+        addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
     move(Imm32(constant), regT2);
     convertInt32ToDouble(regT2, fpRegT0);
     emitLoadDouble(op, fpRegT1);
@@ -926,8 +926,8 @@ void JIT::emit_op_sub(Instruction* currentInstruction)
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
     // Int32 case.
     addSlowCase(branchSub32(Overflow, regT2, regT0));
@@ -949,7 +949,7 @@ void JIT::emitSub32Constant(unsigned dst, unsigned op, int32_t constant, ResultT
 {
     // Int32 case.
     emitLoad(op, regT1, regT0);
-    Jump notInt32 = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
+    Jump notInt32 = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
     addSlowCase(branchSub32(Overflow, Imm32(constant), regT0));
     emitStoreInt32(dst, regT0, (op == dst));
 
@@ -962,7 +962,7 @@ void JIT::emitSub32Constant(unsigned dst, unsigned op, int32_t constant, ResultT
 
     notInt32.link(this);
     if (!opType.definitelyIsNumber())
-        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+        addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
     move(Imm32(constant), regT2);
     convertInt32ToDouble(regT2, fpRegT0);
     emitLoadDouble(op, fpRegT1);
@@ -1019,15 +1019,15 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
 
         // Verify Op1 is double.
         if (!types.first().definitelyIsNumber())
-            addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
+            addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
 
         if (!op2IsInRegisters)
             emitLoad(op2, regT3, regT2);
 
-        Jump doubleOp2 = branch32(Below, regT3, Imm32(JSValue::LowestTag));
+        Jump doubleOp2 = branch32(Below, regT3, TrustedImm32(JSValue::LowestTag));
 
         if (!types.second().definitelyIsNumber())
-            addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+            addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
         convertInt32ToDouble(regT2, fpRegT0);
         Jump doTheMath = jump();
@@ -1096,7 +1096,7 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
 
         // Verify op2 is double.
         if (!types.second().definitelyIsNumber())
-            addSlowCase(branch32(Above, regT3, Imm32(JSValue::LowestTag)));
+            addSlowCase(branch32(Above, regT3, TrustedImm32(JSValue::LowestTag)));
 
         // Do the math.
         switch (opcodeID) {
@@ -1157,8 +1157,8 @@ void JIT::emit_op_mul(Instruction* currentInstruction)
     JumpList notInt32Op2;
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
     // Int32 case.
     move(regT0, regT3);
@@ -1189,7 +1189,7 @@ void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>
     linkSlowCase(iter); // zero result check
 
     Jump negZero = branchOr32(Signed, regT2, regT3);
-    emitStoreInt32(dst, Imm32(0), (op1 == dst || op2 == dst));
+    emitStoreInt32(dst, TrustedImm32(0), (op1 == dst || op2 == dst));
 
     emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_mul));
 
@@ -1240,8 +1240,8 @@ void JIT::emit_op_div(Instruction* currentInstruction)
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
 
-    notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
     convertInt32ToDouble(regT0, fpRegT0);
     convertInt32ToDouble(regT2, fpRegT1);
@@ -1312,16 +1312,16 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op2) && getConstantOperand(op2).asInt32() != 0) {
         emitLoad(op1, regT1, regT0);
         move(Imm32(getConstantOperand(op2).asInt32()), regT2);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         if (getConstantOperand(op2).asInt32() == -1)
-            addSlowCase(branch32(Equal, regT0, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
+            addSlowCase(branch32(Equal, regT0, TrustedImm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
-        addSlowCase(branch32(Equal, regT0, Imm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
-        addSlowCase(branch32(Equal, regT2, Imm32(0))); // divide by 0
+        addSlowCase(branch32(Equal, regT0, TrustedImm32(0x80000000))); // -2147483648 / -1 => EXC_ARITHMETIC
+        addSlowCase(branch32(Equal, regT2, TrustedImm32(0))); // divide by 0
     }
 
     move(regT0, regT3); // Save dividend payload, in case of 0.
@@ -1335,7 +1335,7 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
 
     // If the remainder is zero and the dividend is negative, the result is -0.
     Jump storeResult1 = branchTest32(NonZero, regT1);
-    Jump storeResult2 = branchTest32(Zero, regT3, Imm32(0x80000000)); // not negative
+    Jump storeResult2 = branchTest32(Zero, regT3, TrustedImm32(0x80000000)); // not negative
     emitStore(dst, jsNumber(-0.0));
     Jump end = jump();
 
@@ -1378,10 +1378,10 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
 
 #if ENABLE(JIT_USE_SOFT_MODULO)
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
 
-    addSlowCase(branch32(Equal, regT2, Imm32(0)));
+    addSlowCase(branch32(Equal, regT2, TrustedImm32(0)));
 
     emitNakedCall(m_globalData->jitStubs->ctiSoftModulo());
 
diff --git a/Source/JavaScriptCore/jit/JITCall.cpp b/Source/JavaScriptCore/jit/JITCall.cpp
index fdd0d47..77c2a69 100644
--- a/Source/JavaScriptCore/jit/JITCall.cpp
+++ b/Source/JavaScriptCore/jit/JITCall.cpp
@@ -48,10 +48,11 @@ namespace JSC {
 
 void JIT::compileOpCallInitializeCallFrame()
 {
-    store32(regT1, Address(callFrameRegister, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT3); // newScopeChain
-    storePtr(regT0, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register))));
-    storePtr(regT3, Address(callFrameRegister, RegisterFile::ScopeChain * static_cast<int>(sizeof(Register))));
+    // regT0 holds callee, regT1 holds argCount
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT3); // scopeChain
+    emitPutIntToCallFrameHeader(regT1, RegisterFile::ArgumentCount);
+    emitPutCellToCallFrameHeader(regT0, RegisterFile::Callee);
+    emitPutCellToCallFrameHeader(regT3, RegisterFile::ScopeChain);
 }
 
 void JIT::emit_op_call_put_result(Instruction* instruction)
@@ -67,15 +68,16 @@ void JIT::compileOpCallVarargs(Instruction* instruction)
     int registerOffset = instruction[3].u.operand;
 
     emitGetVirtualRegister(argCountRegister, regT1);
+    emitFastArithImmToInt(regT1);
     emitGetVirtualRegister(callee, regT0);
     addPtr(Imm32(registerOffset), regT1, regT2);
 
     // Check for JSFunctions.
     emitJumpSlowCaseIfNotJSCell(regT0);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsFunctionVPtr)));
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
-    mul32(Imm32(sizeof(Register)), regT2, regT2);
+    mul32(TrustedImm32(sizeof(Register)), regT2, regT2);
     intptr_t offset = (intptr_t)sizeof(Register) * (intptr_t)RegisterFile::CallerFrame;
     addPtr(Imm32((int32_t)offset), regT2, regT3);
     addPtr(callFrameRegister, regT3);
@@ -118,14 +120,14 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
+        wasEval = branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(JSValue())));
     }
 
     emitGetVirtualRegister(callee, regT0);
 
     // Check for JSFunctions.
     emitJumpSlowCaseIfNotJSCell(regT0);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsFunctionVPtr)));
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
     storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
@@ -175,7 +177,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
+        wasEval = branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(JSValue())));
     }
 
     // This plants a check for a cached JSFunction value, so we can plant a fast link to the callee.
@@ -185,7 +187,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
 
     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
 
-    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, ImmPtr(JSValue::encode(JSValue())));
+    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, TrustedImmPtr(JSValue::encode(JSValue())));
 
     END_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
 
@@ -198,9 +200,10 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     // Fast version of stack frame initialization, directly relative to edi.
     // Note that this omits to set up RegisterFile::CodeBlock, which is set in the callee
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // newScopeChain
-
-    store32(Imm32(argCount), Address(callFrameRegister, (registerOffset + RegisterFile::ArgumentCount) * static_cast<int>(sizeof(Register))));
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT1); // newScopeChain
+    
+    store32(TrustedImm32(Int32Tag), intTagFor(registerOffset + RegisterFile::ArgumentCount));
+    store32(Imm32(argCount), intPayloadFor(registerOffset + RegisterFile::ArgumentCount));
     storePtr(callFrameRegister, Address(callFrameRegister, (registerOffset + RegisterFile::CallerFrame) * static_cast<int>(sizeof(Register))));
     storePtr(regT0, Address(callFrameRegister, (registerOffset + RegisterFile::Callee) * static_cast<int>(sizeof(Register))));
     storePtr(regT1, Address(callFrameRegister, (registerOffset + RegisterFile::ScopeChain) * static_cast<int>(sizeof(Register))));
@@ -224,7 +227,7 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
 
     // Fast check for JS function.
     Jump callLinkFailNotObject = emitJumpIfNotJSCell(regT0);
-    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr));
+    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsFunctionVPtr));
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
     storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
diff --git a/Source/JavaScriptCore/jit/JITCall32_64.cpp b/Source/JavaScriptCore/jit/JITCall32_64.cpp
index daf5d2d..9ffa495 100644
--- a/Source/JavaScriptCore/jit/JITCall32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITCall32_64.cpp
@@ -49,10 +49,10 @@ namespace JSC {
 void JIT::compileOpCallInitializeCallFrame()
 {
     // regT0 holds callee, regT1 holds argCount
-    store32(regT1, Address(callFrameRegister, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT3); // scopeChain
-    storePtr(regT0, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register)))); // callee
-    storePtr(regT3, Address(callFrameRegister, RegisterFile::ScopeChain * static_cast<int>(sizeof(Register)))); // scopeChain
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT3); // scopeChain
+    emitPutIntToCallFrameHeader(regT1, RegisterFile::ArgumentCount);
+    emitPutCellToCallFrameHeader(regT0, RegisterFile::Callee);
+    emitPutCellToCallFrameHeader(regT3, RegisterFile::ScopeChain);
 }
 
 void JIT::emit_op_call_put_result(Instruction* instruction)
@@ -72,12 +72,13 @@ void JIT::compileOpCallVarargs(Instruction* instruction)
     addPtr(Imm32(registerOffset), regT2, regT3); // registerOffset
 
     emitJumpSlowCaseIfNotJSCell(callee, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsFunctionVPtr)));
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
-    mul32(Imm32(sizeof(Register)), regT3, regT3);
+    mul32(TrustedImm32(sizeof(Register)), regT3, regT3);
     addPtr(callFrameRegister, regT3);
-    storePtr(callFrameRegister, Address(regT3, RegisterFile::CallerFrame * static_cast<int>(sizeof(Register))));
+    store32(TrustedImm32(JSValue::CellTag), tagFor(RegisterFile::CallerFrame, regT3));
+    storePtr(callFrameRegister, payloadFor(RegisterFile::CallerFrame, regT3));
     move(regT3, callFrameRegister);
 
     move(regT2, regT1); // argCount
@@ -107,12 +108,6 @@ void JIT::emit_op_ret(Instruction* currentInstruction)
 {
     unsigned dst = currentInstruction[1].u.operand;
 
-    // We could JIT generate the deref, only calling out to C when the refcount hits zero.
-    if (m_codeBlock->needsFullScopeChain()) {
-        Jump activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), Imm32(JSValue::EmptyValueTag));
-        JITStubCall(this, cti_op_ret_scopeChain).call();
-        activationNotCreated.link(this);
-    }
     emitLoad(dst, regT1, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
@@ -126,17 +121,10 @@ void JIT::emit_op_ret_object_or_this(Instruction* currentInstruction)
     unsigned result = currentInstruction[1].u.operand;
     unsigned thisReg = currentInstruction[2].u.operand;
 
-    // We could JIT generate the deref, only calling out to C when the refcount hits zero.
-    if (m_codeBlock->needsFullScopeChain()) {
-        Jump activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), Imm32(JSValue::EmptyValueTag));
-        JITStubCall(this, cti_op_ret_scopeChain).call();
-        activationNotCreated.link(this);
-    }
-
     emitLoad(result, regT1, regT0);
-    Jump notJSCell = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    Jump notObject = branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType));
+    Jump notJSCell = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    Jump notObject = branch8(NotEqual, Address(regT2, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType));
 
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
@@ -212,18 +200,19 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
+        wasEval = branch32(NotEqual, regT1, TrustedImm32(JSValue::EmptyValueTag));
     }
 
     emitLoad(callee, regT1, regT0);
 
     emitJumpSlowCaseIfNotJSCell(callee, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsFunctionVPtr)));
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
-    storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
+    store32(TrustedImm32(JSValue::CellTag), tagFor(RegisterFile::CallerFrame + registerOffset, callFrameRegister));
+    storePtr(callFrameRegister, payloadFor(RegisterFile::CallerFrame + registerOffset, callFrameRegister));
     addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
-    move(Imm32(argCount), regT1);
+    move(TrustedImm32(argCount), regT1);
 
     emitNakedCall(opcodeID == op_construct ? m_globalData->jitStubs->ctiVirtualConstruct() : m_globalData->jitStubs->ctiVirtualCall());
 
@@ -268,7 +257,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
         stubCall.addArgument(JIT::Imm32(registerOffset));
         stubCall.addArgument(JIT::Imm32(argCount));
         stubCall.call();
-        wasEval = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
+        wasEval = branch32(NotEqual, regT1, TrustedImm32(JSValue::EmptyValueTag));
     }
 
     emitLoad(callee, regT1, regT0);
@@ -277,26 +266,28 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
 
     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
 
-    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, ImmPtr(0));
+    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, TrustedImmPtr(0));
 
     END_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
 
     addSlowCase(jumpToSlow);
-    ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
+    ASSERT_JIT_OFFSET(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow), patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
 
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
 
     // The following is the fast case, only used whan a callee can be linked.
 
     // Fast version of stack frame initialization, directly relative to edi.
     // Note that this omits to set up RegisterFile::CodeBlock, which is set in the callee
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT2);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT2);
 
-    store32(Imm32(argCount), Address(callFrameRegister, (registerOffset + RegisterFile::ArgumentCount) * static_cast<int>(sizeof(Register))));
-    storePtr(callFrameRegister, Address(callFrameRegister, (registerOffset + RegisterFile::CallerFrame) * static_cast<int>(sizeof(Register))));
+    store32(TrustedImm32(JSValue::Int32Tag), tagFor(registerOffset + RegisterFile::ArgumentCount));
+    store32(Imm32(argCount), payloadFor(registerOffset + RegisterFile::ArgumentCount));
+    storePtr(callFrameRegister, payloadFor(RegisterFile::CallerFrame + registerOffset, callFrameRegister));
     emitStore(registerOffset + RegisterFile::Callee, regT1, regT0);
-    storePtr(regT2, Address(callFrameRegister, (registerOffset + RegisterFile::ScopeChain) * static_cast<int>(sizeof(Register))));
+    store32(TrustedImm32(JSValue::CellTag), tagFor(registerOffset + RegisterFile::ScopeChain));
+    store32(regT2, payloadFor(registerOffset + RegisterFile::ScopeChain));
     addPtr(Imm32(registerOffset * sizeof(Register)), callFrameRegister);
 
     // Call to the callee
@@ -318,11 +309,12 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
     linkSlowCase(iter);
 
     // Fast check for JS function.
-    Jump callLinkFailNotObject = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
-    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsFunctionVPtr));
+    Jump callLinkFailNotObject = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsFunctionVPtr));
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
-    storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
+    store32(TrustedImm32(JSValue::CellTag), tagFor(RegisterFile::CallerFrame + registerOffset, callFrameRegister));
+    storePtr(callFrameRegister, payloadFor(RegisterFile::CallerFrame + registerOffset, callFrameRegister));
     addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
     move(Imm32(argCount), regT1);
 
diff --git a/Source/JavaScriptCore/jit/JITInlineMethods.h b/Source/JavaScriptCore/jit/JITInlineMethods.h
index 39ca4a5..dabfdd2 100644
--- a/Source/JavaScriptCore/jit/JITInlineMethods.h
+++ b/Source/JavaScriptCore/jit/JITInlineMethods.h
@@ -52,12 +52,26 @@ ALWAYS_INLINE JSValue JIT::getConstantOperand(unsigned src)
 
 ALWAYS_INLINE void JIT::emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry)
 {
-    storePtr(from, Address(callFrameRegister, entry * sizeof(Register)));
+    storePtr(from, payloadFor(entry, callFrameRegister));
+}
+
+ALWAYS_INLINE void JIT::emitPutCellToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry)
+{
+#if USE(JSVALUE32_64)
+    store32(TrustedImm32(JSValue::CellTag), tagFor(entry, callFrameRegister));
+#endif
+    storePtr(from, payloadFor(entry, callFrameRegister));
+}
+
+ALWAYS_INLINE void JIT::emitPutIntToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry)
+{
+    store32(TrustedImm32(Int32Tag), intTagFor(entry, callFrameRegister));
+    store32(from, intPayloadFor(entry, callFrameRegister));
 }
 
 ALWAYS_INLINE void JIT::emitPutImmediateToCallFrameHeader(void* value, RegisterFile::CallFrameHeaderEntry entry)
 {
-    storePtr(ImmPtr(value), Address(callFrameRegister, entry * sizeof(Register)));
+    storePtr(TrustedImmPtr(value), Address(callFrameRegister, entry * sizeof(Register)));
 }
 
 ALWAYS_INLINE void JIT::emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
@@ -70,9 +84,9 @@ ALWAYS_INLINE void JIT::emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHea
 
 ALWAYS_INLINE void JIT::emitLoadCharacterString(RegisterID src, RegisterID dst, JumpList& failures)
 {
-    failures.append(branchPtr(NotEqual, Address(src), ImmPtr(m_globalData->jsStringVPtr)));
+    failures.append(branchPtr(NotEqual, Address(src), TrustedImmPtr(m_globalData->jsStringVPtr)));
     failures.append(branchTest32(NonZero, Address(src, OBJECT_OFFSETOF(JSString, m_fiberCount))));
-    failures.append(branch32(NotEqual, MacroAssembler::Address(src, ThunkHelpers::jsStringLengthOffset()), Imm32(1)));
+    failures.append(branch32(NotEqual, MacroAssembler::Address(src, ThunkHelpers::jsStringLengthOffset()), TrustedImm32(1)));
     loadPtr(MacroAssembler::Address(src, ThunkHelpers::jsStringValueOffset()), dst);
     loadPtr(MacroAssembler::Address(dst, ThunkHelpers::stringImplDataOffset()), dst);
     load16(MacroAssembler::Address(dst, 0), dst);
@@ -109,6 +123,13 @@ ALWAYS_INLINE void JIT::beginUninterruptedSequence(int insnSpace, int constSpace
 
     ensureSpace(insnSpace, constSpace);
 
+#elif CPU(SH4)
+#ifndef NDEBUG
+    insnSpace += sizeof(SH4Word);
+    constSpace += sizeof(uint64_t);
+#endif
+
+    m_assembler.ensureSpace(insnSpace + m_assembler.maxInstructionSize + 2, constSpace + 8);
 #endif
 
 #if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
@@ -119,8 +140,9 @@ ALWAYS_INLINE void JIT::beginUninterruptedSequence(int insnSpace, int constSpace
 #endif
 }
 
-ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace)
+ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace, int dst)
 {
+    UNUSED_PARAM(dst);
 #if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
     /* There are several cases when the uninterrupted sequence is larger than
      * maximum required offset for pathing the same sequence. Eg.: if in a
@@ -129,6 +151,15 @@ ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace)
      * calculation of length of uninterrupted sequence. So, the insnSpace and
      * constSpace should be upper limit instead of hard limit.
      */
+#if CPU(SH4)
+    if ((dst > 15) || (dst < -16)) {
+        insnSpace += 8;
+        constSpace += 2;
+    }
+
+    if (((dst >= -16) && (dst < 0)) || ((dst > 7) && (dst <= 15)))
+        insnSpace += 8;
+#endif
     ASSERT(differenceBetween(m_uninterruptedInstructionSequenceBegin, label()) <= insnSpace);
     ASSERT(sizeOfConstantPool() - m_uninterruptedConstantSequenceBegin <= constSpace);
 #endif
@@ -153,6 +184,22 @@ ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
 {
     loadPtr(address, linkRegister);
 }
+#elif CPU(SH4)
+
+ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
+{
+    m_assembler.stspr(reg);
+}
+
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(RegisterID reg)
+{
+    m_assembler.ldspr(reg);
+}
+
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
+{
+    loadPtrLinkReg(address);
+}
 
 #elif CPU(MIPS)
 
@@ -200,16 +247,18 @@ ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 {
 #if CPU(X86)
     // Within a trampoline the return address will be on the stack at this point.
-    addPtr(Imm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
+    addPtr(TrustedImm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
 #elif CPU(ARM)
     move(stackPointerRegister, firstArgumentRegister);
+#elif CPU(SH4)
+    move(stackPointerRegister, firstArgumentRegister);
 #endif
     // In the trampoline on x86-64, the first argument register is not overwritten.
 }
 
 ALWAYS_INLINE JIT::Jump JIT::checkStructure(RegisterID reg, Structure* structure)
 {
-    return branchPtr(NotEqual, Address(reg, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(structure));
+    return branchPtr(NotEqual, Address(reg, JSCell::structureOffset()), TrustedImmPtr(structure));
 }
 
 ALWAYS_INLINE void JIT::linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator& iter, int vReg)
@@ -254,14 +303,14 @@ ALWAYS_INLINE void JIT::setSamplingFlag(int32_t flag)
 {
     ASSERT(flag >= 1);
     ASSERT(flag <= 32);
-    or32(Imm32(1u << (flag - 1)), AbsoluteAddress(&SamplingFlags::s_flags));
+    or32(TrustedImm32(1u << (flag - 1)), AbsoluteAddress(&SamplingFlags::s_flags));
 }
 
 ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
 {
     ASSERT(flag >= 1);
     ASSERT(flag <= 32);
-    and32(Imm32(~(1u << (flag - 1))), AbsoluteAddress(&SamplingFlags::s_flags));
+    and32(TrustedImm32(~(1u << (flag - 1))), AbsoluteAddress(&SamplingFlags::s_flags));
 }
 #endif
 
@@ -269,11 +318,11 @@ ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
 ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t count)
 {
 #if CPU(X86_64) // Or any other 64-bit plattform.
-    addPtr(Imm32(count), AbsoluteAddress(&counter.m_counter));
+    addPtr(TrustedImm32(count), AbsoluteAddress(counter.addressOfCounter()));
 #elif CPU(X86) // Or any other little-endian 32-bit plattform.
-    intptr_t hiWord = reinterpret_cast<intptr_t>(&counter.m_counter) + sizeof(int32_t);
-    add32(Imm32(count), AbsoluteAddress(&counter.m_counter));
-    addWithCarry32(Imm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
+    intptr_t hiWord = reinterpret_cast<intptr_t>(counter.addressOfCounter()) + sizeof(int32_t);
+    add32(TrustedImm32(count), AbsoluteAddress(counter.addressOfCounter()));
+    addWithCarry32(TrustedImm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
 #else
 #error "SAMPLING_FLAGS not implemented on this platform."
 #endif
@@ -284,13 +333,13 @@ ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t cou
 #if CPU(X86_64)
 ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
 {
-    move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86Registers::ecx);
-    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86Registers::ecx);
+    move(TrustedImmPtr(m_interpreter->sampler()->sampleSlot()), X86Registers::ecx);
+    storePtr(TrustedImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86Registers::ecx);
 }
 #else
 ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
 {
-    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), m_interpreter->sampler()->sampleSlot());
+    storePtr(TrustedImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), m_interpreter->sampler()->sampleSlot());
 }
 #endif
 #endif
@@ -299,13 +348,13 @@ ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostF
 #if CPU(X86_64)
 ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
 {
-    move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86Registers::ecx);
-    storePtr(ImmPtr(codeBlock), X86Registers::ecx);
+    move(TrustedImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86Registers::ecx);
+    storePtr(TrustedImmPtr(codeBlock), X86Registers::ecx);
 }
 #else
 ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
 {
-    storePtr(ImmPtr(codeBlock), m_interpreter->sampler()->codeBlockSlot());
+    storePtr(TrustedImmPtr(codeBlock), m_interpreter->sampler()->codeBlockSlot());
 }
 #endif
 #endif
@@ -396,7 +445,7 @@ inline void JIT::emitLoad2(unsigned index1, RegisterID tag1, RegisterID payload1
 inline void JIT::emitLoadDouble(unsigned index, FPRegisterID value)
 {
     if (m_codeBlock->isConstantRegisterIndex(index)) {
-        Register& inConstantPool = m_codeBlock->constantRegister(index);
+        WriteBarrier<Unknown>& inConstantPool = m_codeBlock->constantRegister(index);
         loadDouble(&inConstantPool, value);
     } else
         loadDouble(addressFor(index), value);
@@ -405,7 +454,7 @@ inline void JIT::emitLoadDouble(unsigned index, FPRegisterID value)
 inline void JIT::emitLoadInt32ToDouble(unsigned index, FPRegisterID value)
 {
     if (m_codeBlock->isConstantRegisterIndex(index)) {
-        Register& inConstantPool = m_codeBlock->constantRegister(index);
+        WriteBarrier<Unknown>& inConstantPool = m_codeBlock->constantRegister(index);
         char* bytePointer = reinterpret_cast<char*>(&inConstantPool);
         convertInt32ToDouble(AbsoluteAddress(bytePointer + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), value);
     } else
@@ -422,28 +471,28 @@ inline void JIT::emitStoreInt32(unsigned index, RegisterID payload, bool indexIs
 {
     store32(payload, payloadFor(index, callFrameRegister));
     if (!indexIsInt32)
-        store32(Imm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
+        store32(TrustedImm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
 }
 
-inline void JIT::emitStoreInt32(unsigned index, Imm32 payload, bool indexIsInt32)
+inline void JIT::emitStoreInt32(unsigned index, TrustedImm32 payload, bool indexIsInt32)
 {
     store32(payload, payloadFor(index, callFrameRegister));
     if (!indexIsInt32)
-        store32(Imm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
+        store32(TrustedImm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
 }
 
 inline void JIT::emitStoreCell(unsigned index, RegisterID payload, bool indexIsCell)
 {
     store32(payload, payloadFor(index, callFrameRegister));
     if (!indexIsCell)
-        store32(Imm32(JSValue::CellTag), tagFor(index, callFrameRegister));
+        store32(TrustedImm32(JSValue::CellTag), tagFor(index, callFrameRegister));
 }
 
-inline void JIT::emitStoreBool(unsigned index, RegisterID tag, bool indexIsBool)
+inline void JIT::emitStoreBool(unsigned index, RegisterID payload, bool indexIsBool)
 {
+    store32(payload, payloadFor(index, callFrameRegister));
     if (!indexIsBool)
-        store32(Imm32(0), payloadFor(index, callFrameRegister));
-    store32(tag, tagFor(index, callFrameRegister));
+        store32(TrustedImm32(JSValue::BooleanTag), tagFor(index, callFrameRegister));
 }
 
 inline void JIT::emitStoreDouble(unsigned index, FPRegisterID value)
@@ -550,7 +599,7 @@ inline void JIT::emitJumpSlowCaseIfNotJSCell(unsigned virtualRegisterIndex, Regi
         if (m_codeBlock->isConstantRegisterIndex(virtualRegisterIndex))
             addSlowCase(jump());
         else
-            addSlowCase(branch32(NotEqual, tag, Imm32(JSValue::CellTag)));
+            addSlowCase(branch32(NotEqual, tag, TrustedImm32(JSValue::CellTag)));
     }
 }
 
@@ -652,7 +701,7 @@ ALWAYS_INLINE void JIT::emitPutVirtualRegister(unsigned dst, RegisterID from)
 
 ALWAYS_INLINE void JIT::emitInitRegister(unsigned dst)
 {
-    storePtr(ImmPtr(JSValue::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
+    storePtr(TrustedImmPtr(JSValue::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
 }
 
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfJSCell(RegisterID reg)
@@ -660,7 +709,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfJSCell(RegisterID reg)
 #if USE(JSVALUE64)
     return branchTestPtr(Zero, reg, tagMaskRegister);
 #else
-    return branchTest32(Zero, reg, Imm32(JSImmediate::TagMask));
+    return branchTest32(Zero, reg, TrustedImm32(TagMask));
 #endif
 }
 
@@ -681,7 +730,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotJSCell(RegisterID reg)
 #if USE(JSVALUE64)
     return branchTestPtr(NonZero, reg, tagMaskRegister);
 #else
-    return branchTest32(NonZero, reg, Imm32(JSImmediate::TagMask));
+    return branchTest32(NonZero, reg, TrustedImm32(TagMask));
 #endif
 }
 
@@ -701,7 +750,7 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotJSCell(RegisterID reg, int vReg)
 inline void JIT::emitLoadDouble(unsigned index, FPRegisterID value)
 {
     if (m_codeBlock->isConstantRegisterIndex(index)) {
-        Register& inConstantPool = m_codeBlock->constantRegister(index);
+        WriteBarrier<Unknown>& inConstantPool = m_codeBlock->constantRegister(index);
         loadDouble(&inConstantPool, value);
     } else
         loadDouble(addressFor(index), value);
@@ -710,8 +759,8 @@ inline void JIT::emitLoadDouble(unsigned index, FPRegisterID value)
 inline void JIT::emitLoadInt32ToDouble(unsigned index, FPRegisterID value)
 {
     if (m_codeBlock->isConstantRegisterIndex(index)) {
-        Register& inConstantPool = m_codeBlock->constantRegister(index);
-        convertInt32ToDouble(AbsoluteAddress(&inConstantPool), value);
+        ASSERT(isOperandConstantImmediateInt(index));
+        convertInt32ToDouble(Imm32(getConstantOperand(index).asInt32()), value);
     } else
         convertInt32ToDouble(addressFor(index), value);
 }
@@ -722,7 +771,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmediateInteger(RegisterID reg)
 #if USE(JSVALUE64)
     return branchPtr(AboveOrEqual, reg, tagTypeNumberRegister);
 #else
-    return branchTest32(NonZero, reg, Imm32(JSImmediate::TagTypeNumber));
+    return branchTest32(NonZero, reg, TrustedImm32(TagTypeNumber));
 #endif
 }
 
@@ -731,7 +780,7 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateInteger(RegisterID reg)
 #if USE(JSVALUE64)
     return branchPtr(Below, reg, tagTypeNumberRegister);
 #else
-    return branchTest32(Zero, reg, Imm32(JSImmediate::TagTypeNumber));
+    return branchTest32(Zero, reg, TrustedImm32(TagTypeNumber));
 #endif
 }
 
@@ -760,12 +809,12 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateNumber(RegisterID reg)
 #if USE(JSVALUE32_64)
 ALWAYS_INLINE void JIT::emitFastArithDeTagImmediate(RegisterID reg)
 {
-    subPtr(Imm32(JSImmediate::TagTypeNumber), reg);
+    subPtr(TrustedImm32(TagTypeNumber), reg);
 }
 
 ALWAYS_INLINE JIT::Jump JIT::emitFastArithDeTagImmediateJumpIfZero(RegisterID reg)
 {
-    return branchSubPtr(Zero, Imm32(JSImmediate::TagTypeNumber), reg);
+    return branchSubPtr(Zero, TrustedImm32(TagTypeNumber), reg);
 }
 #endif
 
@@ -776,7 +825,7 @@ ALWAYS_INLINE void JIT::emitFastArithReTagImmediate(RegisterID src, RegisterID d
 #else
     if (src != dest)
         move(src, dest);
-    addPtr(Imm32(JSImmediate::TagTypeNumber), dest);
+    addPtr(TrustedImm32(TagTypeNumber), dest);
 #endif
 }
 
@@ -796,8 +845,7 @@ ALWAYS_INLINE void JIT::emitFastArithIntToImmNoCheck(RegisterID src, RegisterID
 
 ALWAYS_INLINE void JIT::emitTagAsBoolImmediate(RegisterID reg)
 {
-    lshift32(Imm32(JSImmediate::ExtendedPayloadShift), reg);
-    or32(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), reg);
+    or32(TrustedImm32(static_cast<int32_t>(ValueFalse)), reg);
 }
 
 #endif // USE(JSVALUE32_64)
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index f458ea2..53bc1df 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -52,12 +52,12 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
     // Check eax is a string
     Jump string_failureCases1 = emitJumpIfNotJSCell(regT0);
-    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
+    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
     load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT0);
 
-    Jump string_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
+    Jump string_failureCases3 = branch32(LessThan, regT0, TrustedImm32(0));
 
     // regT0 contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
     emitFastArithIntToImmNoCheck(regT0, regT0);
@@ -102,7 +102,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
-    Jump hasCodeBlock3 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForCall)), Imm32(0));
+    Jump hasCodeBlock3 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForCall)), TrustedImm32(0));
     preserveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callCompileCall = call();
@@ -122,7 +122,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
-    Jump hasCodeBlock4 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForConstruct)), Imm32(0));
+    Jump hasCodeBlock4 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForConstruct)), TrustedImm32(0));
     preserveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callCompileConstruct = call();
@@ -141,10 +141,10 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
     restoreReturnAddressBeforeReturn(regT1);
-    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    move(TrustedImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
     poke(callFrameRegister, 1 + OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
-    poke(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()));
+    poke(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()));
     ret();
 
     // NativeCall Trampoline
@@ -199,7 +199,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     peek(regT1);
     emitPutToCallFrameHeader(regT1, RegisterFile::ReturnPC);
@@ -208,21 +208,21 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // Host function signature: f(ExecState*);
     move(callFrameRegister, X86Registers::edi);
 
-    subPtr(Imm32(16 - sizeof(void*)), stackPointerRegister); // Align stack after call.
+    subPtr(TrustedImm32(16 - sizeof(void*)), stackPointerRegister); // Align stack after call.
 
     emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::esi);
     loadPtr(Address(X86Registers::esi, OBJECT_OFFSETOF(JSFunction, m_executable)), X86Registers::r9);
     move(regT0, callFrameRegister); // Eagerly restore caller frame register to avoid loading from stack.
     call(Address(X86Registers::r9, executableOffsetToFunction));
 
-    addPtr(Imm32(16 - sizeof(void*)), stackPointerRegister);
+    addPtr(TrustedImm32(16 - sizeof(void*)), stackPointerRegister);
 
 #elif CPU(ARM)
     // Load caller frame's scope chain into this callframe so that whatever we call can
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT2);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     preserveReturnAddressAfterCall(regT3); // Callee preserved
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
@@ -243,7 +243,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     preserveReturnAddressAfterCall(regT3); // Callee preserved
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
@@ -253,7 +253,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
 
     // Allocate stack space for 16 bytes (8-byte aligned)
     // 16 bytes (unused) for 4 arguments
-    subPtr(Imm32(16), stackPointerRegister);
+    subPtr(TrustedImm32(16), stackPointerRegister);
 
     // Setup arg0
     move(callFrameRegister, MIPSRegisters::a0);
@@ -265,7 +265,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     call(Address(regT2, executableOffsetToFunction));
 
     // Restore stack space
-    addPtr(Imm32(16), stackPointerRegister);
+    addPtr(TrustedImm32(16), stackPointerRegister);
 
     restoreReturnAddressBeforeReturn(regT3);
 
@@ -289,12 +289,12 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // Grab the return address.
     preserveReturnAddressAfterCall(regT1);
 
-    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    move(TrustedImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
 
     // Set the return address.
-    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
+    move(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
     restoreReturnAddressBeforeReturn(regT1);
 
     ret();
@@ -330,9 +330,6 @@ void JIT::emit_op_mov(Instruction* currentInstruction)
 
 void JIT::emit_op_end(Instruction* currentInstruction)
 {
-    if (m_codeBlock->needsFullScopeChain())
-        JITStubCall(this, cti_op_end).call();
-
     ASSERT(returnValueRegister != callFrameRegister);
     emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
     restoreReturnAddressBeforeReturn(Address(callFrameRegister, RegisterFile::ReturnPC * static_cast<int>(sizeof(Register))));
@@ -381,8 +378,8 @@ void JIT::emit_op_check_has_instance(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotJSCell(regT0, baseVal);
 
     // Check that baseVal 'ImplementsHasInstance'.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsHasInstance)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT0);
+    addSlowCase(branchTest8(Zero, Address(regT0, Structure::typeInfoFlagsOffset()), TrustedImm32(ImplementsHasInstance)));
 }
 
 void JIT::emit_op_instanceof(Instruction* currentInstruction)
@@ -403,29 +400,29 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotJSCell(regT1, proto);
 
     // Check that prototype is an object
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), regT3);
-    addSlowCase(branch8(NotEqual, Address(regT3, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    loadPtr(Address(regT1, JSCell::structureOffset()), regT3);
+    addSlowCase(branch8(NotEqual, Address(regT3, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType)));
     
     // Fixme: this check is only needed because the JSC API allows HasInstance to be overridden; we should deprecate this.
     // Check that baseVal 'ImplementsDefaultHasInstance'.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT0);
+    addSlowCase(branchTest8(Zero, Address(regT0, Structure::typeInfoFlagsOffset()), TrustedImm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
     // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
-    move(ImmPtr(JSValue::encode(jsBoolean(true))), regT0);
+    move(TrustedImmPtr(JSValue::encode(jsBoolean(true))), regT0);
     Label loop(this);
 
     // Load the prototype of the object in regT2.  If this is equal to regT1 - WIN!
     // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
+    loadPtr(Address(regT2, JSCell::structureOffset()), regT2);
+    loadPtr(Address(regT2, Structure::prototypeOffset()), regT2);
     Jump isInstance = branchPtr(Equal, regT2, regT1);
     emitJumpIfJSCell(regT2).linkTo(loop, this);
 
     // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
-    move(ImmPtr(JSValue::encode(jsBoolean(false))), regT0);
+    move(TrustedImmPtr(JSValue::encode(jsBoolean(false))), regT0);
 
     // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
     isInstance.link(this);
@@ -455,7 +452,7 @@ void JIT::emit_op_construct(Instruction* currentInstruction)
 void JIT::emit_op_get_global_var(Instruction* currentInstruction)
 {
     JSVariableObject* globalObject = m_codeBlock->globalObject();
-    loadPtr(&globalObject->d->registers, regT0);
+    loadPtr(&globalObject->m_registers, regT0);
     loadPtr(Address(regT0, currentInstruction[2].u.operand * sizeof(Register)), regT0);
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
@@ -464,7 +461,7 @@ void JIT::emit_op_put_global_var(Instruction* currentInstruction)
 {
     emitGetVirtualRegister(currentInstruction[2].u.operand, regT1);
     JSVariableObject* globalObject = m_codeBlock->globalObject();
-    loadPtr(&globalObject->d->registers, regT0);
+    loadPtr(&globalObject->m_registers, regT0);
     storePtr(regT1, Address(regT0, currentInstruction[1].u.operand * sizeof(Register)));
 }
 
@@ -486,8 +483,7 @@ void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
         loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, next)), regT0);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, object)), regT0);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSVariableObject, d)), regT0);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), regT0);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSVariableObject, m_registers)), regT0);
     loadPtr(Address(regT0, currentInstruction[2].u.operand * sizeof(Register)), regT0);
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
@@ -511,8 +507,7 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
         loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, next)), regT1);
 
     loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, object)), regT1);
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSVariableObject, d)), regT1);
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), regT1);
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSVariableObject, m_registers)), regT1);
     storePtr(regT0, Address(regT1, currentInstruction[1].u.operand * sizeof(Register)));
 }
 
@@ -543,12 +538,6 @@ void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)
 
 void JIT::emit_op_ret(Instruction* currentInstruction)
 {
-    // We could JIT generate the deref, only calling out to C when the refcount hits zero.
-    if (m_codeBlock->needsFullScopeChain()) {
-        Jump activationNotCreated = branchTestPtr(Zero, addressFor(m_codeBlock->activationRegister()));
-        JITStubCall(this, cti_op_ret_scopeChain).call();
-        activationNotCreated.link(this);
-    }
     ASSERT(callFrameRegister != regT1);
     ASSERT(regT1 != returnValueRegister);
     ASSERT(returnValueRegister != callFrameRegister);
@@ -569,13 +558,6 @@ void JIT::emit_op_ret(Instruction* currentInstruction)
 
 void JIT::emit_op_ret_object_or_this(Instruction* currentInstruction)
 {
-    // We could JIT generate the deref, only calling out to C when the refcount hits zero.
-    if (m_codeBlock->needsFullScopeChain()) {
-        Jump activationNotCreated = branchTestPtr(Zero, addressFor(m_codeBlock->activationRegister()));
-        JITStubCall(this, cti_op_ret_scopeChain).call();
-        activationNotCreated.link(this);
-    }
-
     ASSERT(callFrameRegister != regT1);
     ASSERT(regT1 != returnValueRegister);
     ASSERT(returnValueRegister != callFrameRegister);
@@ -583,8 +565,8 @@ void JIT::emit_op_ret_object_or_this(Instruction* currentInstruction)
     // Return the result in %eax.
     emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
     Jump notJSCell = emitJumpIfNotJSCell(returnValueRegister);
-    loadPtr(Address(returnValueRegister, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    Jump notObject = branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType));
+    loadPtr(Address(returnValueRegister, JSCell::structureOffset()), regT2);
+    Jump notObject = branch8(NotEqual, Address(regT2, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType));
 
     // Grab the return address.
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
@@ -623,7 +605,7 @@ void JIT::emit_op_new_array(Instruction* currentInstruction)
 void JIT::emit_op_resolve(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -635,7 +617,7 @@ void JIT::emit_op_to_primitive(Instruction* currentInstruction)
     emitGetVirtualRegister(src, regT0);
     
     Jump isImm = emitJumpIfNotJSCell(regT0);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr)));
     isImm.link(this);
 
     if (dst != src)
@@ -654,7 +636,7 @@ void JIT::emit_op_strcat(Instruction* currentInstruction)
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, currentInstruction[3].u.operand ? cti_op_resolve_base_strict_put : cti_op_resolve_base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -662,14 +644,14 @@ void JIT::emit_op_ensure_property_exists(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_ensure_property_exists);
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
 void JIT::emit_op_resolve_skip(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_skip);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -683,13 +665,13 @@ void JIT::emit_op_resolve_global(Instruction* currentInstruction, bool)
     void* offsetAddr = &(m_codeBlock->globalResolveInfo(currentIndex).offset);
 
     // Check Structure of global object
-    move(ImmPtr(globalObject), regT0);
+    move(TrustedImmPtr(globalObject), regT0);
     loadPtr(structureAddress, regT1);
-    addSlowCase(branchPtr(NotEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)))); // Structures don't match
+    addSlowCase(branchPtr(NotEqual, regT1, Address(regT0, JSCell::structureOffset()))); // Structures don't match
 
     // Load cached property
     // Assume that the global object always uses external storage.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSGlobalObject, m_externalStorage)), regT0);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSGlobalObject, m_propertyStorage)), regT0);
     load32(offsetAddr, regT1);
     loadPtr(BaseIndex(regT0, regT1, ScalePtr), regT0);
     emitPutVirtualRegister(currentInstruction[1].u.operand);
@@ -704,7 +686,7 @@ void JIT::emitSlow_op_resolve_global(Instruction* currentInstruction, Vector<Slo
     
     linkSlowCase(iter);
     JITStubCall stubCall(this, cti_op_resolve_global);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.addArgument(Imm32(currentIndex));
     stubCall.addArgument(regT0);
     stubCall.call(dst);
@@ -713,9 +695,14 @@ void JIT::emitSlow_op_resolve_global(Instruction* currentInstruction, Vector<Slo
 void JIT::emit_op_not(Instruction* currentInstruction)
 {
     emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
-    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
-    addSlowCase(branchTestPtr(NonZero, regT0, Imm32(static_cast<int32_t>(~JSImmediate::ExtendedPayloadBitBoolValue))));
-    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool | JSImmediate::ExtendedPayloadBitBoolValue)), regT0);
+
+    // Invert against JSValue(false); if the value was tagged as a boolean, then all bits will be
+    // clear other than the low bit (which will be 0 or 1 for false or true inputs respectively).
+    // Then invert against JSValue(true), which will add the tag back in, and flip the low bit.
+    xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), regT0);
+    addSlowCase(branchTestPtr(NonZero, regT0, TrustedImm32(static_cast<int32_t>(~1))));
+    xorPtr(TrustedImm32(static_cast<int32_t>(ValueTrue)), regT0);
+
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
@@ -724,11 +711,11 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
     unsigned target = currentInstruction[2].u.operand;
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(0)))), target);
+    addJump(branchPtr(Equal, regT0, TrustedImmPtr(JSValue::encode(jsNumber(0)))), target);
     Jump isNonZero = emitJumpIfImmediateInteger(regT0);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target);
-    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))));
+    addJump(branchPtr(Equal, regT0, TrustedImmPtr(JSValue::encode(jsBoolean(false)))), target);
+    addSlowCase(branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(jsBoolean(true)))));
 
     isNonZero.link(this);
     RECORD_JUMP_TARGET(target);
@@ -743,14 +730,14 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    addJump(branchTest8(NonZero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
-    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNull()))), target);            
+    andPtr(TrustedImm32(~TagBitUndefined), regT0);
+    addJump(branchPtr(Equal, regT0, TrustedImmPtr(JSValue::encode(jsNull()))), target);            
 
     wasNotImmediate.link(this);
     RECORD_JUMP_TARGET(target);
@@ -764,14 +751,14 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    addJump(branchTest8(Zero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
-    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsNull()))), target);            
+    andPtr(TrustedImm32(~TagBitUndefined), regT0);
+    addJump(branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(jsNull()))), target);            
 
     wasNotImmediate.link(this);
     RECORD_JUMP_TARGET(target);
@@ -780,11 +767,11 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
 {
     unsigned src = currentInstruction[1].u.operand;
-    JSCell* ptr = currentInstruction[2].u.jsCell;
+    JSCell* ptr = currentInstruction[2].u.jsCell.get();
     unsigned target = currentInstruction[3].u.operand;
     
     emitGetVirtualRegister(src, regT0);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue(ptr)))), target);            
+    addJump(branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(JSValue(ptr)))), target);            
 
     RECORD_JUMP_TARGET(target);
 }
@@ -793,7 +780,7 @@ void JIT::emit_op_jsr(Instruction* currentInstruction)
 {
     int retAddrDst = currentInstruction[1].u.operand;
     int target = currentInstruction[2].u.operand;
-    DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
+    DataLabelPtr storeLocation = storePtrWithPatch(TrustedImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
     addJump(jump(), target);
     m_jsrSites.append(JSRInfo(storeLocation, label()));
     killLastResultRegister();
@@ -827,7 +814,7 @@ void JIT::emit_op_bitnot(Instruction* currentInstruction)
 void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_with_base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.call(currentInstruction[2].u.operand);
 }
@@ -835,7 +822,7 @@ void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_new_func_exp);
-    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -844,11 +831,11 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
     unsigned target = currentInstruction[2].u.operand;
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
-    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(0))));
+    Jump isZero = branchPtr(Equal, regT0, TrustedImmPtr(JSValue::encode(jsNumber(0))));
     addJump(emitJumpIfImmediateInteger(regT0), target);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target);
-    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
+    addJump(branchPtr(Equal, regT0, TrustedImmPtr(JSValue::encode(jsBoolean(true)))), target);
+    addSlowCase(branchPtr(NotEqual, regT0, TrustedImmPtr(JSValue::encode(jsBoolean(false)))));
 
     isZero.link(this);
     RECORD_JUMP_TARGET(target);
@@ -909,8 +896,8 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
     if (!m_codeBlock->isKnownNotImmediate(base))
         isNotObject.append(emitJumpIfNotJSCell(regT0));
     if (base != m_codeBlock->thisRegister() || m_codeBlock->isStrictMode()) {
-        loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        isNotObject.append(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+        loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+        isNotObject.append(branch8(NotEqual, Address(regT2, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType)));
     }
 
     // We could inline the case where you have a valid cache, but
@@ -920,14 +907,15 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
     getPnamesStubCall.addArgument(regT0);
     getPnamesStubCall.call(dst);
     load32(Address(regT0, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStringsSize)), regT3);
-    store32(Imm32(0), addressFor(i));
-    store32(regT3, addressFor(size));
+    storePtr(tagTypeNumberRegister, payloadFor(i));
+    store32(TrustedImm32(Int32Tag), intTagFor(size));
+    store32(regT3, intPayloadFor(size));
     Jump end = jump();
 
     isNotObject.link(this);
     move(regT0, regT1);
-    and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT1);
-    addJump(branch32(Equal, regT1, Imm32(JSImmediate::FullTagTypeNull)), breakTarget);
+    and32(TrustedImm32(~TagBitUndefined), regT1);
+    addJump(branch32(Equal, regT1, TrustedImm32(ValueNull)), breakTarget);
 
     JITStubCall toObjectStubCall(this, cti_to_object);
     toObjectStubCall.addArgument(regT0);
@@ -949,8 +937,8 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     JumpList callHasProperty;
 
     Label begin(this);
-    load32(addressFor(i), regT0);
-    Jump end = branch32(Equal, regT0, addressFor(size));
+    load32(intPayloadFor(i), regT0);
+    Jump end = branch32(Equal, regT0, intPayloadFor(size));
 
     // Grab key @ i
     loadPtr(addressFor(it), regT1);
@@ -961,14 +949,14 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     emitPutVirtualRegister(dst, regT2);
 
     // Increment i
-    add32(Imm32(1), regT0);
-    store32(regT0, addressFor(i));
+    add32(TrustedImm32(1), regT0);
+    store32(regT0, intPayloadFor(i));
 
     // Verify that i is valid:
     emitGetVirtualRegister(base, regT0);
 
     // Test base's structure
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
     callHasProperty.append(branchPtr(NotEqual, regT2, Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure)))));
 
     // Test base's prototype chain
@@ -977,11 +965,11 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     addJump(branchTestPtr(Zero, Address(regT3)), target);
 
     Label checkPrototype(this);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
+    loadPtr(Address(regT2, Structure::prototypeOffset()), regT2);
     callHasProperty.append(emitJumpIfNotJSCell(regT2));
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    loadPtr(Address(regT2, JSCell::structureOffset()), regT2);
     callHasProperty.append(branchPtr(NotEqual, regT2, Address(regT3)));
-    addPtr(Imm32(sizeof(Structure*)), regT3);
+    addPtr(TrustedImm32(sizeof(Structure*)), regT3);
     branchTestPtr(NonZero, Address(regT3)).linkTo(checkPrototype, this);
 
     // Continue loop.
@@ -1056,8 +1044,8 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
     Jump wasImmediate = emitJumpIfImmediateInteger(regT0);
 
     emitJumpSlowCaseIfNotJSCell(regT0, srcVReg);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    addSlowCase(branch8(NotEqual, Address(regT2, Structure::typeInfoTypeOffset()), TrustedImm32(NumberType)));
     
     wasImmediate.link(this);
 
@@ -1067,7 +1055,7 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
 void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_push_new_scope);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -1078,7 +1066,7 @@ void JIT::emit_op_catch(Instruction* currentInstruction)
     move(regT0, callFrameRegister);
     peek(regT3, OBJECT_OFFSETOF(struct JITStackFrame, globalData) / sizeof(void*));
     loadPtr(Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception)), regT0);
-    storePtr(ImmPtr(JSValue::encode(JSValue())), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception)));
+    storePtr(TrustedImmPtr(JSValue::encode(JSValue())), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception)));
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
@@ -1173,15 +1161,15 @@ void JIT::emit_op_eq_null(Instruction* currentInstruction)
     emitGetVirtualRegister(src1, regT0);
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    set32Test8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    set32Test8(NonZero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined), regT0);
 
     Jump wasNotImmediate = jump();
 
     isImmediate.link(this);
 
-    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    setPtr(Equal, regT0, Imm32(JSImmediate::FullTagTypeNull), regT0);
+    andPtr(TrustedImm32(~TagBitUndefined), regT0);
+    setPtr(Equal, regT0, TrustedImm32(ValueNull), regT0);
 
     wasNotImmediate.link(this);
 
@@ -1198,15 +1186,15 @@ void JIT::emit_op_neq_null(Instruction* currentInstruction)
     emitGetVirtualRegister(src1, regT0);
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    set32Test8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    set32Test8(Zero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined), regT0);
 
     Jump wasNotImmediate = jump();
 
     isImmediate.link(this);
 
-    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    setPtr(NotEqual, regT0, Imm32(JSImmediate::FullTagTypeNull), regT0);
+    andPtr(TrustedImm32(~TagBitUndefined), regT0);
+    setPtr(NotEqual, regT0, TrustedImm32(ValueNull), regT0);
 
     wasNotImmediate.link(this);
 
@@ -1253,7 +1241,7 @@ void JIT::emit_op_init_lazy_reg(Instruction* currentInstruction)
 {
     unsigned dst = currentInstruction[1].u.operand;
 
-    storePtr(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * dst));
+    storePtr(TrustedImmPtr(0), Address(callFrameRegister, sizeof(Register) * dst));
 }
 
 void JIT::emit_op_convert_this(Instruction* currentInstruction)
@@ -1261,22 +1249,22 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
     emitJumpSlowCaseIfNotJSCell(regT0);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
-    addSlowCase(branchTest8(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT1);
+    addSlowCase(branchTest8(NonZero, Address(regT1, Structure::typeInfoFlagsOffset()), TrustedImm32(NeedsThisConversion)));
 }
 
 void JIT::emit_op_convert_this_strict(Instruction* currentInstruction)
 {
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
     Jump notNull = branchTestPtr(NonZero, regT0);
-    move(ImmPtr(JSValue::encode(jsNull())), regT0);
+    move(TrustedImmPtr(JSValue::encode(jsNull())), regT0);
     emitPutVirtualRegister(currentInstruction[1].u.operand, regT0);
     Jump setThis = jump();
     notNull.link(this);
     Jump isImmediate = emitJumpIfNotJSCell(regT0);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
-    Jump notAnObject = branch8(NotEqual, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType));
-    addSlowCase(branchTest8(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT1);
+    Jump notAnObject = branch8(NotEqual, Address(regT1, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType));
+    addSlowCase(branchTest8(NonZero, Address(regT1, Structure::typeInfoFlagsOffset()), TrustedImm32(NeedsThisConversion)));
     isImmediate.link(this);
     notAnObject.link(this);
     setThis.link(this);
@@ -1391,7 +1379,7 @@ void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCas
 void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
-    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
+    xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), regT0);
     JITStubCall stubCall(this, cti_op_not);
     stubCall.addArgument(regT0);
     stubCall.call(currentInstruction[1].u.operand);
@@ -1459,7 +1447,7 @@ void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT1);
     stubCall.call();
-    xor32(Imm32(0x1), regT0);
+    xor32(TrustedImm32(0x1), regT0);
     emitTagAsBoolImmediate(regT0);
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
@@ -1549,7 +1537,7 @@ void JIT::emit_op_get_arguments_length(Instruction* currentInstruction)
     int argumentsRegister = currentInstruction[2].u.operand;
     addSlowCase(branchTestPtr(NonZero, addressFor(argumentsRegister)));
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
-    sub32(Imm32(1), regT0);
+    sub32(TrustedImm32(1), regT0);
     emitFastArithReTagImmediate(regT0, regT0);
     emitPutVirtualRegister(dst, regT0);
 }
@@ -1564,7 +1552,7 @@ void JIT::emitSlow_op_get_arguments_length(Instruction* currentInstruction, Vect
     emitGetVirtualRegister(base, regT0);
     JITStubCall stubCall(this, cti_op_get_by_id_generic);
     stubCall.addArgument(regT0);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.call(dst);
 }
 
@@ -1576,7 +1564,7 @@ void JIT::emit_op_get_argument_by_val(Instruction* currentInstruction)
     addSlowCase(branchTestPtr(NonZero, addressFor(argumentsRegister)));
     emitGetVirtualRegister(property, regT1);
     addSlowCase(emitJumpIfNotImmediateInteger(regT1));
-    add32(Imm32(1), regT1);
+    add32(TrustedImm32(1), regT1);
     // regT1 now contains the integer index of the argument we want, including this
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT2);
     addSlowCase(branch32(AboveOrEqual, regT1, regT2));
@@ -1592,7 +1580,7 @@ void JIT::emit_op_get_argument_by_val(Instruction* currentInstruction)
     }
     
     addPtr(Imm32(static_cast<unsigned>(-(RegisterFile::CallFrameHeaderSize + numArgs) * sizeof(Register))), callFrameRegister, regT0);
-    mul32(Imm32(sizeof(Register)), regT2, regT2);
+    mul32(TrustedImm32(sizeof(Register)), regT2, regT2);
     subPtr(regT2, regT0);
     loadPtr(BaseIndex(regT0, regT1, TimesEight, 0), regT0);
     if (numArgs)
@@ -1660,7 +1648,7 @@ void JIT::emitSlow_op_resolve_global_dynamic(Instruction* currentInstruction, Ve
     while (skip--)
         linkSlowCase(iter);
     JITStubCall resolveStubCall(this, cti_op_resolve);
-    resolveStubCall.addArgument(ImmPtr(ident));
+    resolveStubCall.addArgument(TrustedImmPtr(ident));
     resolveStubCall.call(dst);
     emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_resolve_global_dynamic));
     
@@ -1668,7 +1656,7 @@ void JIT::emitSlow_op_resolve_global_dynamic(Instruction* currentInstruction, Ve
     
     linkSlowCase(iter); // We managed to skip all the nodes in the scope chain, but the cache missed.
     JITStubCall stubCall(this, cti_op_resolve_global);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.addArgument(Imm32(currentIndex));
     stubCall.addArgument(regT0);
     stubCall.call(dst);
@@ -1677,7 +1665,7 @@ void JIT::emitSlow_op_resolve_global_dynamic(Instruction* currentInstruction, Ve
 void JIT::emit_op_new_regexp(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_new_regexp);
-    stubCall.addArgument(ImmPtr(m_codeBlock->regexp(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(m_codeBlock->regexp(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -1701,26 +1689,27 @@ void JIT::emit_op_load_varargs(Instruction* currentInstruction)
     }
 
 #if USE(JSVALUE32_64)
-    addSlowCase(branch32(NotEqual, tagFor(argsOffset), Imm32(JSValue::EmptyValueTag)));
+    addSlowCase(branch32(NotEqual, tagFor(argsOffset), TrustedImm32(JSValue::EmptyValueTag)));
 #else
     addSlowCase(branchTestPtr(NonZero, addressFor(argsOffset)));
 #endif
     // Load arg count into regT0
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
-    storePtr(regT0, addressFor(argCountDst));
-    Jump endBranch = branch32(Equal, regT0, Imm32(1));
+    store32(TrustedImm32(Int32Tag), intTagFor(argCountDst));
+    store32(regT0, intPayloadFor(argCountDst));
+    Jump endBranch = branch32(Equal, regT0, TrustedImm32(1));
 
-    mul32(Imm32(sizeof(Register)), regT0, regT3);
-    addPtr(Imm32(static_cast<unsigned>(sizeof(Register) - RegisterFile::CallFrameHeaderSize * sizeof(Register))), callFrameRegister, regT1);
+    mul32(TrustedImm32(sizeof(Register)), regT0, regT3);
+    addPtr(TrustedImm32(static_cast<unsigned>(sizeof(Register) - RegisterFile::CallFrameHeaderSize * sizeof(Register))), callFrameRegister, regT1);
     subPtr(regT3, regT1); // regT1 is now the start of the out of line arguments
     addPtr(Imm32(argsOffset * sizeof(Register)), callFrameRegister, regT2); // regT2 is the target buffer
     
     // Bounds check the registerfile
     addPtr(regT2, regT3);
     addPtr(Imm32((registerOffset - argsOffset) * sizeof(Register)), regT3);
-    addSlowCase(branchPtr(Below, AbsoluteAddress(&m_globalData->interpreter->registerFile().m_end), regT3));
+    addSlowCase(branchPtr(Below, AbsoluteAddress(m_globalData->interpreter->registerFile().addressOfEnd()), regT3));
 
-    sub32(Imm32(1), regT0);
+    sub32(TrustedImm32(1), regT0);
     Label loopStart = label();
     loadPtr(BaseIndex(regT1, regT0, TimesEight, static_cast<unsigned>(0 - 2 * sizeof(Register))), regT3);
     storePtr(regT3, BaseIndex(regT2, regT0, TimesEight, static_cast<unsigned>(0 - sizeof(Register))));
@@ -1728,7 +1717,7 @@ void JIT::emit_op_load_varargs(Instruction* currentInstruction)
     loadPtr(BaseIndex(regT1, regT0, TimesEight, static_cast<unsigned>(sizeof(void*) - 2 * sizeof(Register))), regT3);
     storePtr(regT3, BaseIndex(regT2, regT0, TimesEight, static_cast<unsigned>(sizeof(void*) - sizeof(Register))));
 #endif
-    branchSubPtr(NonZero, Imm32(1), regT0).linkTo(loopStart, this);
+    branchSubPtr(NonZero, TrustedImm32(1), regT0).linkTo(loopStart, this);
     endBranch.link(this);
 }
 
@@ -1745,8 +1734,9 @@ void JIT::emitSlow_op_load_varargs(Instruction* currentInstruction, Vector<SlowC
     JITStubCall stubCall(this, cti_op_load_varargs);
     stubCall.addArgument(Imm32(argsOffset));
     stubCall.call();
-    // Stores a naked int32 in the register file.
-    store32(returnValueRegister, Address(callFrameRegister, argCountDst * sizeof(Register)));
+    
+    store32(TrustedImm32(Int32Tag), intTagFor(argCountDst));
+    store32(returnValueRegister, intPayloadFor(argCountDst));
 }
 
 void JIT::emit_op_new_func(Instruction* currentInstruction)
@@ -1755,13 +1745,13 @@ void JIT::emit_op_new_func(Instruction* currentInstruction)
     int dst = currentInstruction[1].u.operand;
     if (currentInstruction[3].u.operand) {
 #if USE(JSVALUE32_64)
-        lazyJump = branch32(NotEqual, tagFor(dst), Imm32(JSValue::EmptyValueTag));
+        lazyJump = branch32(NotEqual, tagFor(dst), TrustedImm32(JSValue::EmptyValueTag));
 #else
         lazyJump = branchTestPtr(NonZero, addressFor(dst));
 #endif
     }
     JITStubCall stubCall(this, cti_op_new_func);
-    stubCall.addArgument(ImmPtr(m_codeBlock->functionDecl(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(m_codeBlock->functionDecl(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
     if (currentInstruction[3].u.operand)
         lazyJump.link(this);
diff --git a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
index dda74c8..edce21c 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -52,15 +52,15 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
     // regT0 holds payload, regT1 holds tag
 
-    Jump string_failureCases1 = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
-    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
+    Jump string_failureCases1 = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
     load32(Address(regT0, OBJECT_OFFSETOF(JSString, m_length)), regT2);
 
-    Jump string_failureCases3 = branch32(Above, regT2, Imm32(INT_MAX));
+    Jump string_failureCases3 = branch32(Above, regT2, TrustedImm32(INT_MAX));
     move(regT2, regT0);
-    move(Imm32(JSValue::Int32Tag), regT1);
+    move(TrustedImm32(JSValue::Int32Tag), regT1);
 
     ret();
 #endif
@@ -103,7 +103,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
-    Jump hasCodeBlock3 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForCall)), Imm32(0));
+    Jump hasCodeBlock3 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForCall)), TrustedImm32(0));
     preserveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callCompileCall = call();
@@ -123,7 +123,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
-    Jump hasCodeBlock4 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForConstruct)), Imm32(0));
+    Jump hasCodeBlock4 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForConstruct)), TrustedImm32(0));
     preserveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
     Call callCompileCconstruct = call();
@@ -142,10 +142,10 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
     restoreReturnAddressBeforeReturn(regT1);
-    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    move(TrustedImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
     poke(callFrameRegister, 1 + OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
-    poke(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()));
+    poke(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()));
     ret();
 
     // NativeCall Trampoline
@@ -205,7 +205,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     peek(regT1);
     emitPutToCallFrameHeader(regT1, RegisterFile::ReturnPC);
@@ -214,7 +214,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // Host function signature: f(ExecState*);
     move(callFrameRegister, X86Registers::ecx);
 
-    subPtr(Imm32(16 - sizeof(void*)), stackPointerRegister); // Align stack after call.
+    subPtr(TrustedImm32(16 - sizeof(void*)), stackPointerRegister); // Align stack after call.
 
     // call the function
     emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT1);
@@ -222,14 +222,14 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     move(regT0, callFrameRegister); // Eagerly restore caller frame register to avoid loading from stack.
     call(Address(regT1, executableOffsetToFunction));
 
-    addPtr(Imm32(16 - sizeof(void*)), stackPointerRegister);
+    addPtr(TrustedImm32(16 - sizeof(void*)), stackPointerRegister);
 
 #elif CPU(ARM)
     // Load caller frame's scope chain into this callframe so that whatever we call can
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT2);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     preserveReturnAddressAfterCall(regT3); // Callee preserved
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
@@ -245,13 +245,32 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     call(Address(regT2, executableOffsetToFunction));
 
     restoreReturnAddressBeforeReturn(regT3);
+#elif CPU(SH4)
+    // Load caller frame's scope chain into this callframe so that whatever we call can
+    // get to its global data.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT2);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT2);
+    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+
+    preserveReturnAddressAfterCall(regT3); // Callee preserved
+    emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
+
+    // Calling convention: f(r0 == regT4, r1 == regT5, ...);
+    // Host function signature: f(ExecState*);
+    move(callFrameRegister, regT4);
+
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT5);
+    move(regT2, callFrameRegister); // Eagerly restore caller frame register to avoid loading from stack.
+    loadPtr(Address(regT5, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
 
+    call(Address(regT2, executableOffsetToFunction), regT0);
+    restoreReturnAddressBeforeReturn(regT3);
 #elif CPU(MIPS)
     // Load caller frame's scope chain into this callframe so that whatever we call can
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     preserveReturnAddressAfterCall(regT3); // Callee preserved
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
@@ -261,7 +280,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
 
     // Allocate stack space for 16 bytes (8-byte aligned)
     // 16 bytes (unused) for 4 arguments
-    subPtr(Imm32(16), stackPointerRegister);
+    subPtr(TrustedImm32(16), stackPointerRegister);
 
     // Setup arg0
     move(callFrameRegister, MIPSRegisters::a0);
@@ -273,7 +292,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     call(Address(regT2, executableOffsetToFunction));
 
     // Restore stack space
-    addPtr(Imm32(16), stackPointerRegister);
+    addPtr(TrustedImm32(16), stackPointerRegister);
 
     restoreReturnAddressBeforeReturn(regT3);
 
@@ -285,7 +304,7 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
 #endif // CPU(X86)
 
     // Check for an exception
-    Jump sawException = branch32(NotEqual, AbsoluteAddress(reinterpret_cast<char*>(&globalData->exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), Imm32(JSValue::EmptyValueTag));
+    Jump sawException = branch32(NotEqual, AbsoluteAddress(reinterpret_cast<char*>(&globalData->exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
 
     // Return.
     ret();
@@ -296,12 +315,12 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
     // Grab the return address.
     preserveReturnAddressAfterCall(regT1);
 
-    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    move(TrustedImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
 
     // Set the return address.
-    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
+    move(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
     restoreReturnAddressBeforeReturn(regT1);
 
     ret();
@@ -321,7 +340,7 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     peek(regT1);
     emitPutToCallFrameHeader(regT1, RegisterFile::ReturnPC);
@@ -330,21 +349,21 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
     // Host function signature: f(ExecState*);
     move(callFrameRegister, X86Registers::ecx);
 
-    subPtr(Imm32(16 - sizeof(void*)), stackPointerRegister); // Align stack after call.
+    subPtr(TrustedImm32(16 - sizeof(void*)), stackPointerRegister); // Align stack after call.
 
     move(regT0, callFrameRegister); // Eagerly restore caller frame register to avoid loading from stack.
 
     // call the function
     nativeCall = call();
 
-    addPtr(Imm32(16 - sizeof(void*)), stackPointerRegister);
+    addPtr(TrustedImm32(16 - sizeof(void*)), stackPointerRegister);
 
 #elif CPU(ARM)
     // Load caller frame's scope chain into this callframe so that whatever we call can
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT2);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     preserveReturnAddressAfterCall(regT3); // Callee preserved
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
@@ -367,7 +386,7 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
     // get to its global data.
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
-    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     preserveReturnAddressAfterCall(regT3); // Callee preserved
     emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
@@ -377,7 +396,7 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
 
     // Allocate stack space for 16 bytes (8-byte aligned)
     // 16 bytes (unused) for 4 arguments
-    subPtr(Imm32(16), stackPointerRegister);
+    subPtr(TrustedImm32(16), stackPointerRegister);
 
     // Setup arg0
     move(callFrameRegister, MIPSRegisters::a0);
@@ -391,10 +410,31 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
     nativeCall = call();
 
     // Restore stack space
-    addPtr(Imm32(16), stackPointerRegister);
+    addPtr(TrustedImm32(16), stackPointerRegister);
 
     restoreReturnAddressBeforeReturn(regT3);
+#elif CPU(SH4)
+    // Load caller frame's scope chain into this callframe so that whatever we call can
+    // get to its global data.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT2);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT2);
+    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+
+    preserveReturnAddressAfterCall(regT3); // Callee preserved
+    emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
 
+    // Calling convention: f(r0 == regT4, r1 == regT5, ...);
+    // Host function signature: f(ExecState*);
+    move(callFrameRegister, regT4);
+
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, regT5);
+    move(regT2, callFrameRegister); // Eagerly restore caller frame register to avoid loading from stack.
+    loadPtr(Address(regT5, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+
+    // call the function
+    nativeCall = call();
+
+    restoreReturnAddressBeforeReturn(regT3);
 #elif ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
 #error "JIT_OPTIMIZE_NATIVE_CALL not yet supported on this platform."
 #else
@@ -402,7 +442,7 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
 #endif // CPU(X86)
 
     // Check for an exception
-    Jump sawException = branch32(NotEqual, AbsoluteAddress(reinterpret_cast<char*>(&globalData->exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), Imm32(JSValue::EmptyValueTag));
+    Jump sawException = branch32(NotEqual, AbsoluteAddress(reinterpret_cast<char*>(&globalData->exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
 
     // Return.
     ret();
@@ -413,12 +453,12 @@ JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executa
     // Grab the return address.
     preserveReturnAddressAfterCall(regT1);
 
-    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    move(TrustedImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
 
     // Set the return address.
-    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
+    move(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT1);
     restoreReturnAddressBeforeReturn(regT1);
 
     ret();
@@ -448,8 +488,6 @@ void JIT::emit_op_mov(Instruction* currentInstruction)
 
 void JIT::emit_op_end(Instruction* currentInstruction)
 {
-    if (m_codeBlock->needsFullScopeChain())
-        JITStubCall(this, cti_op_end).call();
     ASSERT(returnValueRegister != callFrameRegister);
     emitLoad(currentInstruction[1].u.operand, regT1, regT0);
     restoreReturnAddressBeforeReturn(Address(callFrameRegister, RegisterFile::ReturnPC * static_cast<int>(sizeof(Register))));
@@ -472,21 +510,21 @@ void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
 
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op1).asInt32())), target);
         return;
     }
 
     if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
-        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
         addJump(branch32(LessThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     addJump(branch32(LessThanOrEqual, regT0, regT2), target);
 }
 
@@ -522,8 +560,8 @@ void JIT::emit_op_check_has_instance(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotJSCell(baseVal);
     
     // Check that baseVal 'ImplementsHasInstance'.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsHasInstance)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT0);
+    addSlowCase(branchTest8(Zero, Address(regT0, Structure::typeInfoFlagsOffset()), TrustedImm32(ImplementsHasInstance)));
 }
 
 void JIT::emit_op_instanceof(Instruction* currentInstruction)
@@ -544,29 +582,29 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotJSCell(proto);
     
     // Check that prototype is an object
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), regT3);
-    addSlowCase(branch8(NotEqual, Address(regT3, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    loadPtr(Address(regT1, JSCell::structureOffset()), regT3);
+    addSlowCase(branch8(NotEqual, Address(regT3, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType)));
 
     // Fixme: this check is only needed because the JSC API allows HasInstance to be overridden; we should deprecate this.
     // Check that baseVal 'ImplementsDefaultHasInstance'.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branchTest8(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT0);
+    addSlowCase(branchTest8(Zero, Address(regT0, Structure::typeInfoFlagsOffset()), TrustedImm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
     // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
-    move(Imm32(JSValue::TrueTag), regT0);
+    move(TrustedImm32(1), regT0);
     Label loop(this);
 
     // Load the prototype of the cell in regT2.  If this is equal to regT1 - WIN!
     // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    load32(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
+    loadPtr(Address(regT2, JSCell::structureOffset()), regT2);
+    load32(Address(regT2, Structure::prototypeOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
     Jump isInstance = branchPtr(Equal, regT2, regT1);
     branchTest32(NonZero, regT2).linkTo(loop, this);
 
     // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
-    move(Imm32(JSValue::FalseTag), regT0);
+    move(TrustedImm32(0), regT0);
 
     // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
     isInstance.link(this);
@@ -611,7 +649,7 @@ void JIT::emit_op_get_global_var(Instruction* currentInstruction)
     ASSERT(globalObject->isGlobalObject());
     int index = currentInstruction[2].u.operand;
 
-    loadPtr(&globalObject->d()->registers, regT2);
+    loadPtr(&globalObject->m_registers, regT2);
 
     emitLoad(index, regT1, regT0, regT2);
     emitStore(dst, regT1, regT0);
@@ -627,7 +665,7 @@ void JIT::emit_op_put_global_var(Instruction* currentInstruction)
 
     emitLoad(value, regT1, regT0);
 
-    loadPtr(&globalObject->d()->registers, regT2);
+    loadPtr(&globalObject->m_registers, regT2);
     emitStore(index, regT1, regT0, regT2);
     map(m_bytecodeOffset + OPCODE_LENGTH(op_put_global_var), value, regT1, regT0);
 }
@@ -644,7 +682,7 @@ void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
     if (checkTopLevel && skip--) {
         Jump activationNotCreated;
         if (checkTopLevel)
-            activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), Imm32(JSValue::EmptyValueTag));
+            activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), TrustedImm32(JSValue::EmptyValueTag));
         loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
         activationNotCreated.link(this);
     }
@@ -652,8 +690,7 @@ void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
         loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
 
     loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, object)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject, d)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject, m_registers)), regT2);
 
     emitLoad(index, regT1, regT0, regT2);
     emitStore(dst, regT1, regT0);
@@ -674,7 +711,7 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
     if (checkTopLevel && skip--) {
         Jump activationNotCreated;
         if (checkTopLevel)
-            activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), Imm32(JSValue::EmptyValueTag));
+            activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), TrustedImm32(JSValue::EmptyValueTag));
         loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
         activationNotCreated.link(this);
     }
@@ -682,8 +719,7 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
         loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
 
     loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, object)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject, d)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSVariableObject, m_registers)), regT2);
 
     emitStore(index, regT1, regT0, regT2);
     map(m_bytecodeOffset + OPCODE_LENGTH(op_put_scoped_var), value, regT1, regT0);
@@ -693,8 +729,8 @@ void JIT::emit_op_tear_off_activation(Instruction* currentInstruction)
 {
     unsigned activation = currentInstruction[1].u.operand;
     unsigned arguments = currentInstruction[2].u.operand;
-    Jump activationCreated = branch32(NotEqual, tagFor(activation), Imm32(JSValue::EmptyValueTag));
-    Jump argumentsNotCreated = branch32(Equal, tagFor(arguments), Imm32(JSValue::EmptyValueTag));
+    Jump activationCreated = branch32(NotEqual, tagFor(activation), TrustedImm32(JSValue::EmptyValueTag));
+    Jump argumentsNotCreated = branch32(Equal, tagFor(arguments), TrustedImm32(JSValue::EmptyValueTag));
     activationCreated.link(this);
     JITStubCall stubCall(this, cti_op_tear_off_activation);
     stubCall.addArgument(currentInstruction[1].u.operand);
@@ -707,7 +743,7 @@ void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)
 {
     int dst = currentInstruction[1].u.operand;
 
-    Jump argsNotCreated = branch32(Equal, tagFor(unmodifiedArgumentsRegister(dst)), Imm32(JSValue::EmptyValueTag));
+    Jump argsNotCreated = branch32(Equal, tagFor(unmodifiedArgumentsRegister(dst)), TrustedImm32(JSValue::EmptyValueTag));
     JITStubCall stubCall(this, cti_op_tear_off_arguments);
     stubCall.addArgument(unmodifiedArgumentsRegister(dst));
     stubCall.call();
@@ -725,7 +761,7 @@ void JIT::emit_op_new_array(Instruction* currentInstruction)
 void JIT::emit_op_resolve(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -736,8 +772,8 @@ void JIT::emit_op_to_primitive(Instruction* currentInstruction)
 
     emitLoad(src, regT1, regT0);
 
-    Jump isImm = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
+    Jump isImm = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr)));
     isImm.link(this);
 
     if (dst != src)
@@ -767,7 +803,7 @@ void JIT::emit_op_strcat(Instruction* currentInstruction)
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, currentInstruction[3].u.operand ? cti_op_resolve_base_strict_put : cti_op_resolve_base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -775,14 +811,14 @@ void JIT::emit_op_ensure_property_exists(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_ensure_property_exists);
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
 void JIT::emit_op_resolve_skip(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_skip);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -799,12 +835,12 @@ void JIT::emit_op_resolve_global(Instruction* currentInstruction, bool dynamic)
     void* offsetAddr = &(m_codeBlock->globalResolveInfo(currentIndex).offset);
 
     // Verify structure.
-    move(ImmPtr(globalObject), regT0);
+    move(TrustedImmPtr(globalObject), regT0);
     loadPtr(structureAddress, regT1);
-    addSlowCase(branchPtr(NotEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure))));
+    addSlowCase(branchPtr(NotEqual, regT1, Address(regT0, JSCell::structureOffset())));
 
     // Load property.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSGlobalObject, m_externalStorage)), regT2);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSGlobalObject, m_propertyStorage)), regT2);
     load32(offsetAddr, regT3);
     load32(BaseIndex(regT2, regT3, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0); // payload
     load32(BaseIndex(regT2, regT3, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1); // tag
@@ -821,7 +857,7 @@ void JIT::emitSlow_op_resolve_global(Instruction* currentInstruction, Vector<Slo
 
     linkSlowCase(iter);
     JITStubCall stubCall(this, cti_op_resolve_global);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.addArgument(Imm32(currentIndex));
     stubCall.call(dst);
 }
@@ -833,9 +869,9 @@ void JIT::emit_op_not(Instruction* currentInstruction)
 
     emitLoadTag(src, regT0);
 
-    xor32(Imm32(JSValue::FalseTag), regT0);
-    addSlowCase(branchTest32(NonZero, regT0, Imm32(~1)));
-    xor32(Imm32(JSValue::TrueTag), regT0);
+    emitLoad(src, regT1, regT0);
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::BooleanTag)));
+    xor32(TrustedImm32(1), regT0);
 
     emitStoreBool(dst, regT0, (dst == src));
 }
@@ -859,25 +895,9 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
 
     emitLoad(cond, regT1, regT0);
 
-    Jump isTrue = branch32(Equal, regT1, Imm32(JSValue::TrueTag));
-    addJump(branch32(Equal, regT1, Imm32(JSValue::FalseTag)), target);
-
-    Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    Jump isTrue2 = branch32(NotEqual, regT0, Imm32(0));
-    addJump(jump(), target);
-
-    if (supportsFloatingPoint()) {
-        isNotInteger.link(this);
-
-        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
-
-        emitLoadDouble(cond, fpRegT0);
-        addJump(branchDoubleZeroOrNaN(fpRegT0, fpRegT1), target);
-    } else
-        addSlowCase(isNotInteger);
-
-    isTrue.link(this);
-    isTrue2.link(this);
+    ASSERT((JSValue::BooleanTag + 1 == JSValue::Int32Tag) && !(JSValue::Int32Tag + 1));
+    addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::BooleanTag)));
+    addJump(branchTest32(Zero, regT0), target);
 }
 
 void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -886,6 +906,18 @@ void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEnt
     unsigned target = currentInstruction[2].u.operand;
 
     linkSlowCase(iter);
+
+    if (supportsFloatingPoint()) {
+        // regT1 contains the tag from the hot path.
+        Jump notNumber = branch32(Above, regT1, Imm32(JSValue::LowestTag));
+
+        emitLoadDouble(cond, fpRegT0);
+        emitJumpSlowToHot(branchDoubleZeroOrNaN(fpRegT0, fpRegT1), target);
+        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jfalse));
+
+        notNumber.link(this);
+    }
+
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
@@ -899,25 +931,9 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
 
     emitLoad(cond, regT1, regT0);
 
-    Jump isFalse = branch32(Equal, regT1, Imm32(JSValue::FalseTag));
-    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target);
-
-    Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    Jump isFalse2 = branch32(Equal, regT0, Imm32(0));
-    addJump(jump(), target);
-
-    if (supportsFloatingPoint()) {
-        isNotInteger.link(this);
-
-        addSlowCase(branch32(Above, regT1, Imm32(JSValue::LowestTag)));
-
-        emitLoadDouble(cond, fpRegT0);
-        addJump(branchDoubleNonZero(fpRegT0, fpRegT1), target);
-    } else
-        addSlowCase(isNotInteger);
-
-    isFalse.link(this);
-    isFalse2.link(this);
+    ASSERT((JSValue::BooleanTag + 1 == JSValue::Int32Tag) && !(JSValue::Int32Tag + 1));
+    addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::BooleanTag)));
+    addJump(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -926,6 +942,18 @@ void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntr
     unsigned target = currentInstruction[2].u.operand;
 
     linkSlowCase(iter);
+
+    if (supportsFloatingPoint()) {
+        // regT1 contains the tag from the hot path.
+        Jump notNumber = branch32(Above, regT1, Imm32(JSValue::LowestTag));
+
+        emitLoadDouble(cond, fpRegT0);
+        emitJumpSlowToHot(branchDoubleNonZero(fpRegT0, fpRegT1), target);
+        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jtrue));
+
+        notNumber.link(this);
+    }
+
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
@@ -939,19 +967,20 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     emitLoad(src, regT1, regT0);
 
-    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    addJump(branchTest8(NonZero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
 
-    ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && !(JSValue::NullTag + 1));
-    addJump(branch32(AboveOrEqual, regT1, Imm32(JSValue::UndefinedTag)), target);
+    ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && (JSValue::NullTag & 0x1));
+    or32(TrustedImm32(1), regT1);
+    addJump(branch32(Equal, regT1, TrustedImm32(JSValue::NullTag)), target);
 
     wasNotImmediate.link(this);
 }
@@ -963,19 +992,20 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     emitLoad(src, regT1, regT0);
 
-    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest8(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    addJump(branchTest8(Zero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
 
-    ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && !(JSValue::NullTag + 1));
-    addJump(branch32(Below, regT1, Imm32(JSValue::UndefinedTag)), target);
+    ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && (JSValue::NullTag & 0x1));
+    or32(TrustedImm32(1), regT1);
+    addJump(branch32(NotEqual, regT1, TrustedImm32(JSValue::NullTag)), target);
 
     wasNotImmediate.link(this);
 }
@@ -983,19 +1013,19 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
 {
     unsigned src = currentInstruction[1].u.operand;
-    JSCell* ptr = currentInstruction[2].u.jsCell;
+    JSCell* ptr = currentInstruction[2].u.jsCell.get();
     unsigned target = currentInstruction[3].u.operand;
 
     emitLoad(src, regT1, regT0);
-    addJump(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)), target);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(ptr)), target);
+    addJump(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)), target);
+    addJump(branchPtr(NotEqual, regT0, TrustedImmPtr(ptr)), target);
 }
 
 void JIT::emit_op_jsr(Instruction* currentInstruction)
 {
     int retAddrDst = currentInstruction[1].u.operand;
     int target = currentInstruction[2].u.operand;
-    DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
+    DataLabelPtr storeLocation = storePtrWithPatch(TrustedImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
     addJump(jump(), target);
     m_jsrSites.append(JSRInfo(storeLocation, label()));
 }
@@ -1013,11 +1043,10 @@ void JIT::emit_op_eq(Instruction* currentInstruction)
 
     emitLoad2(src1, regT1, regT0, src2, regT3, regT2);
     addSlowCase(branch32(NotEqual, regT1, regT3));
-    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::CellTag)));
-    addSlowCase(branch32(Below, regT1, Imm32(JSValue::LowestTag)));
+    addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::CellTag)));
+    addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::LowestTag)));
 
-    set8Compare32(Equal, regT0, regT2, regT0);
-    or32(Imm32(JSValue::FalseTag), regT0);
+    set32Compare32(Equal, regT0, regT2, regT0);
 
     emitStoreBool(dst, regT0);
 }
@@ -1034,8 +1063,8 @@ void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>:
     genericCase.append(getSlowCase(iter)); // tags not equal
 
     linkSlowCase(iter); // tags equal and JSCell
-    genericCase.append(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
-    genericCase.append(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsStringVPtr)));
+    genericCase.append(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr)));
+    genericCase.append(branchPtr(NotEqual, Address(regT2), TrustedImmPtr(m_globalData->jsStringVPtr)));
 
     // String case.
     JITStubCall stubCallEqStrings(this, cti_op_eq_strings);
@@ -1053,7 +1082,6 @@ void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>:
     stubCallEq.call(regT0);
 
     storeResult.link(this);
-    or32(Imm32(JSValue::FalseTag), regT0);
     emitStoreBool(dst, regT0);
 }
 
@@ -1065,11 +1093,10 @@ void JIT::emit_op_neq(Instruction* currentInstruction)
 
     emitLoad2(src1, regT1, regT0, src2, regT3, regT2);
     addSlowCase(branch32(NotEqual, regT1, regT3));
-    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::CellTag)));
-    addSlowCase(branch32(Below, regT1, Imm32(JSValue::LowestTag)));
+    addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::CellTag)));
+    addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::LowestTag)));
 
-    set8Compare32(NotEqual, regT0, regT2, regT0);
-    or32(Imm32(JSValue::FalseTag), regT0);
+    set32Compare32(NotEqual, regT0, regT2, regT0);
 
     emitStoreBool(dst, regT0);
 }
@@ -1084,8 +1111,8 @@ void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>
     genericCase.append(getSlowCase(iter)); // tags not equal
 
     linkSlowCase(iter); // tags equal and JSCell
-    genericCase.append(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
-    genericCase.append(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsStringVPtr)));
+    genericCase.append(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr)));
+    genericCase.append(branchPtr(NotEqual, Address(regT2), TrustedImmPtr(m_globalData->jsStringVPtr)));
 
     // String case.
     JITStubCall stubCallEqStrings(this, cti_op_eq_strings);
@@ -1103,8 +1130,7 @@ void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>
     stubCallEq.call(regT0);
 
     storeResult.link(this);
-    xor32(Imm32(0x1), regT0);
-    or32(Imm32(JSValue::FalseTag), regT0);
+    xor32(TrustedImm32(0x1), regT0);
     emitStoreBool(dst, regT0);
 }
 
@@ -1121,15 +1147,13 @@ void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqTy
     // cells and/or Int32s.
     move(regT0, regT2);
     and32(regT1, regT2);
-    addSlowCase(branch32(Below, regT2, Imm32(JSValue::LowestTag)));
-    addSlowCase(branch32(AboveOrEqual, regT2, Imm32(JSValue::CellTag)));
+    addSlowCase(branch32(Below, regT2, TrustedImm32(JSValue::LowestTag)));
+    addSlowCase(branch32(AboveOrEqual, regT2, TrustedImm32(JSValue::CellTag)));
 
     if (type == OpStrictEq)
-        set8Compare32(Equal, regT0, regT1, regT0);
+        set32Compare32(Equal, regT0, regT1, regT0);
     else
-        set8Compare32(NotEqual, regT0, regT1, regT0);
-
-    or32(Imm32(JSValue::FalseTag), regT0);
+        set32Compare32(NotEqual, regT0, regT1, regT0);
 
     emitStoreBool(dst, regT0);
 }
@@ -1180,23 +1204,21 @@ void JIT::emit_op_eq_null(Instruction* currentInstruction)
     unsigned src = currentInstruction[2].u.operand;
 
     emitLoad(src, regT1, regT0);
-    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
-    set32Test8(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT1);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT1);
+    set32Test8(NonZero, Address(regT1, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined), regT1);
 
     Jump wasNotImmediate = jump();
 
     isImmediate.link(this);
 
-    set8Compare32(Equal, regT1, Imm32(JSValue::NullTag), regT2);
-    set8Compare32(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
+    set32Compare32(Equal, regT1, TrustedImm32(JSValue::NullTag), regT2);
+    set32Compare32(Equal, regT1, TrustedImm32(JSValue::UndefinedTag), regT1);
     or32(regT2, regT1);
 
     wasNotImmediate.link(this);
 
-    or32(Imm32(JSValue::FalseTag), regT1);
-
     emitStoreBool(dst, regT1);
 }
 
@@ -1206,30 +1228,28 @@ void JIT::emit_op_neq_null(Instruction* currentInstruction)
     unsigned src = currentInstruction[2].u.operand;
 
     emitLoad(src, regT1, regT0);
-    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
-    set32Test8(Zero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT1);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT1);
+    set32Test8(Zero, Address(regT1, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined), regT1);
 
     Jump wasNotImmediate = jump();
 
     isImmediate.link(this);
 
-    set8Compare32(NotEqual, regT1, Imm32(JSValue::NullTag), regT2);
-    set8Compare32(NotEqual, regT1, Imm32(JSValue::UndefinedTag), regT1);
+    set32Compare32(NotEqual, regT1, TrustedImm32(JSValue::NullTag), regT2);
+    set32Compare32(NotEqual, regT1, TrustedImm32(JSValue::UndefinedTag), regT1);
     and32(regT2, regT1);
 
     wasNotImmediate.link(this);
 
-    or32(Imm32(JSValue::FalseTag), regT1);
-
     emitStoreBool(dst, regT1);
 }
 
 void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_resolve_with_base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.call(currentInstruction[2].u.operand);
 }
@@ -1237,7 +1257,7 @@ void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
 void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_new_func_exp);
-    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -1267,10 +1287,10 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
 
     emitLoad(base, regT1, regT0);
     if (!m_codeBlock->isKnownNotImmediate(base))
-        isNotObject.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+        isNotObject.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
     if (base != m_codeBlock->thisRegister() || m_codeBlock->isStrictMode()) {
-        loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        isNotObject.append(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+        loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+        isNotObject.append(branch8(NotEqual, Address(regT2, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType)));
     }
 
     // We could inline the case where you have a valid cache, but
@@ -1280,13 +1300,15 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
     getPnamesStubCall.addArgument(regT0);
     getPnamesStubCall.call(dst);
     load32(Address(regT0, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStringsSize)), regT3);
-    store32(Imm32(0), addressFor(i));
-    store32(regT3, addressFor(size));
+    store32(TrustedImm32(Int32Tag), intTagFor(i));
+    store32(TrustedImm32(0), intPayloadFor(i));
+    store32(TrustedImm32(Int32Tag), intTagFor(size));
+    store32(regT3, payloadFor(size));
     Jump end = jump();
 
     isNotObject.link(this);
-    addJump(branch32(Equal, regT1, Imm32(JSValue::NullTag)), breakTarget);
-    addJump(branch32(Equal, regT1, Imm32(JSValue::UndefinedTag)), breakTarget);
+    addJump(branch32(Equal, regT1, TrustedImm32(JSValue::NullTag)), breakTarget);
+    addJump(branch32(Equal, regT1, TrustedImm32(JSValue::UndefinedTag)), breakTarget);
     JITStubCall toObjectStubCall(this, cti_to_object);
     toObjectStubCall.addArgument(regT1, regT0);
     toObjectStubCall.call(base);
@@ -1307,25 +1329,25 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     JumpList callHasProperty;
 
     Label begin(this);
-    load32(addressFor(i), regT0);
-    Jump end = branch32(Equal, regT0, addressFor(size));
+    load32(intPayloadFor(i), regT0);
+    Jump end = branch32(Equal, regT0, intPayloadFor(size));
 
     // Grab key @ i
-    loadPtr(addressFor(it), regT1);
+    loadPtr(payloadFor(it), regT1);
     loadPtr(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStrings)), regT2);
     load32(BaseIndex(regT2, regT0, TimesEight), regT2);
-    store32(Imm32(JSValue::CellTag), tagFor(dst));
+    store32(TrustedImm32(JSValue::CellTag), tagFor(dst));
     store32(regT2, payloadFor(dst));
 
     // Increment i
-    add32(Imm32(1), regT0);
-    store32(regT0, addressFor(i));
+    add32(TrustedImm32(1), regT0);
+    store32(regT0, intPayloadFor(i));
 
     // Verify that i is valid:
-    loadPtr(addressFor(base), regT0);
+    loadPtr(payloadFor(base), regT0);
 
     // Test base's structure
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
     callHasProperty.append(branchPtr(NotEqual, regT2, Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure)))));
 
     // Test base's prototype chain
@@ -1334,11 +1356,11 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     addJump(branchTestPtr(Zero, Address(regT3)), target);
 
     Label checkPrototype(this);
-    callHasProperty.append(branch32(Equal, Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), Imm32(JSValue::NullTag)));
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branch32(Equal, Address(regT2, Structure::prototypeOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::NullTag)));
+    loadPtr(Address(regT2, Structure::prototypeOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
+    loadPtr(Address(regT2, JSCell::structureOffset()), regT2);
     callHasProperty.append(branchPtr(NotEqual, regT2, Address(regT3)));
-    addPtr(Imm32(sizeof(Structure*)), regT3);
+    addPtr(TrustedImm32(sizeof(Structure*)), regT3);
     branchTestPtr(NonZero, Address(regT3)).linkTo(checkPrototype, this);
 
     // Continue loop.
@@ -1379,8 +1401,8 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
 
     emitLoad(src, regT1, regT0);
 
-    Jump isInt32 = branch32(Equal, regT1, Imm32(JSValue::Int32Tag));
-    addSlowCase(branch32(AboveOrEqual, regT1, Imm32(JSValue::EmptyValueTag)));
+    Jump isInt32 = branch32(Equal, regT1, TrustedImm32(JSValue::Int32Tag));
+    addSlowCase(branch32(AboveOrEqual, regT1, TrustedImm32(JSValue::EmptyValueTag)));
     isInt32.link(this);
 
     if (src != dst)
@@ -1402,7 +1424,7 @@ void JIT::emitSlow_op_to_jsnumber(Instruction* currentInstruction, Vector<SlowCa
 void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_push_new_scope);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(currentInstruction[3].u.operand);
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -1416,8 +1438,8 @@ void JIT::emit_op_catch(Instruction* currentInstruction)
     loadPtr(Address(stackPointerRegister, OBJECT_OFFSETOF(struct JITStackFrame, globalData)), regT3);
     load32(Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0);
     load32(Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1);
-    store32(Imm32(JSValue().payload()), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
-    store32(Imm32(JSValue().tag()), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+    store32(TrustedImm32(JSValue().payload()), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+    store32(TrustedImm32(JSValue().tag()), Address(regT3, OBJECT_OFFSETOF(JSGlobalData, exception) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
 
     unsigned exception = currentInstruction[1].u.operand;
     emitStore(exception, regT1, regT0);
@@ -1522,7 +1544,7 @@ void JIT::emit_op_create_activation(Instruction* currentInstruction)
 {
     unsigned activation = currentInstruction[1].u.operand;
     
-    Jump activationCreated = branch32(NotEqual, tagFor(activation), Imm32(JSValue::EmptyValueTag));
+    Jump activationCreated = branch32(NotEqual, tagFor(activation), TrustedImm32(JSValue::EmptyValueTag));
     JITStubCall(this, cti_op_push_activation).call(activation);
     activationCreated.link(this);
 }
@@ -1531,7 +1553,7 @@ void JIT::emit_op_create_arguments(Instruction* currentInstruction)
 {
     unsigned dst = currentInstruction[1].u.operand;
 
-    Jump argsCreated = branch32(NotEqual, tagFor(dst), Imm32(JSValue::EmptyValueTag));
+    Jump argsCreated = branch32(NotEqual, tagFor(dst), TrustedImm32(JSValue::EmptyValueTag));
 
     if (m_codeBlock->m_numParameters == 1)
         JITStubCall(this, cti_op_create_arguments_no_params).call();
@@ -1573,10 +1595,10 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
 
     emitLoad(thisRegister, regT1, regT0);
 
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addSlowCase(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    addSlowCase(branchTest8(NonZero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(NeedsThisConversion)));
 
     map(m_bytecodeOffset + OPCODE_LENGTH(op_convert_this), thisRegister, regT1, regT0);
 }
@@ -1587,14 +1609,14 @@ void JIT::emit_op_convert_this_strict(Instruction* currentInstruction)
     
     emitLoad(thisRegister, regT1, regT0);
     
-    Jump notNull = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
+    Jump notNull = branch32(NotEqual, regT1, TrustedImm32(JSValue::EmptyValueTag));
     emitStore(thisRegister, jsNull());
     Jump setThis = jump();
     notNull.link(this);
-    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    Jump notAnObject = branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType));
-    addSlowCase(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
+    Jump notAnObject = branch8(NotEqual, Address(regT2, Structure::typeInfoTypeOffset()), TrustedImm32(ObjectType));
+    addSlowCase(branchTest8(NonZero, Address(regT2, Structure::typeInfoFlagsOffset()), TrustedImm32(NeedsThisConversion)));
     isImmediate.link(this);
     notAnObject.link(this);
     setThis.link(this);
@@ -1650,9 +1672,9 @@ void JIT::emit_op_get_arguments_length(Instruction* currentInstruction)
 {
     int dst = currentInstruction[1].u.operand;
     int argumentsRegister = currentInstruction[2].u.operand;
-    addSlowCase(branch32(NotEqual, tagFor(argumentsRegister), Imm32(JSValue::EmptyValueTag)));
+    addSlowCase(branch32(NotEqual, tagFor(argumentsRegister), TrustedImm32(JSValue::EmptyValueTag)));
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
-    sub32(Imm32(1), regT0);
+    sub32(TrustedImm32(1), regT0);
     emitStoreInt32(dst, regT0);
 }
 
@@ -1665,7 +1687,7 @@ void JIT::emitSlow_op_get_arguments_length(Instruction* currentInstruction, Vect
     
     JITStubCall stubCall(this, cti_op_get_by_id_generic);
     stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(TrustedImmPtr(&(m_codeBlock->identifier(ident))));
     stubCall.call(dst);
 }
 
@@ -1674,10 +1696,10 @@ void JIT::emit_op_get_argument_by_val(Instruction* currentInstruction)
     int dst = currentInstruction[1].u.operand;
     int argumentsRegister = currentInstruction[2].u.operand;
     int property = currentInstruction[3].u.operand;
-    addSlowCase(branch32(NotEqual, tagFor(argumentsRegister), Imm32(JSValue::EmptyValueTag)));
+    addSlowCase(branch32(NotEqual, tagFor(argumentsRegister), TrustedImm32(JSValue::EmptyValueTag)));
     emitLoad(property, regT1, regT2);
-    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-    add32(Imm32(1), regT2);
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    add32(TrustedImm32(1), regT2);
     // regT2 now contains the integer index of the argument we want, including this
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT3);
     addSlowCase(branch32(AboveOrEqual, regT2, regT3));
@@ -1694,7 +1716,7 @@ void JIT::emit_op_get_argument_by_val(Instruction* currentInstruction)
     }
 
     addPtr(Imm32(static_cast<unsigned>(-(RegisterFile::CallFrameHeaderSize + numArgs) * sizeof(Register))), callFrameRegister, regT1);
-    mul32(Imm32(sizeof(Register)), regT3, regT3);
+    mul32(TrustedImm32(sizeof(Register)), regT3, regT3);
     subPtr(regT3, regT1);
     loadPtr(BaseIndex(regT1, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0);
     loadPtr(BaseIndex(regT1, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1);
@@ -1736,17 +1758,17 @@ void JIT::softModulo()
     push(regT3);
     move(regT2, regT3);
     move(regT0, regT2);
-    move(Imm32(0), regT1);
+    move(TrustedImm32(0), regT1);
 
     // Check for negative result reminder
-    Jump positiveRegT3 = branch32(GreaterThanOrEqual, regT3, Imm32(0));
+    Jump positiveRegT3 = branch32(GreaterThanOrEqual, regT3, TrustedImm32(0));
     neg32(regT3);
-    xor32(Imm32(1), regT1);
+    xor32(TrustedImm32(1), regT1);
     positiveRegT3.link(this);
 
-    Jump positiveRegT2 = branch32(GreaterThanOrEqual, regT2, Imm32(0));
+    Jump positiveRegT2 = branch32(GreaterThanOrEqual, regT2, TrustedImm32(0));
     neg32(regT2);
-    xor32(Imm32(2), regT1);
+    xor32(TrustedImm32(2), regT1);
     positiveRegT2.link(this);
 
     // Save the condition for negative reminder
@@ -1756,7 +1778,7 @@ void JIT::softModulo()
 
     // Power of two fast case
     move(regT3, regT0);
-    sub32(Imm32(1), regT0);
+    sub32(TrustedImm32(1), regT0);
     Jump powerOfTwo = branchTest32(NotEqual, regT0, regT3);
     and32(regT0, regT2);
     powerOfTwo.link(this);
@@ -1769,10 +1791,10 @@ void JIT::softModulo()
     countLeadingZeros32(regT3, regT1);
     sub32(regT0, regT1);
 
-    Jump useFullTable = branch32(Equal, regT1, Imm32(31));
+    Jump useFullTable = branch32(Equal, regT1, TrustedImm32(31));
 
     neg32(regT1);
-    add32(Imm32(31), regT1);
+    add32(TrustedImm32(31), regT1);
 
     int elementSizeByShift = -1;
 #if CPU(ARM)
@@ -1807,7 +1829,7 @@ void JIT::softModulo()
 
     // Check for negative reminder
     pop(regT1);
-    Jump positiveResult = branch32(Equal, regT1, Imm32(0));
+    Jump positiveResult = branch32(Equal, regT1, TrustedImm32(0));
     neg32(regT2);
     positiveResult.link(this);
 
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
index 1b95eec..a1f1fe6 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -54,7 +54,7 @@ JIT::CodePtr JIT::stringGetByValStubGenerator(JSGlobalData* globalData, Executab
 {
     JSInterfaceJIT jit;
     JumpList failures;
-    failures.append(jit.branchPtr(NotEqual, Address(regT0), ImmPtr(globalData->jsStringVPtr)));
+    failures.append(jit.branchPtr(NotEqual, Address(regT0), TrustedImmPtr(globalData->jsStringVPtr)));
     failures.append(jit.branchTest32(NonZero, Address(regT0, OBJECT_OFFSETOF(JSString, m_fiberCount))));
 
     // Load string length to regT1, and start the process of loading the data pointer into regT0
@@ -68,13 +68,13 @@ JIT::CodePtr JIT::stringGetByValStubGenerator(JSGlobalData* globalData, Executab
     // Load the character
     jit.load16(BaseIndex(regT0, regT1, TimesTwo, 0), regT0);
     
-    failures.append(jit.branch32(AboveOrEqual, regT0, Imm32(0x100)));
-    jit.move(ImmPtr(globalData->smallStrings.singleCharacterStrings()), regT1);
+    failures.append(jit.branch32(AboveOrEqual, regT0, TrustedImm32(0x100)));
+    jit.move(TrustedImmPtr(globalData->smallStrings.singleCharacterStrings()), regT1);
     jit.loadPtr(BaseIndex(regT1, regT0, ScalePtr, 0), regT0);
     jit.ret();
     
     failures.link(&jit);
-    jit.move(Imm32(0), regT0);
+    jit.move(TrustedImm32(0), regT0);
     jit.ret();
     
     LinkBuffer patchBuffer(&jit, pool, 0);
@@ -99,10 +99,10 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     zeroExtend32ToPtr(regT1, regT1);
 
     emitJumpSlowCaseIfNotJSCell(regT0, base);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsArrayVPtr)));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
-    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    loadPtr(Address(regT0, JSArray::storageOffset()), regT2);
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, JSArray::vectorLengthOffset())));
 
     loadPtr(BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0);
     addSlowCase(branchTestPtr(Zero, regT0));
@@ -120,7 +120,7 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
     linkSlowCaseIfNotJSCell(iter, base); // base cell check
     Jump nonCell = jump();
     linkSlowCase(iter); // base array check
-    Jump notString = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
+    Jump notString = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr));
     emitNakedCall(m_globalData->getCTIStub(stringGetByValStubGenerator));
     Jump failed = branchTestPtr(Zero, regT0);
     emitPutVirtualRegister(dst, regT0);
@@ -138,18 +138,10 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
     stubCall.call(dst);
 }
 
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch)
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID offset, RegisterID scratch)
 {
-    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
-    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
-
-    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
-    loadPtr(BaseIndex(base, offset, ScalePtr, OBJECT_OFFSETOF(JSObject, m_inlineStorage)), result);
-    Jump finishedLoad = jump();
-    notUsingInlineStorage.link(this);
-    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), scratch);
+    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), scratch);
     loadPtr(BaseIndex(scratch, offset, ScalePtr, 0), result);
-    finishedLoad.link(this);
 }
 
 void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
@@ -167,12 +159,12 @@ void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotJSCell(regT0, base);
 
     // Test base's structure
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    loadPtr(Address(regT0, JSCell::structureOffset()), regT2);
     addSlowCase(branchPtr(NotEqual, regT2, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
     load32(addressFor(i), regT3);
-    sub32(Imm32(1), regT3);
+    sub32(TrustedImm32(1), regT3);
     addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
-    compileGetDirectOffset(regT0, regT0, regT2, regT3, regT1);
+    compileGetDirectOffset(regT0, regT0, regT3, regT1);
 
     emitPutVirtualRegister(dst, regT0);
 }
@@ -205,10 +197,10 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
     // See comment in op_get_by_val.
     zeroExtend32ToPtr(regT1, regT1);
     emitJumpSlowCaseIfNotJSCell(regT0, base);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, JSArray::vectorLengthOffset())));
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
+    loadPtr(Address(regT0, JSArray::storageOffset()), regT2);
     Jump empty = branchTestPtr(Zero, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
 
     Label storeResult(this);
@@ -217,11 +209,11 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
     Jump end = jump();
     
     empty.link(this);
-    add32(Imm32(1), Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    add32(TrustedImm32(1), Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
     branch32(Below, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
 
     move(regT1, regT0);
-    add32(Imm32(1), regT0);
+    add32(TrustedImm32(1), regT0);
     store32(regT0, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)));
     jump().linkTo(storeResult, this);
 
@@ -232,7 +224,7 @@ void JIT::emit_op_put_by_index(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_put_by_index);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
-    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(TrustedImm32(currentInstruction[2].u.operand));
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
     stubCall.call();
 }
@@ -241,7 +233,7 @@ void JIT::emit_op_put_getter(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_put_getter);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
     stubCall.call();
 }
@@ -250,7 +242,7 @@ void JIT::emit_op_put_setter(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_put_setter);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.addArgument(currentInstruction[3].u.operand, regT2);
     stubCall.call();
 }
@@ -259,7 +251,7 @@ void JIT::emit_op_del_by_id(Instruction* currentInstruction)
 {
     JITStubCall stubCall(this, cti_op_del_by_id);
     stubCall.addArgument(currentInstruction[2].u.operand, regT2);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
@@ -284,7 +276,7 @@ void JIT::emit_op_get_by_id(Instruction* currentInstruction)
     emitGetVirtualRegister(baseVReg, regT0);
     JITStubCall stubCall(this, cti_op_get_by_id_generic);
     stubCall.addArgument(regT0);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.call(resultVReg);
 
     m_propertyAccessInstructionIndex++;
@@ -306,7 +298,7 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 
     JITStubCall stubCall(this, direct ? cti_op_put_by_id_direct_generic, cti_op_put_by_id_generic);
     stubCall.addArgument(regT0);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.addArgument(regT1);
     stubCall.call();
 
@@ -344,12 +336,12 @@ void JIT::emit_op_method_check(Instruction* currentInstruction)
 
     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
 
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT1);
-    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), info.structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(TrustedImmPtr(0), regT1);
+    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT1, JSCell::structureOffset()), protoStructureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
 
     // This will be relinked to load the function without doing a load.
-    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+    DataLabelPtr putFunction = moveWithPatch(TrustedImmPtr(0), regT0);
 
     END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
 
@@ -422,16 +414,12 @@ void JIT::compileGetByIdHotPath(int, int baseVReg, Identifier*, unsigned propert
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
 
     DataLabelPtr structureToCompare;
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     addSlowCase(structureCheck);
     ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureToCompare), patchOffsetGetByIdStructure);
     ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureCheck), patchOffsetGetByIdBranchToSlowCase)
 
-    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
-    Label externalLoadComplete(this);
-    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, externalLoad), patchOffsetGetByIdExternalLoad);
-    ASSERT_JIT_OFFSET(differenceBetween(externalLoad, externalLoadComplete), patchLengthGetByIdExternalLoad);
-
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), regT0);
     DataLabel32 displacementLabel = loadPtrWithAddressOffsetPatch(Address(regT0, patchGetByIdDefaultOffset), regT0);
     ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel), patchOffsetGetByIdPropertyMapOffset);
 
@@ -469,7 +457,7 @@ void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident
 #endif
     JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
     stubCall.addArgument(regT0);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     Call call = stubCall.call(resultVReg);
 
     END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
@@ -504,15 +492,10 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 
     // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
     DataLabelPtr structureToCompare;
-    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
+    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
     ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureToCompare), patchOffsetPutByIdStructure);
 
-    // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
-    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
-    Label externalLoadComplete(this);
-    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, externalLoad), patchOffsetPutByIdExternalLoad);
-    ASSERT_JIT_OFFSET(differenceBetween(externalLoad, externalLoadComplete), patchLengthPutByIdExternalLoad);
-
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), regT0);
     DataLabel32 displacementLabel = storePtrWithAddressOffsetPatch(regT1, Address(regT0, patchGetByIdDefaultOffset));
 
     END_UNINTERRUPTED_SEQUENCE(sequencePutById);
@@ -533,7 +516,7 @@ void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCase
 
     JITStubCall stubCall(this, direct ? cti_op_put_by_id_direct : cti_op_put_by_id);
     stubCall.addArgument(regT0);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.addArgument(regT1);
     Call call = stubCall.call();
 
@@ -547,9 +530,9 @@ void JIT::compilePutDirectOffset(RegisterID base, RegisterID value, Structure* s
 {
     int offset = cachedOffset * sizeof(JSValue);
     if (structure->isUsingInlineStorage())
-        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage);
+        offset += JSObject::offsetOfInlineStorage();
     else
-        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), base);
     storePtr(value, Address(base, offset));
 }
 
@@ -557,22 +540,18 @@ void JIT::compilePutDirectOffset(RegisterID base, RegisterID value, Structure* s
 void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset)
 {
     int offset = cachedOffset * sizeof(JSValue);
-    if (structure->isUsingInlineStorage())
-        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage);
-    else
-        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
-    loadPtr(Address(base, offset), result);
+    if (structure->isUsingInlineStorage()) {
+        offset += JSObject::offsetOfInlineStorage();
+        loadPtr(Address(base, offset), result);
+    } else {
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), result);
+        loadPtr(Address(result, offset), result);
+    }
 }
 
-void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID result, size_t cachedOffset)
+void JIT::compileGetDirectOffset(JSObject* base, RegisterID result, size_t cachedOffset)
 {
-    if (base->isUsingInlineStorage())
-        loadPtr(static_cast<void*>(&base->m_inlineStorage[cachedOffset]), result);
-    else {
-        PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
-        loadPtr(static_cast<void*>(protoPropertyStorage), temp);
-        loadPtr(Address(temp, cachedOffset * sizeof(JSValue)), result);
-    } 
+    loadPtr(static_cast<void*>(&base->m_propertyStorage[cachedOffset]), result);
 }
 
 void JIT::testPrototype(JSValue prototype, JumpList& failureCases)
@@ -585,10 +564,10 @@ void JIT::testPrototype(JSValue prototype, JumpList& failureCases)
     // values.  In the non X86_64 case, the generated code is slightly more efficient because it uses
     // two less instructions and doesn't require any scratch registers.
 #if CPU(X86_64)
-    move(ImmPtr(prototype.asCell()->structure()), regT3);
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&prototype.asCell()->m_structure), regT3));
+    move(TrustedImmPtr(prototype.asCell()->structure()), regT3);
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(prototype.asCell()->addressOfStructure()), regT3));
 #else
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&prototype.asCell()->m_structure), ImmPtr(prototype.asCell()->structure())));
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(prototype.asCell()->addressOfStructure()), TrustedImmPtr(prototype.asCell()->structure())));
 #endif
 }
 
@@ -597,12 +576,12 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
     JumpList failureCases;
     // Check eax is an object of the right Structure.
     failureCases.append(emitJumpIfNotJSCell(regT0));
-    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
+    failureCases.append(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(oldStructure)));
     testPrototype(oldStructure->storedPrototype(), failureCases);
 
     // ecx = baseObject->m_structure
     if (!direct) {
-        for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        for (WriteBarrier<Structure>* it = chain->head(); *it; ++it)
             testPrototype((*it)->storedPrototype(), failureCases);
     }
 
@@ -619,19 +598,15 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         stubCall.skipArgument(); // base
         stubCall.skipArgument(); // ident
         stubCall.skipArgument(); // value
-        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
-        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
+        stubCall.addArgument(TrustedImm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(TrustedImm32(newStructure->propertyStorageCapacity()));
         stubCall.call(regT0);
         emitGetJITStubArg(2, regT1);
 
         restoreReturnAddressBeforeReturn(regT3);
     }
 
-    // Assumes m_refCount can be decremented easily, refcount decrement is safe as 
-    // codeblock should ensure oldStructure->m_refCount > 0
-    sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
-    add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
-    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
+    storePtrWithWriteBarrier(TrustedImmPtr(newStructure), regT0, Address(regT0, JSCell::structureOffset()));
 
     // write the value
     compilePutDirectOffset(regT0, regT1, newStructure, cachedOffset);
@@ -668,27 +643,20 @@ void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, St
 
     int offset = sizeof(JSValue) * cachedOffset;
 
-    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
-    // and makes the subsequent load's offset automatically correct
-    if (structure->isUsingInlineStorage())
-        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad));
-
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure), structure);
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset), offset);
 }
 
-void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
+void JIT::patchMethodCallProto(JSGlobalData& globalData, CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
 {
     RepatchBuffer repatchBuffer(codeBlock);
 
     ASSERT(!methodCallLinkInfo.cachedStructure);
-    methodCallLinkInfo.cachedStructure = structure;
-    structure->ref();
+    methodCallLinkInfo.cachedStructure.set(globalData, codeBlock->ownerExecutable(), structure);
 
     Structure* prototypeStructure = proto->structure();
-    methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
-    prototypeStructure->ref();
+    methodCallLinkInfo.cachedPrototypeStructure.set(globalData, codeBlock->ownerExecutable(), prototypeStructure);
 
     repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
     repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
@@ -708,11 +676,6 @@ void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo,
 
     int offset = sizeof(JSValue) * cachedOffset;
 
-    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
-    // and makes the subsequent load's offset automatically correct
-    if (structure->isUsingInlineStorage())
-        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad));
-
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure), structure);
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset), offset);
@@ -723,12 +686,12 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
 
     // Check eax is an array
-    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
+    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsArrayVPtr));
 
     // Checks out okay! - get the length from the storage
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    loadPtr(Address(regT0, JSArray::storageOffset()), regT3);
     load32(Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
-    Jump failureCases2 = branch32(Above, regT2, Imm32(JSImmediate::maxImmediateInt));
+    Jump failureCases2 = branch32(LessThan, regT2, TrustedImm32(0));
 
     emitFastArithIntToImmNoCheck(regT2, regT0);
     Jump success = jump();
@@ -766,12 +729,12 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     Jump failureCases1 = checkStructure(regT0, structure);
 
     // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+    const void* prototypeStructureAddress = protoObject->addressOfStructure();
 #if CPU(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
+    move(TrustedImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), TrustedImmPtr(prototypeStructure));
 #endif
 
     bool needsStubLink = false;
@@ -779,22 +742,22 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     // Checks out okay!
     if (slot.cachedPropertyType() == PropertySlot::Getter) {
         needsStubLink = true;
-        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        compileGetDirectOffset(protoObject, regT1, cachedOffset);
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
-        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+        compileGetDirectOffset(protoObject, regT0, cachedOffset);
     Jump success = jump();
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool(), 0);
 
@@ -831,23 +794,19 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
     bool needsStubLink = false;
     if (slot.cachedPropertyType() == PropertySlot::Getter) {
         needsStubLink = true;
-        if (!structure->isUsingInlineStorage()) {
-            move(regT0, regT1);
-            compileGetDirectOffset(regT1, regT1, structure, cachedOffset);
-        } else
-            compileGetDirectOffset(regT0, regT1, structure, cachedOffset);
+        compileGetDirectOffset(regT0, regT1, structure, cachedOffset);
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
         compileGetDirectOffset(regT0, regT0, structure, cachedOffset);
@@ -874,8 +833,7 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
 
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
-    structure->ref();
-    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
+    polymorphicStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), entryLabel, structure);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
@@ -893,34 +851,34 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     Jump failureCases1 = checkStructure(regT0, structure);
 
     // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+    const void* prototypeStructureAddress = protoObject->addressOfStructure();
 #if CPU(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
+    move(TrustedImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), TrustedImmPtr(prototypeStructure));
 #endif
 
     // Checks out okay!
     bool needsStubLink = false;
     if (slot.cachedPropertyType() == PropertySlot::Getter) {
         needsStubLink = true;
-        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        compileGetDirectOffset(protoObject, regT1, cachedOffset);
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
-        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+        compileGetDirectOffset(protoObject, regT0, cachedOffset);
 
     Jump success = jump();
 
@@ -942,10 +900,7 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    structure->ref();
-    prototypeStructure->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
+    prototypeStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), entryLabel, structure, prototypeStructure);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
@@ -963,7 +918,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     bucketsOfFail.append(baseObjectCheck);
 
     Structure* currStructure = structure;
-    RefPtr<Structure>* it = chain->head();
+    WriteBarrier<Structure>* it = chain->head();
     JSObject* protoObject = 0;
     for (unsigned i = 0; i < count; ++i, ++it) {
         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
@@ -975,22 +930,22 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     bool needsStubLink = false;
     if (slot.cachedPropertyType() == PropertySlot::Getter) {
         needsStubLink = true;
-        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        compileGetDirectOffset(protoObject, regT1, cachedOffset);
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
-        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+        compileGetDirectOffset(protoObject, regT0, cachedOffset);
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool(), 0);
@@ -1013,9 +968,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
     // Track the stub we have created so that it will be deleted later.
-    structure->ref();
-    chain->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
+    prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), entryLabel, structure, chain);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
@@ -1033,7 +986,7 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     bucketsOfFail.append(checkStructure(regT0, structure));
 
     Structure* currStructure = structure;
-    RefPtr<Structure>* it = chain->head();
+    WriteBarrier<Structure>* it = chain->head();
     JSObject* protoObject = 0;
     for (unsigned i = 0; i < count; ++i, ++it) {
         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
@@ -1045,22 +998,22 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     bool needsStubLink = false;
     if (slot.cachedPropertyType() == PropertySlot::Getter) {
         needsStubLink = true;
-        compileGetDirectOffset(protoObject, regT1, regT1, cachedOffset);
+        compileGetDirectOffset(protoObject, regT1, cachedOffset);
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
-        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
+        compileGetDirectOffset(protoObject, regT0, cachedOffset);
     Jump success = jump();
 
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool(), 0);
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index 710a155..d0c3688 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -70,7 +70,7 @@ void JIT::emit_op_put_getter(Instruction* currentInstruction)
     
     JITStubCall stubCall(this, cti_op_put_getter);
     stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(property)));
     stubCall.addArgument(function);
     stubCall.call();
 }
@@ -83,7 +83,7 @@ void JIT::emit_op_put_setter(Instruction* currentInstruction)
     
     JITStubCall stubCall(this, cti_op_put_setter);
     stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(property)));
     stubCall.addArgument(function);
     stubCall.call();
 }
@@ -96,7 +96,7 @@ void JIT::emit_op_del_by_id(Instruction* currentInstruction)
     
     JITStubCall stubCall(this, cti_op_del_by_id);
     stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(property)));
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(property)));
     stubCall.call(dst);
 }
 
@@ -155,7 +155,7 @@ void JIT::emit_op_get_by_id(Instruction* currentInstruction)
     
     JITStubCall stubCall(this, cti_op_get_by_id_generic);
     stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(TrustedImmPtr(&(m_codeBlock->identifier(ident))));
     stubCall.call(dst);
     
     m_propertyAccessInstructionIndex++;
@@ -175,7 +175,7 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     
     JITStubCall stubCall(this, cti_op_put_by_id_generic);
     stubCall.addArgument(base);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(TrustedImmPtr(&(m_codeBlock->identifier(ident))));
     stubCall.addArgument(value);
     stubCall.call();
     
@@ -213,21 +213,21 @@ void JIT::emit_op_method_check(Instruction* currentInstruction)
     
     BEGIN_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
     
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
-    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT2);
-    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), info.structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(TrustedImmPtr(0), regT2);
+    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT2, JSCell::structureOffset()), protoStructureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     
     // This will be relinked to load the function without doing a load.
-    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+    DataLabelPtr putFunction = moveWithPatch(TrustedImmPtr(0), regT0);
     
     END_UNINTERRUPTED_SEQUENCE(sequenceMethodCheck);
     
-    move(Imm32(JSValue::CellTag), regT1);
+    move(TrustedImm32(JSValue::CellTag), regT1);
     Jump match = jump();
     
-    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
-    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
-    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
+    ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, protoObj), patchOffsetMethodCheckProtoObj);
+    ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, protoStructureToCompare), patchOffsetMethodCheckProtoStruct);
+    ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, putFunction), patchOffsetMethodCheckPutFunction);
     
     // Link the failure cases here.
     structureCheck.link(this);
@@ -271,7 +271,7 @@ JIT::CodePtr JIT::stringGetByValStubGenerator(JSGlobalData* globalData, Executab
 {
     JSInterfaceJIT jit;
     JumpList failures;
-    failures.append(jit.branchPtr(NotEqual, Address(regT0), ImmPtr(globalData->jsStringVPtr)));
+    failures.append(jit.branchPtr(NotEqual, Address(regT0), TrustedImmPtr(globalData->jsStringVPtr)));
     failures.append(jit.branchTest32(NonZero, Address(regT0, OBJECT_OFFSETOF(JSString, m_fiberCount))));
     
     // Load string length to regT1, and start the process of loading the data pointer into regT0
@@ -285,14 +285,14 @@ JIT::CodePtr JIT::stringGetByValStubGenerator(JSGlobalData* globalData, Executab
     // Load the character
     jit.load16(BaseIndex(regT0, regT2, TimesTwo, 0), regT0);
     
-    failures.append(jit.branch32(AboveOrEqual, regT0, Imm32(0x100)));
-    jit.move(ImmPtr(globalData->smallStrings.singleCharacterStrings()), regT1);
+    failures.append(jit.branch32(AboveOrEqual, regT0, TrustedImm32(0x100)));
+    jit.move(TrustedImmPtr(globalData->smallStrings.singleCharacterStrings()), regT1);
     jit.loadPtr(BaseIndex(regT1, regT0, ScalePtr, 0), regT0);
-    jit.move(Imm32(JSValue::CellTag), regT1); // We null check regT0 on return so this is safe
+    jit.move(TrustedImm32(JSValue::CellTag), regT1); // We null check regT0 on return so this is safe
     jit.ret();
 
     failures.link(&jit);
-    jit.move(Imm32(0), regT0);
+    jit.move(TrustedImm32(0), regT0);
     jit.ret();
     
     LinkBuffer patchBuffer(&jit, pool, 0);
@@ -307,16 +307,16 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     
     emitLoad2(base, regT1, regT0, property, regT3, regT2);
     
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     emitJumpSlowCaseIfNotJSCell(base, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsArrayVPtr)));
     
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    loadPtr(Address(regT0, JSArray::storageOffset()), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, JSArray::vectorLengthOffset())));
     
     load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1); // tag
     load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0); // payload
-    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
+    addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::EmptyValueTag)));
     
     emitStore(dst, regT1, regT0);
     map(m_bytecodeOffset + OPCODE_LENGTH(op_get_by_val), dst, regT1, regT0);
@@ -333,7 +333,7 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
 
     Jump nonCell = jump();
     linkSlowCase(iter); // base array check
-    Jump notString = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
+    Jump notString = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr));
     emitNakedCall(m_globalData->getCTIStub(stringGetByValStubGenerator));
     Jump failed = branchTestPtr(Zero, regT0);
     emitStore(dst, regT1, regT0);
@@ -359,14 +359,14 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
     
     emitLoad2(base, regT1, regT0, property, regT3, regT2);
     
-    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
     emitJumpSlowCaseIfNotJSCell(base, regT1);
-    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
-    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
+    addSlowCase(branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsArrayVPtr)));
+    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, JSArray::vectorLengthOffset())));
     
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
+    loadPtr(Address(regT0, JSArray::storageOffset()), regT3);
     
-    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), Imm32(JSValue::EmptyValueTag));
+    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
     
     Label storeResult(this);
     emitLoad(value, regT1, regT0);
@@ -375,10 +375,10 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
     Jump end = jump();
     
     empty.link(this);
-    add32(Imm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    add32(TrustedImm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
     branch32(Below, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length))).linkTo(storeResult, this);
     
-    add32(Imm32(1), regT2, regT0);
+    add32(TrustedImm32(1), regT2, regT0);
     store32(regT0, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_length)));
     jump().linkTo(storeResult, this);
     
@@ -429,23 +429,19 @@ void JIT::compileGetByIdHotPath()
     m_propertyAccessInstructionIndex++;
     
     DataLabelPtr structureToCompare;
-    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     addSlowCase(structureCheck);
-    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
-    ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
-    
-    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT2);
-    Label externalLoadComplete(this);
-    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
-    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureToCompare), patchOffsetGetByIdStructure);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureCheck), patchOffsetGetByIdBranchToSlowCase);
     
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), regT2);
     DataLabel32 displacementLabel1 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT0); // payload
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetGetByIdPropertyMapOffset1);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel1), patchOffsetGetByIdPropertyMapOffset1);
     DataLabel32 displacementLabel2 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT1); // tag
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetGetByIdPropertyMapOffset2);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel2), patchOffsetGetByIdPropertyMapOffset2);
     
     Label putResult(this);
-    ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, putResult), patchOffsetGetByIdPutResult);
     
     END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
 }
@@ -476,12 +472,12 @@ void JIT::compileGetByIdSlowCase(int dst, int base, Identifier* ident, Vector<Sl
 #endif
     JITStubCall stubCall(this, isMethodCheck ? cti_op_get_by_id_method_check : cti_op_get_by_id);
     stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(TrustedImmPtr(ident));
     Call call = stubCall.call(dst);
     
-    END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
+    END_UNINTERRUPTED_SEQUENCE_FOR_PUT(sequenceGetByIdSlowCase, dst);
     
-    ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
+    ASSERT_JIT_OFFSET(differenceBetween(coldPathBegin, call), patchOffsetGetByIdSlowCaseCall);
     
     // Track the location of the call; this will be used to recover patch information.
     m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
@@ -509,22 +505,17 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     
     // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
     DataLabelPtr structureToCompare;
-    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
-    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
-    
-    // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
-    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
-    Label externalLoadComplete(this);
-    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
-    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
+    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureToCompare), patchOffsetPutByIdStructure);
     
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), regT0);
     DataLabel32 displacementLabel1 = storePtrWithAddressOffsetPatch(regT2, Address(regT0, patchGetByIdDefaultOffset)); // payload
     DataLabel32 displacementLabel2 = storePtrWithAddressOffsetPatch(regT3, Address(regT0, patchGetByIdDefaultOffset)); // tag
     
     END_UNINTERRUPTED_SEQUENCE(sequencePutById);
     
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel1) == patchOffsetPutByIdPropertyMapOffset1);
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel2) == patchOffsetPutByIdPropertyMapOffset2);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel1), patchOffsetPutByIdPropertyMapOffset1);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel2), patchOffsetPutByIdPropertyMapOffset2);
 }
 
 void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -538,7 +529,7 @@ void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCase
     
     JITStubCall stubCall(this, direct ? cti_op_put_by_id_direct : cti_op_put_by_id);
     stubCall.addArgument(regT1, regT0);
-    stubCall.addArgument(ImmPtr(&(m_codeBlock->identifier(ident))));
+    stubCall.addArgument(TrustedImmPtr(&(m_codeBlock->identifier(ident))));
     stubCall.addArgument(regT3, regT2); 
     Call call = stubCall.call();
     
@@ -552,9 +543,9 @@ void JIT::compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterI
 {
     int offset = cachedOffset;
     if (structure->isUsingInlineStorage())
-        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) /  sizeof(Register);
+        offset += JSObject::offsetOfInlineStorage() /  sizeof(Register);
     else
-        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), base);
     emitStore(offset, valueTag, valuePayload, base);
 }
 
@@ -562,27 +553,20 @@ void JIT::compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterI
 void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset)
 {
     int offset = cachedOffset;
-    if (structure->isUsingInlineStorage())
-        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage) / sizeof(Register);
-    else
-        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
-    emitLoad(offset, resultTag, resultPayload, base);
+    if (structure->isUsingInlineStorage()) {
+        offset += JSObject::offsetOfInlineStorage() / sizeof(Register);
+        emitLoad(offset, resultTag, resultPayload, base);
+    } else {
+        RegisterID temp = resultPayload;
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), temp);
+        emitLoad(offset, resultTag, resultPayload, temp);
+    }
 }
 
-void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset)
+void JIT::compileGetDirectOffset(JSObject* base, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset)
 {
-    if (base->isUsingInlineStorage()) {
-        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload), resultPayload);
-        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag), resultTag);
-        return;
-    }
-    
-    size_t offset = cachedOffset * sizeof(JSValue);
-    
-    PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
-    loadPtr(static_cast<void*>(protoPropertyStorage), temp);
-    load32(Address(temp, offset + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
-    load32(Address(temp, offset + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    load32(reinterpret_cast<char*>(&base->m_propertyStorage[cachedOffset]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload), resultPayload);
+    load32(reinterpret_cast<char*>(&base->m_propertyStorage[cachedOffset]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag), resultTag);
 }
 
 void JIT::testPrototype(JSValue prototype, JumpList& failureCases)
@@ -595,10 +579,10 @@ void JIT::testPrototype(JSValue prototype, JumpList& failureCases)
     // values.  In the non X86_64 case, the generated code is slightly more efficient because it uses
     // two less instructions and doesn't require any scratch registers.
 #if CPU(X86_64)
-    move(ImmPtr(prototype.asCell()->structure()), regT3);
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&prototype.asCell()->m_structure), regT3));
+    move(TrustedImmPtr(prototype.asCell()->structure()), regT3);
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(prototype.asCell()->addressOfStructure()), regT3));
 #else
-    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&prototype.asCell()->m_structure), ImmPtr(prototype.asCell()->structure())));
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(prototype.asCell()->addressOfStructure()), TrustedImmPtr(prototype.asCell()->structure())));
 #endif
 }
 
@@ -607,13 +591,13 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
     // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
     
     JumpList failureCases;
-    failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
-    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
+    failureCases.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
+    failureCases.append(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(oldStructure)));
     testPrototype(oldStructure->storedPrototype(), failureCases);
     
     if (!direct) {
         // Verify that nothing in the prototype chain has a setter for this property. 
-        for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        for (WriteBarrier<Structure>* it = chain->head(); *it; ++it)
             testPrototype((*it)->storedPrototype(), failureCases);
     }
 
@@ -629,18 +613,16 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         stubCall.skipArgument(); // base
         stubCall.skipArgument(); // ident
         stubCall.skipArgument(); // value
-        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
-        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
+        stubCall.addArgument(TrustedImm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(TrustedImm32(newStructure->propertyStorageCapacity()));
         stubCall.call(regT0);
         
         restoreReturnAddressBeforeReturn(regT3);
     }
+
+    storePtrWithWriteBarrier(TrustedImmPtr(newStructure), regT0, Address(regT0, JSCell::structureOffset()));
     
-    sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
-    add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
-    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
-    
-#if CPU(MIPS)
+#if CPU(MIPS) || CPU(SH4)
     // For MIPS, we don't add sizeof(void*) to the stack offset.
     load32(Address(stackPointerRegister, OBJECT_OFFSETOF(JITStackFrame, args[2]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT3);
     load32(Address(stackPointerRegister, OBJECT_OFFSETOF(JITStackFrame, args[2]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT2);
@@ -683,29 +665,21 @@ void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, St
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
     
     int offset = sizeof(JSValue) * cachedOffset;
-    
-    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
-    // and makes the subsequent load's offset automatically correct
-    if (structure->isUsingInlineStorage())
-        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad));
-    
+
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure), structure);
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset1), offset + OBJECT_OFFSETOF(JSValue, u.asBits.payload)); // payload
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset2), offset + OBJECT_OFFSETOF(JSValue, u.asBits.tag)); // tag
 }
 
-void JIT::patchMethodCallProto(CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
+void JIT::patchMethodCallProto(JSGlobalData& globalData, CodeBlock* codeBlock, MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto, ReturnAddressPtr returnAddress)
 {
     RepatchBuffer repatchBuffer(codeBlock);
     
     ASSERT(!methodCallLinkInfo.cachedStructure);
-    methodCallLinkInfo.cachedStructure = structure;
-    structure->ref();
-    
+    methodCallLinkInfo.cachedStructure.set(globalData, codeBlock->ownerExecutable(), structure);
     Structure* prototypeStructure = proto->structure();
-    methodCallLinkInfo.cachedPrototypeStructure = prototypeStructure;
-    prototypeStructure->ref();
+    methodCallLinkInfo.cachedPrototypeStructure.set(globalData, codeBlock->ownerExecutable(), prototypeStructure);
     
     repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
     repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
@@ -724,12 +698,7 @@ void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo,
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(direct ? cti_op_put_by_id_direct_generic : cti_op_put_by_id_generic));
     
     int offset = sizeof(JSValue) * cachedOffset;
-    
-    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
-    // and makes the subsequent load's offset automatically correct
-    if (structure->isUsingInlineStorage())
-        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad));
-    
+
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure), structure);
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset1), offset + OBJECT_OFFSETOF(JSValue, u.asBits.payload)); // payload
@@ -743,15 +712,15 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     // regT0 holds a JSCell*
     
     // Check for array
-    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
+    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsArrayVPtr));
     
     // Checks out okay! - get the length from the storage
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
+    loadPtr(Address(regT0, JSArray::storageOffset()), regT2);
     load32(Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
     
-    Jump failureCases2 = branch32(Above, regT2, Imm32(INT_MAX));
+    Jump failureCases2 = branch32(Above, regT2, TrustedImm32(INT_MAX));
     move(regT2, regT0);
-    move(Imm32(JSValue::Int32Tag), regT1);
+    move(TrustedImm32(JSValue::Int32Tag), regT1);
     Jump success = jump();
     
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool(), 0);
@@ -788,33 +757,33 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     Jump failureCases1 = checkStructure(regT0, structure);
     
     // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+    const void* prototypeStructureAddress = protoObject->addressOfStructure();
 #if CPU(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
+    move(TrustedImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), TrustedImmPtr(prototypeStructure));
 #endif
     bool needsStubLink = false;
     // Checks out okay!
     if (slot.cachedPropertyType() == PropertySlot::Getter) {
         needsStubLink = true;
-        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        compileGetDirectOffset(protoObject, regT2, regT1, cachedOffset);
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
-        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     
     Jump success = jump();
     
@@ -856,23 +825,19 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
     bool needsStubLink = false;
     if (slot.cachedPropertyType() == PropertySlot::Getter) {
         needsStubLink = true;
-        if (!structure->isUsingInlineStorage()) {
-            move(regT0, regT1);
-            compileGetDirectOffset(regT1, regT2, regT1, structure, cachedOffset);
-        } else
-            compileGetDirectOffset(regT0, regT2, regT1, structure, cachedOffset);
+        compileGetDirectOffset(regT0, regT2, regT1, structure, cachedOffset);
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
         compileGetDirectOffset(regT0, regT1, regT0, structure, cachedOffset);
@@ -897,9 +862,8 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    
-    structure->ref();
-    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
+
+    polymorphicStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), entryLabel, structure);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
@@ -919,33 +883,33 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     Jump failureCases1 = checkStructure(regT0, structure);
     
     // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
+    const void* prototypeStructureAddress = protoObject->addressOfStructure();
 #if CPU(X86_64)
-    move(ImmPtr(prototypeStructure), regT3);
+    move(TrustedImmPtr(prototypeStructure), regT3);
     Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
-    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), TrustedImmPtr(prototypeStructure));
 #endif
     
     bool needsStubLink = false;
     if (slot.cachedPropertyType() == PropertySlot::Getter) {
         needsStubLink = true;
-        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        compileGetDirectOffset(protoObject, regT2, regT1, cachedOffset);
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
-        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     
     Jump success = jump();
     
@@ -965,10 +929,8 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
     
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    
-    structure->ref();
-    prototypeStructure->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
+
+    prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), entryLabel, structure, prototypeStructure);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
@@ -987,7 +949,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     bucketsOfFail.append(checkStructure(regT0, structure));
     
     Structure* currStructure = structure;
-    RefPtr<Structure>* it = chain->head();
+    WriteBarrier<Structure>* it = chain->head();
     JSObject* protoObject = 0;
     for (unsigned i = 0; i < count; ++i, ++it) {
         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
@@ -999,22 +961,22 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     bool needsStubLink = false;
     if (slot.cachedPropertyType() == PropertySlot::Getter) {
         needsStubLink = true;
-        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        compileGetDirectOffset(protoObject, regT2, regT1, cachedOffset);
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
-        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
 
     Jump success = jump();
     
@@ -1036,9 +998,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
     
     // Track the stub we have created so that it will be deleted later.
-    structure->ref();
-    chain->ref();
-    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
+    prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), entryLabel, structure, chain);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
@@ -1057,7 +1017,7 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     bucketsOfFail.append(checkStructure(regT0, structure));
     
     Structure* currStructure = structure;
-    RefPtr<Structure>* it = chain->head();
+    WriteBarrier<Structure>* it = chain->head();
     JSObject* protoObject = 0;
     for (unsigned i = 0; i < count; ++i, ++it) {
         protoObject = asObject(currStructure->prototypeForLookup(callFrame));
@@ -1069,22 +1029,22 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     bool needsStubLink = false;
     if (slot.cachedPropertyType() == PropertySlot::Getter) {
         needsStubLink = true;
-        compileGetDirectOffset(protoObject, regT2, regT2, regT1, cachedOffset);
+        compileGetDirectOffset(protoObject, regT2, regT1, cachedOffset);
         JITStubCall stubCall(this, cti_op_get_by_id_getter_stub);
         stubCall.addArgument(regT1);
         stubCall.addArgument(regT0);
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else if (slot.cachedPropertyType() == PropertySlot::Custom) {
         needsStubLink = true;
         JITStubCall stubCall(this, cti_op_get_by_id_custom_stub);
-        stubCall.addArgument(ImmPtr(protoObject));
-        stubCall.addArgument(ImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
-        stubCall.addArgument(ImmPtr(const_cast<Identifier*>(&ident)));
-        stubCall.addArgument(ImmPtr(stubInfo->callReturnLocation.executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(protoObject));
+        stubCall.addArgument(TrustedImmPtr(FunctionPtr(slot.customGetter()).executableAddress()));
+        stubCall.addArgument(TrustedImmPtr(const_cast<Identifier*>(&ident)));
+        stubCall.addArgument(TrustedImmPtr(stubInfo->callReturnLocation.executableAddress()));
         stubCall.call();
     } else
-        compileGetDirectOffset(protoObject, regT2, regT1, regT0, cachedOffset);
+        compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
     
     LinkBuffer patchBuffer(this, m_codeBlock->executablePool(), 0);
@@ -1117,21 +1077,13 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
 #endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset)
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID offset)
 {
-    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
-    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
     ASSERT(sizeof(JSValue) == 8);
     
-    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
-    Jump finishedLoad = jump();
-    notUsingInlineStorage.link(this);
-    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), base);
     loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
     loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
-    finishedLoad.link(this);
 }
 
 void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
@@ -1151,12 +1103,12 @@ void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
     emitLoadPayload(iter, regT1);
     
     // Test base's structure
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    loadPtr(Address(regT2, JSCell::structureOffset()), regT0);
     addSlowCase(branchPtr(NotEqual, regT0, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
     load32(addressFor(i), regT3);
-    sub32(Imm32(1), regT3);
+    sub32(TrustedImm32(1), regT3);
     addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
-    compileGetDirectOffset(regT2, regT1, regT0, regT0, regT3);    
+    compileGetDirectOffset(regT2, regT1, regT0, regT3);    
     
     emitStore(dst, regT1, regT0);
     map(m_bytecodeOffset + OPCODE_LENGTH(op_get_by_pname), dst, regT1, regT0);
diff --git a/Source/JavaScriptCore/jit/JITStubCall.h b/Source/JavaScriptCore/jit/JITStubCall.h
index 4478d06..a0341d6 100644
--- a/Source/JavaScriptCore/jit/JITStubCall.h
+++ b/Source/JavaScriptCore/jit/JITStubCall.h
@@ -99,13 +99,13 @@ namespace JSC {
             m_stackIndex += stackIndexStep;
         }
 
-        void addArgument(JIT::Imm32 argument)
+        void addArgument(JIT::TrustedImm32 argument)
         {
             m_jit->poke(argument, m_stackIndex);
             m_stackIndex += stackIndexStep;
         }
 
-        void addArgument(JIT::ImmPtr argument)
+        void addArgument(JIT::TrustedImmPtr argument)
         {
             m_jit->poke(argument, m_stackIndex);
             m_stackIndex += stackIndexStep;
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index 74f505f..953bd11 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -40,7 +40,7 @@
 #include "Debugger.h"
 #include "ExceptionHelpers.h"
 #include "GetterSetter.h"
-#include "GlobalEvalFunction.h"
+#include "Strong.h"
 #include "JIT.h"
 #include "JSActivation.h"
 #include "JSArray.h"
@@ -67,7 +67,7 @@ using namespace std;
 
 namespace JSC {
 
-#if OS(DARWIN) || OS(WINDOWS)
+#if OS(DARWIN) || (OS(WINDOWS) && CPU(X86))
 #define SYMBOL_STRING(name) "_" #name
 #else
 #define SYMBOL_STRING(name) #name
@@ -81,7 +81,7 @@ namespace JSC {
 
 #if (OS(LINUX) || OS(FREEBSD)) && CPU(X86_64)
 #define SYMBOL_STRING_RELOCATION(name) #name "@plt"
-#elif OS(DARWIN)
+#elif OS(DARWIN) || (CPU(X86_64) && COMPILER(MINGW) && !GCC_VERSION_AT_LEAST(4, 5, 0))
 #define SYMBOL_STRING_RELOCATION(name) "_" #name
 #elif CPU(X86) && COMPILER(MINGW)
 #define SYMBOL_STRING_RELOCATION(name) "@" #name "@4"
@@ -314,7 +314,79 @@ extern "C" {
 #define ENABLE_PROFILER_REFERENCE_OFFSET 96
 #define GLOBAL_DATA_OFFSET         100
 #define STACK_LENGTH               104
+#elif CPU(SH4)
+#define SYMBOL_STRING(name) #name
+/* code (r4), RegisterFile* (r5), CallFrame* (r6), JSValue* exception (r7), Profiler**(sp), JSGlobalData (sp)*/
+
+asm volatile (
+".text\n"
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+HIDE_SYMBOL(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "mov.l r7, @-r15" "\n"
+    "mov.l r6, @-r15" "\n"
+    "mov.l r5, @-r15" "\n"
+    "mov.l r8, @-r15" "\n"
+    "mov #127, r8" "\n"
+    "mov.l r14, @-r15" "\n"
+    "sts.l pr, @-r15" "\n"
+    "mov.l r13, @-r15" "\n"
+    "mov.l r11, @-r15" "\n"
+    "mov.l r10, @-r15" "\n"
+    "add #-60, r15" "\n"
+    "mov r6, r14" "\n"
+    "jsr @r4" "\n"
+    "nop" "\n"
+    "add #60, r15" "\n"
+    "mov.l @r15+,r10" "\n"
+    "mov.l @r15+,r11" "\n"
+    "mov.l @r15+,r13" "\n"
+    "lds.l @r15+,pr" "\n"
+    "mov.l @r15+,r14" "\n"
+    "mov.l @r15+,r8" "\n"
+    "add #12, r15" "\n"
+    "rts" "\n"
+    "nop" "\n"
+);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "mov.l .L2"SYMBOL_STRING(cti_vm_throw)",r0" "\n"
+    "mov r15, r4" "\n"
+    "mov.l @(r0,r12),r11" "\n"
+    "jsr @r11" "\n"
+    "nop" "\n"
+    "add #60, r15" "\n"
+    "mov.l @r15+,r10" "\n"
+    "mov.l @r15+,r11" "\n"
+    "mov.l @r15+,r13" "\n"
+    "lds.l @r15+,pr" "\n"
+    "mov.l @r15+,r14" "\n"
+    "mov.l @r15+,r8" "\n"
+    "add #12, r15" "\n"
+    "rts" "\n"
+    "nop" "\n"
+    ".align 2" "\n"
+    ".L2"SYMBOL_STRING(cti_vm_throw)":.long " SYMBOL_STRING(cti_vm_throw)"@GOT \n"
+);
 
+asm volatile (
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "add #60, r15" "\n"
+    "mov.l @r15+,r10" "\n"
+    "mov.l @r15+,r11" "\n"
+    "mov.l @r15+,r13" "\n"
+    "lds.l @r15+,pr" "\n"
+    "mov.l @r15+,r14" "\n"
+    "mov.l @r15+,r8" "\n"
+    "add #12, r15" "\n"
+    "rts" "\n"
+    "nop" "\n"
+);
 #else
     #error "JIT not supported on this platform."
 #endif
@@ -680,6 +752,7 @@ __asm void ctiOpThrowNotCaught()
 #endif
 
 JITThunks::JITThunks(JSGlobalData* globalData)
+    : m_hostFunctionStubMap(new HostFunctionStubMap)
 {
     if (!globalData->executableAllocator.isValid())
         return;
@@ -717,7 +790,7 @@ JITThunks::JITThunks(JSGlobalData* globalData)
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == THUNK_RETURN_ADDRESS_OFFSET);
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, registerFile) == REGISTER_FILE_OFFSET);
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, callFrame) == CALLFRAME_OFFSET);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, exception) == EXCEPTION_OFFSET);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, unused1) == EXCEPTION_OFFSET);
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, enabledProfilerReference) == ENABLE_PROFILER_REFERENCE_OFFSET);
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, globalData) == GLOBAL_DATA_OFFSET);
 
@@ -770,12 +843,12 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
         normalizePrototypeChain(callFrame, baseCell);
 
         StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-        stubInfo->initPutByIdTransition(structure->previousID(), structure, prototypeChain);
+        stubInfo->initPutByIdTransition(callFrame->globalData(), codeBlock->ownerExecutable(), structure->previousID(), structure, prototypeChain);
         JIT::compilePutByIdTransition(callFrame->scopeChain()->globalData, codeBlock, stubInfo, structure->previousID(), structure, slot.cachedOffset(), prototypeChain, returnAddress, direct);
         return;
     }
     
-    stubInfo->initPutByIdReplace(structure);
+    stubInfo->initPutByIdReplace(callFrame->globalData(), codeBlock->ownerExecutable(), structure);
 
     JIT::patchPutByIdReplace(codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress, direct);
 }
@@ -823,7 +896,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
 
     if (slot.slotBase() == baseValue) {
         // set this up, so derefStructures can do it's job.
-        stubInfo->initGetByIdSelf(structure);
+        stubInfo->initGetByIdSelf(callFrame->globalData(), codeBlock->ownerExecutable(), structure);
         if (slot.cachedPropertyType() != PropertySlot::Value)
             ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
         else
@@ -846,10 +919,10 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary()) {
             slotBaseObject->flattenDictionaryObject(callFrame->globalData());
-            offset = slotBaseObject->structure()->get(propertyName);
+            offset = slotBaseObject->structure()->get(callFrame->globalData(), propertyName);
         }
         
-        stubInfo->initGetByIdProto(structure, slotBaseObject->structure());
+        stubInfo->initGetByIdProto(callFrame->globalData(), codeBlock->ownerExecutable(), structure, slotBaseObject->structure());
 
         ASSERT(!structure->isDictionary());
         ASSERT(!slotBaseObject->structure()->isDictionary());
@@ -865,7 +938,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
     }
 
     StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-    stubInfo->initGetByIdChain(structure, prototypeChain);
+    stubInfo->initGetByIdChain(callFrame->globalData(), codeBlock->ownerExecutable(), structure, prototypeChain);
     JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, propertyName, slot, offset, returnAddress);
 }
 
@@ -942,17 +1015,17 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
-        if (UNLIKELY(stackFrame.globalData->exception.get())) \
+        if (UNLIKELY(stackFrame.globalData->exception)) \
             VM_THROW_EXCEPTION(); \
     } while (0)
 #define CHECK_FOR_EXCEPTION_AT_END() \
     do { \
-        if (UNLIKELY(stackFrame.globalData->exception.get())) \
+        if (UNLIKELY(stackFrame.globalData->exception)) \
             VM_THROW_EXCEPTION_AT_END(); \
     } while (0)
 #define CHECK_FOR_EXCEPTION_VOID() \
     do { \
-        if (UNLIKELY(stackFrame.globalData->exception.get())) { \
+        if (UNLIKELY(stackFrame.globalData->exception)) { \
             VM_THROW_EXCEPTION_AT_END(); \
             return; \
         } \
@@ -977,7 +1050,7 @@ static ExceptionHandler jitThrow(JSGlobalData* globalData, CallFrame* callFrame,
     return exceptionHandler;
 }
 
-#if CPU(ARM_THUMB2)
+#if CPU(ARM_THUMB2) && COMPILER(GCC)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) \
     extern "C" { \
@@ -1073,7 +1146,7 @@ static ExceptionHandler jitThrow(JSGlobalData* globalData, CallFrame* callFrame,
         ); \
     rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
 
-#elif CPU(ARM_TRADITIONAL) && COMPILER(RVCT)
+#elif (CPU(ARM_THUMB2) || CPU(ARM_TRADITIONAL)) && COMPILER(RVCT)
 
 #define DEFINE_STUB_FUNCTION(rtype, op) rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
 
@@ -1086,7 +1159,7 @@ static ExceptionHandler jitThrow(JSGlobalData* globalData, CallFrame* callFrame,
 RVCT(extern "C" #rtype# JITStubThunked_#op#(STUB_ARGS_DECLARATION);)
 RVCT(__asm #rtype# cti_#op#(STUB_ARGS_DECLARATION))
 RVCT({)
-RVCT(    ARM)
+RVCT(    PRESERVE8)
 RVCT(    IMPORT JITStubThunked_#op#)
 RVCT(    str lr, [sp, # THUNK_RETURN_ADDRESS_OFFSET])
 RVCT(    bl JITStubThunked_#op#)
@@ -1155,6 +1228,29 @@ MSVC()
 MSVC_END(    END)
 */
 
+#elif CPU(SH4)
+#define DEFINE_STUB_FUNCTION(rtype, op) \
+    extern "C" { \
+        rtype JITStubThunked_##op(STUB_ARGS_DECLARATION); \
+    }; \
+    asm volatile( \
+    ".align 2" "\n" \
+    ".globl " SYMBOL_STRING(cti_##op) "\n" \
+    SYMBOL_STRING(cti_##op) ":" "\n" \
+    "sts pr, r11" "\n" \
+    "mov.l r11, @(0x38, r15)" "\n" \
+    "mov.l .L2"SYMBOL_STRING(JITStubThunked_##op)",r0" "\n" \
+    "mov.l @(r0,r12),r11" "\n" \
+    "jsr @r11" "\n" \
+    "nop" "\n" \
+    "mov.l @(0x38, r15), r11 " "\n" \
+    "lds r11, pr " "\n" \
+    "rts" "\n" \
+    "nop" "\n" \
+    ".align 2" "\n" \
+    ".L2"SYMBOL_STRING(JITStubThunked_##op)":.long " SYMBOL_STRING(JITStubThunked_##op)"@GOT \n" \
+    ); \
+    rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
 #else
 #define DEFINE_STUB_FUNCTION(rtype, op) rtype JIT_STUB cti_##op(STUB_ARGS_DECLARATION)
 #endif
@@ -1173,10 +1269,10 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_create_this)
     Structure* structure;
     JSValue proto = stackFrame.args[0].jsValue();
     if (proto.isObject())
-        structure = asObject(proto)->inheritorID();
+        structure = asObject(proto)->inheritorID(*stackFrame.globalData);
     else
-        structure = constructor->scope().node()->globalObject->emptyObjectStructure();
-    JSValue result = new (&callFrame->globalData()) JSObject(structure);
+        structure = constructor->scope()->globalObject->emptyObjectStructure();
+    JSValue result = constructEmptyObject(callFrame, structure);
 
     return JSValue::encode(result);
 }
@@ -1205,15 +1301,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_convert_this_strict)
     return JSValue::encode(result);
 }
 
-DEFINE_STUB_FUNCTION(void, op_end)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    ScopeChainNode* scopeChain = stackFrame.callFrame->scopeChain();
-    ASSERT(scopeChain->refCount > 1);
-    scopeChain->deref();
-}
-
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_add)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -1473,7 +1560,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
 
         // Check to see if the function is on the object's prototype.  Patch up the code to optimize.
         if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
-            JIT::patchMethodCallProto(codeBlock, methodCallLinkInfo, callee, structure, slotBaseObject, STUB_RETURN_ADDRESS);
+            JIT::patchMethodCallProto(callFrame->globalData(), codeBlock, methodCallLinkInfo, callee, structure, slotBaseObject, STUB_RETURN_ADDRESS);
             return JSValue::encode(result);
         }
 
@@ -1484,7 +1571,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
         // for now.  For now it performs a check on a special object on the global object only used for this
         // purpose.  The object is in no way exposed, and as such the check will always pass.
         if (slot.slotBase() == baseValue) {
-            JIT::patchMethodCallProto(codeBlock, methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject->methodCallDummy(), STUB_RETURN_ADDRESS);
+            JIT::patchMethodCallProto(callFrame->globalData(), codeBlock, methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject->methodCallDummy(), STUB_RETURN_ADDRESS);
             return JSValue::encode(result);
         }
     }
@@ -1543,7 +1630,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
 
         if (stubInfo->accessType == access_get_by_id_self) {
             ASSERT(!stubInfo->stubRoutine);
-            polymorphicStructureList = new PolymorphicAccessStructureList(CodeLocationLabel(), stubInfo->u.getByIdSelf.baseObjectStructure);
+            polymorphicStructureList = new PolymorphicAccessStructureList(callFrame->globalData(), codeBlock->ownerExecutable(), CodeLocationLabel(), stubInfo->u.getByIdSelf.baseObjectStructure.get());
             stubInfo->initGetByIdSelfList(polymorphicStructureList, 1);
         } else {
             polymorphicStructureList = stubInfo->u.getByIdSelfList.structureList;
@@ -1561,19 +1648,19 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
     return JSValue::encode(result);
 }
 
-static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(StructureStubInfo* stubInfo, int& listIndex)
+static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(JSGlobalData& globalData, ScriptExecutable* owner, StructureStubInfo* stubInfo, int& listIndex)
 {
     PolymorphicAccessStructureList* prototypeStructureList = 0;
     listIndex = 1;
 
     switch (stubInfo->accessType) {
     case access_get_by_id_proto:
-        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdProto.baseObjectStructure, stubInfo->u.getByIdProto.prototypeStructure);
+        prototypeStructureList = new PolymorphicAccessStructureList(globalData, owner, stubInfo->stubRoutine, stubInfo->u.getByIdProto.baseObjectStructure.get(), stubInfo->u.getByIdProto.prototypeStructure.get());
         stubInfo->stubRoutine = CodeLocationLabel();
         stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
         break;
     case access_get_by_id_chain:
-        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure, stubInfo->u.getByIdChain.chain);
+        prototypeStructureList = new PolymorphicAccessStructureList(globalData, owner, stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure.get(), stubInfo->u.getByIdChain.chain.get());
         stubInfo->stubRoutine = CodeLocationLabel();
         stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
         break;
@@ -1657,11 +1744,11 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
         // should not be treated as a dictionary.
         if (slotBaseObject->structure()->isDictionary()) {
             slotBaseObject->flattenDictionaryObject(callFrame->globalData());
-            offset = slotBaseObject->structure()->get(propertyName);
+            offset = slotBaseObject->structure()->get(callFrame->globalData(), propertyName);
         }
 
         int listIndex;
-        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(callFrame->globalData(), codeBlock->ownerExecutable(), stubInfo, listIndex);
         if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
             JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), propertyName, slot, offset);
 
@@ -1671,7 +1758,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
     } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset)) {
         ASSERT(!baseValue.asCell()->structure()->isDictionary());
         int listIndex;
-        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(callFrame->globalData(), codeBlock->ownerExecutable(), stubInfo, listIndex);
         
         if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
             StructureChain* protoChain = structure->prototypeChain(callFrame);
@@ -1848,7 +1935,7 @@ DEFINE_STUB_FUNCTION(void*, op_call_jitCompile)
     JSFunction* function = asFunction(stackFrame.callFrame->callee());
     ASSERT(!function->isHostFunction());
     FunctionExecutable* executable = function->jsExecutable();
-    ScopeChainNode* callDataScopeChain = function->scope().node();
+    ScopeChainNode* callDataScopeChain = function->scope();
     JSObject* error = executable->compileForCall(stackFrame.callFrame, callDataScopeChain);
     if (error) {
         stackFrame.callFrame->globalData().exception = error;
@@ -1869,7 +1956,7 @@ DEFINE_STUB_FUNCTION(void*, op_construct_jitCompile)
     JSFunction* function = asFunction(stackFrame.callFrame->callee());
     ASSERT(!function->isHostFunction());
     FunctionExecutable* executable = function->jsExecutable();
-    ScopeChainNode* callDataScopeChain = function->scope().node();
+    ScopeChainNode* callDataScopeChain = function->scope();
     JSObject* error = executable->compileForConstruct(stackFrame.callFrame, callDataScopeChain);
     if (error) {
         stackFrame.callFrame->globalData().exception = error;
@@ -1930,7 +2017,7 @@ DEFINE_STUB_FUNCTION(void*, op_call_arityCheck)
     callFrame->setCallerFrame(oldCallFrame);
     callFrame->setArgumentCountIncludingThis(argCount);
     callFrame->setCallee(callee);
-    callFrame->setScopeChain(callee->scope().node());
+    callFrame->setScopeChain(callee->scope());
     callFrame->setReturnPC(pc.value());
 
     ASSERT((void*)callFrame <= stackFrame.registerFile->end());
@@ -1989,7 +2076,7 @@ DEFINE_STUB_FUNCTION(void*, op_construct_arityCheck)
     callFrame->setCallerFrame(oldCallFrame);
     callFrame->setArgumentCountIncludingThis(argCount);
     callFrame->setCallee(callee);
-    callFrame->setScopeChain(callee->scope().node());
+    callFrame->setScopeChain(callee->scope());
     callFrame->setReturnPC(pc.value());
 
     ASSERT((void*)callFrame <= stackFrame.registerFile->end());
@@ -2010,7 +2097,7 @@ DEFINE_STUB_FUNCTION(void*, vm_lazyLinkCall)
         codePtr = executable->generatedJITCodeForCall().addressForCall();
     else {
         FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
-        JSObject* error = functionExecutable->compileForCall(callFrame, callee->scope().node());
+        JSObject* error = functionExecutable->compileForCall(callFrame, callee->scope());
         if (error) {
             callFrame->globalData().exception = createStackOverflowError(callFrame);
             return 0;
@@ -2044,7 +2131,7 @@ DEFINE_STUB_FUNCTION(void*, vm_lazyLinkConstruct)
         codePtr = executable->generatedJITCodeForConstruct().addressForCall();
     else {
         FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
-        JSObject* error = functionExecutable->compileForConstruct(callFrame, callee->scope().node());
+        JSObject* error = functionExecutable->compileForConstruct(callFrame, callee->scope());
         if (error) {
             throwStackOverflowError(callFrame, stackFrame.globalData, ReturnAddressPtr(callFrame->returnPC()), STUB_RETURN_ADDRESS);
             return 0;
@@ -2071,7 +2158,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_push_activation)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     JSActivation* activation = new (stackFrame.globalData) JSActivation(stackFrame.callFrame, static_cast<FunctionExecutable*>(stackFrame.callFrame->codeBlock()->ownerExecutable()));
-    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->copy()->push(activation));
+    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->push(activation));
     return activation;
 }
 
@@ -2139,12 +2226,12 @@ DEFINE_STUB_FUNCTION(void, op_tear_off_activation)
     if (!activationValue) {
         if (JSValue v = stackFrame.args[1].jsValue()) {
             if (!stackFrame.callFrame->codeBlock()->isStrictMode())
-                asArguments(v)->copyRegisters();
+                asArguments(v)->copyRegisters(*stackFrame.globalData);
         }
         return;
     }
     JSActivation* activation = asActivation(stackFrame.args[0].jsValue());
-    activation->copyRegisters();
+    activation->copyRegisters(*stackFrame.globalData);
     if (JSValue v = stackFrame.args[1].jsValue()) {
         if (!stackFrame.callFrame->codeBlock()->isStrictMode())
             asArguments(v)->setActivation(*stackFrame.globalData, activation);
@@ -2156,7 +2243,7 @@ DEFINE_STUB_FUNCTION(void, op_tear_off_arguments)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     ASSERT(stackFrame.callFrame->codeBlock()->usesArguments() && !stackFrame.callFrame->codeBlock()->needsFullScopeChain());
-    asArguments(stackFrame.args[0].jsValue())->copyRegisters();
+    asArguments(stackFrame.args[0].jsValue())->copyRegisters(*stackFrame.globalData);
 }
 
 DEFINE_STUB_FUNCTION(void, op_profile_will_call)
@@ -2175,14 +2262,6 @@ DEFINE_STUB_FUNCTION(void, op_profile_did_call)
     (*stackFrame.enabledProfilerReference)->didExecute(stackFrame.callFrame, stackFrame.args[0].jsValue());
 }
 
-DEFINE_STUB_FUNCTION(void, op_ret_scopeChain)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-
-    ASSERT(stackFrame.callFrame->codeBlock()->needsFullScopeChain());
-    stackFrame.callFrame->scopeChain()->deref();
-}
-
 DEFINE_STUB_FUNCTION(JSObject*, op_new_array)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2525,7 +2604,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs)
             stackFrame.globalData->exception = createInvalidParamError(callFrame, "Function.prototype.apply", arguments);
             VM_THROW_EXCEPTION();
         }
-        if (asObject(arguments)->classInfo() == &Arguments::info) {
+        if (asObject(arguments)->classInfo() == &Arguments::s_info) {
             Arguments* argsObject = asArguments(arguments);
             argCount = argsObject->numProvidedArguments(callFrame);
             argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments));
@@ -2547,7 +2626,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs)
                 VM_THROW_EXCEPTION();
             }
             array->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
-        } else if (asObject(arguments)->inherits(&JSArray::info)) {
+        } else if (asObject(arguments)->inherits(&JSArray::s_info)) {
             JSObject* argObject = asObject(arguments);
             argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
             argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments));
@@ -2674,10 +2753,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_global)
         JSValue result = slot.getValue(callFrame, ident);
         if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
             GlobalResolveInfo& globalResolveInfo = codeBlock->globalResolveInfo(globalResolveInfoIndex);
-            if (globalResolveInfo.structure)
-                globalResolveInfo.structure->deref();
-            globalObject->structure()->ref();
-            globalResolveInfo.structure = globalObject->structure();
+            globalResolveInfo.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), globalObject->structure());
             globalResolveInfo.offset = slot.cachedOffset();
             return JSValue::encode(result);
         }
@@ -3009,7 +3085,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_new_func_exp)
      */
     if (!function->name().isNull()) {
         JSStaticScopeObject* functionScopeObject = new (callFrame) JSStaticScopeObject(callFrame, function->name(), func, ReadOnly | DontDelete);
-        func->scope().push(functionScopeObject);
+        func->setScope(callFrame->globalData(), func->scope()->push(functionScopeObject));
     }
 
     return func;
@@ -3085,7 +3161,15 @@ DEFINE_STUB_FUNCTION(JSObject*, op_new_regexp)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return new (stackFrame.globalData) RegExpObject(stackFrame.callFrame->lexicalGlobalObject(), stackFrame.callFrame->lexicalGlobalObject()->regExpStructure(), stackFrame.args[0].regExp());
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    RegExp* regExp = stackFrame.args[0].regExp();
+    if (!regExp->isValid()) {
+        stackFrame.globalData->exception = createSyntaxError(callFrame, "Invalid flags supplied to RegExp constructor.");
+        VM_THROW_EXCEPTION();
+    }
+
+    return new (stackFrame.globalData) RegExpObject(stackFrame.callFrame->lexicalGlobalObject(), stackFrame.callFrame->lexicalGlobalObject()->regExpStructure(), regExp);
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitor)
@@ -3119,7 +3203,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_eval)
     Register* newCallFrame = callFrame->registers() + registerOffset;
     Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
     JSValue baseValue = argv[0].jsValue();
-    JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject;
+    JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject.get();
 
     if (baseValue == globalObject && funcVal == globalObject->evalFunction()) {
         JSValue result = interpreter->callEval(callFrame, registerFile, argv, argCount, registerOffset);
@@ -3480,7 +3564,7 @@ DEFINE_STUB_FUNCTION(void*, vm_throw)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
     JSGlobalData* globalData = stackFrame.globalData;
-    ExceptionHandler handler = jitThrow(globalData, stackFrame.callFrame, globalData->exception.get(), globalData->exceptionLocation);
+    ExceptionHandler handler = jitThrow(globalData, stackFrame.callFrame, globalData->exception, globalData->exceptionLocation);
     STUB_SET_RETURN_ADDRESS(handler.catchRoutine);
     return handler.callFrame;
 }
@@ -3501,22 +3585,27 @@ MacroAssemblerCodePtr JITThunks::ctiStub(JSGlobalData* globalData, ThunkGenerato
     return entry.first->second;
 }
 
-PassRefPtr<NativeExecutable> JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFunction function)
+NativeExecutable* JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFunction function)
 {
-    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap.add(function, 0);
+    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, Strong<NativeExecutable>());
     if (entry.second)
-        entry.first->second = NativeExecutable::create(JIT::compileCTINativeCall(globalData, m_executablePool, function), function, ctiNativeConstruct(), callHostFunctionAsConstructor);
-    return entry.first->second;
+        entry.first->second.set(*globalData, NativeExecutable::create(*globalData, JIT::compileCTINativeCall(globalData, m_executablePool, function), function, ctiNativeConstruct(), callHostFunctionAsConstructor));
+    return entry.first->second.get();
 }
 
-PassRefPtr<NativeExecutable> JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFunction function, ThunkGenerator generator)
+NativeExecutable* JITThunks::hostFunctionStub(JSGlobalData* globalData, NativeFunction function, ThunkGenerator generator)
 {
-    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap.add(function, 0);
+    std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, Strong<NativeExecutable>());
     if (entry.second) {
         MacroAssemblerCodePtr code = globalData->canUseJIT() ? generator(globalData, m_executablePool.get()) : MacroAssemblerCodePtr();
-        entry.first->second = NativeExecutable::create(code, function, ctiNativeConstruct(), callHostFunctionAsConstructor);
+        entry.first->second.set(*globalData, NativeExecutable::create(*globalData, code, function, ctiNativeConstruct(), callHostFunctionAsConstructor));
     }
-    return entry.first->second;
+    return entry.first->second.get();
+}
+
+void JITThunks::clearHostFunctionStubs()
+{
+    m_hostFunctionStubMap.clear();
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/jit/JITStubs.h b/Source/JavaScriptCore/jit/JITStubs.h
index 66edf45..7c67f6e 100644
--- a/Source/JavaScriptCore/jit/JITStubs.h
+++ b/Source/JavaScriptCore/jit/JITStubs.h
@@ -229,6 +229,27 @@ namespace JSC {
 
         ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
     };
+#elif CPU(SH4)
+    struct JITStackFrame {
+        JITStubArg padding; // Unused
+        JITStubArg args[6];
+
+        ReturnAddressPtr thunkReturnAddress;
+        void* savedR10;
+        void* savedR11;
+        void* savedR13;
+        void* savedRPR;
+        void* savedR14;
+        void* savedTimeoutReg;
+
+        RegisterFile* registerFile;
+        CallFrame* callFrame;
+        JSValue* exception;
+        Profiler** enabledProfilerReference;
+        JSGlobalData* globalData;
+
+        ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
+    };
 #else
 #error "JITStackFrame not defined for this platform."
 #endif
@@ -254,6 +275,8 @@ namespace JSC {
     extern "C" void ctiOpThrowNotCaught();
     extern "C" EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, void* /*unused1*/, Profiler**, JSGlobalData*);
 
+    template <typename T> class Strong;
+
     class JITThunks {
     public:
         JITThunks(JSGlobalData*);
@@ -273,13 +296,16 @@ namespace JSC {
 
         MacroAssemblerCodePtr ctiStub(JSGlobalData* globalData, ThunkGenerator generator);
 
-        PassRefPtr<NativeExecutable> hostFunctionStub(JSGlobalData* globalData, NativeFunction func);
-        PassRefPtr<NativeExecutable> hostFunctionStub(JSGlobalData* globalData, NativeFunction func, ThunkGenerator generator);
+        NativeExecutable* hostFunctionStub(JSGlobalData*, NativeFunction);
+        NativeExecutable* hostFunctionStub(JSGlobalData*, NativeFunction, ThunkGenerator);
+
+        void clearHostFunctionStubs();
+
     private:
         typedef HashMap<ThunkGenerator, MacroAssemblerCodePtr> CTIStubMap;
         CTIStubMap m_ctiStubMap;
-        typedef HashMap<NativeFunction, RefPtr<NativeExecutable> > HostFunctionStubMap;
-        HostFunctionStubMap m_hostFunctionStubMap;
+        typedef HashMap<NativeFunction, Strong<NativeExecutable> > HostFunctionStubMap;
+        OwnPtr<HostFunctionStubMap> m_hostFunctionStubMap;
         RefPtr<ExecutablePool> m_executablePool;
 
         TrampolineStructure m_trampolineStructure;
@@ -390,7 +416,6 @@ extern "C" {
     void JIT_STUB cti_op_put_by_val_byte_array(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_getter(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_put_setter(STUB_ARGS_DECLARATION);
-    void JIT_STUB cti_op_ret_scopeChain(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_tear_off_activation(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_throw_reference_error(STUB_ARGS_DECLARATION);
diff --git a/Source/JavaScriptCore/jit/JSInterfaceJIT.h b/Source/JavaScriptCore/jit/JSInterfaceJIT.h
index 6453bab..e1d9353 100644
--- a/Source/JavaScriptCore/jit/JSInterfaceJIT.h
+++ b/Source/JavaScriptCore/jit/JSInterfaceJIT.h
@@ -28,7 +28,7 @@
 
 #include "JITCode.h"
 #include "JITStubs.h"
-#include "JSImmediate.h"
+#include "JSValue.h"
 #include "MacroAssembler.h"
 #include "RegisterFile.h"
 #include <wtf/AlwaysInline.h>
@@ -153,17 +153,54 @@ namespace JSC {
         static const FPRegisterID fpRegT1 = MIPSRegisters::f6;
         static const FPRegisterID fpRegT2 = MIPSRegisters::f8;
         static const FPRegisterID fpRegT3 = MIPSRegisters::f10;
+#elif CPU(SH4)
+        static const RegisterID timeoutCheckRegister = SH4Registers::r8;
+        static const RegisterID callFrameRegister = SH4Registers::fp;
+
+        static const RegisterID regT0 = SH4Registers::r0;
+        static const RegisterID regT1 = SH4Registers::r1;
+        static const RegisterID regT2 = SH4Registers::r2;
+        static const RegisterID regT3 = SH4Registers::r10;
+        static const RegisterID regT4 = SH4Registers::r4;
+        static const RegisterID regT5 = SH4Registers::r5;
+        static const RegisterID regT6 = SH4Registers::r6;
+        static const RegisterID regT7 = SH4Registers::r7;
+        static const RegisterID firstArgumentRegister =regT4;
+
+        static const RegisterID returnValueRegister = SH4Registers::r0;
+        static const RegisterID cachedResultRegister = SH4Registers::r0;
+
+        static const FPRegisterID fpRegT0  = SH4Registers::fr0;
+        static const FPRegisterID fpRegT1  = SH4Registers::fr2;
+        static const FPRegisterID fpRegT2  = SH4Registers::fr4;
+        static const FPRegisterID fpRegT3  = SH4Registers::fr6;
+        static const FPRegisterID fpRegT4  = SH4Registers::fr8;
+        static const FPRegisterID fpRegT5  = SH4Registers::fr10;
+        static const FPRegisterID fpRegT6  = SH4Registers::fr12;
+        static const FPRegisterID fpRegT7  = SH4Registers::fr14;
 #else
 #error "JIT not supported on this platform."
 #endif
 
+#if USE(JSVALUE32_64)
+        // Can't just propogate JSValue::Int32Tag as visual studio doesn't like it
+        static const unsigned Int32Tag = 0xffffffff;
+        COMPILE_ASSERT(Int32Tag == JSValue::Int32Tag, Int32Tag_out_of_sync);
+#else
+        static const unsigned Int32Tag = TagTypeNumber >> 32;
+#endif
         inline Jump emitLoadJSCell(unsigned virtualRegisterIndex, RegisterID payload);
         inline Jump emitLoadInt32(unsigned virtualRegisterIndex, RegisterID dst);
         inline Jump emitLoadDouble(unsigned virtualRegisterIndex, FPRegisterID dst, RegisterID scratch);
 
+        inline void storePtrWithWriteBarrier(TrustedImmPtr ptr, RegisterID /* owner */, Address dest)
+        {
+            storePtr(ptr, dest);
+        }
+
 #if USE(JSVALUE32_64)
         inline Jump emitJumpIfNotJSCell(unsigned virtualRegisterIndex);
-        inline Address tagFor(unsigned index, RegisterID base = callFrameRegister);
+        inline Address tagFor(int index, RegisterID base = callFrameRegister);
 #endif
 
 #if USE(JSVALUE64)
@@ -172,8 +209,10 @@ namespace JSC {
         void emitFastArithImmToInt(RegisterID reg);
 #endif
 
-        inline Address payloadFor(unsigned index, RegisterID base = callFrameRegister);
-        inline Address addressFor(unsigned index, RegisterID base = callFrameRegister);
+        inline Address payloadFor(int index, RegisterID base = callFrameRegister);
+        inline Address intPayloadFor(int index, RegisterID base = callFrameRegister);
+        inline Address intTagFor(int index, RegisterID base = callFrameRegister);
+        inline Address addressFor(int index, RegisterID base = callFrameRegister);
     };
 
     struct ThunkHelpers {
@@ -192,34 +231,44 @@ namespace JSC {
     inline JSInterfaceJIT::Jump JSInterfaceJIT::emitJumpIfNotJSCell(unsigned virtualRegisterIndex)
     {
         ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
-        return branch32(NotEqual, tagFor(virtualRegisterIndex), Imm32(JSValue::CellTag));
+        return branch32(NotEqual, tagFor(virtualRegisterIndex), TrustedImm32(JSValue::CellTag));
     }
     
     inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadInt32(unsigned virtualRegisterIndex, RegisterID dst)
     {
         ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
         loadPtr(payloadFor(virtualRegisterIndex), dst);
-        return branch32(NotEqual, tagFor(virtualRegisterIndex), Imm32(JSValue::Int32Tag));
+        return branch32(NotEqual, tagFor(static_cast<int>(virtualRegisterIndex)), TrustedImm32(JSValue::Int32Tag));
     }
     
-    inline JSInterfaceJIT::Address JSInterfaceJIT::tagFor(unsigned virtualRegisterIndex, RegisterID base)
+    inline JSInterfaceJIT::Address JSInterfaceJIT::tagFor(int virtualRegisterIndex, RegisterID base)
     {
-        ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
-        return Address(base, (virtualRegisterIndex * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.tag));
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.tag));
     }
     
-    inline JSInterfaceJIT::Address JSInterfaceJIT::payloadFor(unsigned virtualRegisterIndex, RegisterID base)
+    inline JSInterfaceJIT::Address JSInterfaceJIT::payloadFor(int virtualRegisterIndex, RegisterID base)
     {
-        ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
-        return Address(base, (virtualRegisterIndex * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.payload));
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.payload));
+    }
+
+    inline JSInterfaceJIT::Address JSInterfaceJIT::intPayloadFor(int virtualRegisterIndex, RegisterID base)
+    {
+        return payloadFor(virtualRegisterIndex, base);
+    }
+
+    inline JSInterfaceJIT::Address JSInterfaceJIT::intTagFor(int virtualRegisterIndex, RegisterID base)
+    {
+        return tagFor(virtualRegisterIndex, base);
     }
 
     inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadDouble(unsigned virtualRegisterIndex, FPRegisterID dst, RegisterID scratch)
     {
         ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
         loadPtr(tagFor(virtualRegisterIndex), scratch);
-        Jump isDouble = branch32(Below, scratch, Imm32(JSValue::LowestTag));
-        Jump notInt = branch32(NotEqual, scratch, Imm32(JSValue::Int32Tag));
+        Jump isDouble = branch32(Below, scratch, TrustedImm32(JSValue::LowestTag));
+        Jump notInt = branch32(NotEqual, scratch, TrustedImm32(JSValue::Int32Tag));
         loadPtr(payloadFor(virtualRegisterIndex), scratch);
         convertInt32ToDouble(scratch, dst);
         Jump done = jump();
@@ -274,17 +323,28 @@ namespace JSC {
 #endif
 
 #if USE(JSVALUE64)
-    inline JSInterfaceJIT::Address JSInterfaceJIT::payloadFor(unsigned virtualRegisterIndex, RegisterID base)
+    inline JSInterfaceJIT::Address JSInterfaceJIT::payloadFor(int virtualRegisterIndex, RegisterID base)
     {
-        ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
         return addressFor(virtualRegisterIndex, base);
     }
+
+    inline JSInterfaceJIT::Address JSInterfaceJIT::intPayloadFor(int virtualRegisterIndex, RegisterID base)
+    {
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
+    }
+    inline JSInterfaceJIT::Address JSInterfaceJIT::intTagFor(int virtualRegisterIndex, RegisterID base)
+    {
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
+    }
 #endif
 
-    inline JSInterfaceJIT::Address JSInterfaceJIT::addressFor(unsigned virtualRegisterIndex, RegisterID base)
+    inline JSInterfaceJIT::Address JSInterfaceJIT::addressFor(int virtualRegisterIndex, RegisterID base)
     {
-        ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
-        return Address(base, (virtualRegisterIndex * sizeof(Register)));
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)));
     }
 
 }
diff --git a/Source/JavaScriptCore/jit/SpecializedThunkJIT.h b/Source/JavaScriptCore/jit/SpecializedThunkJIT.h
index 5c593d9..8c79692 100644
--- a/Source/JavaScriptCore/jit/SpecializedThunkJIT.h
+++ b/Source/JavaScriptCore/jit/SpecializedThunkJIT.h
@@ -43,7 +43,7 @@ namespace JSC {
             , m_pool(pool)
         {
             // Check that we have the expected number of arguments
-            m_failures.append(branch32(NotEqual, Address(callFrameRegister, RegisterFile::ArgumentCount * (int)sizeof(Register)), Imm32(expectedArgCount + 1)));
+            m_failures.append(branch32(NotEqual, Address(callFrameRegister, RegisterFile::ArgumentCount * (int)sizeof(Register)), TrustedImm32(expectedArgCount + 1)));
         }
         
         void loadDoubleArgument(int argument, FPRegisterID dst, RegisterID scratch)
@@ -61,7 +61,7 @@ namespace JSC {
         void loadJSStringArgument(int argument, RegisterID dst)
         {
             loadCellArgument(argument, dst);
-            m_failures.append(branchPtr(NotEqual, Address(dst, 0), ImmPtr(m_globalData->jsStringVPtr)));
+            m_failures.append(branchPtr(NotEqual, Address(dst, 0), TrustedImmPtr(m_globalData->jsStringVPtr)));
             m_failures.append(branchTest32(NonZero, Address(dst, OBJECT_OFFSETOF(JSString, m_fiberCount))));
         }
         
@@ -87,7 +87,7 @@ namespace JSC {
         {
             if (src != regT0)
                 move(src, regT0);
-            loadPtr(Address(callFrameRegister, RegisterFile::CallerFrame * (int)sizeof(Register)), callFrameRegister);
+            loadPtr(payloadFor(RegisterFile::CallerFrame, callFrameRegister), callFrameRegister);
             ret();
         }
         
@@ -101,7 +101,7 @@ namespace JSC {
             loadPtr(Address(stackPointerRegister, OBJECT_OFFSETOF(JSValue, u.asBits.tag) - sizeof(double)), regT1);
             loadPtr(Address(stackPointerRegister, OBJECT_OFFSETOF(JSValue, u.asBits.payload) - sizeof(double)), regT0);
 #endif
-            loadPtr(Address(callFrameRegister, RegisterFile::CallerFrame * (int)sizeof(Register)), callFrameRegister);
+            loadPtr(payloadFor(RegisterFile::CallerFrame, callFrameRegister), callFrameRegister);
             ret();
         }
 
@@ -110,7 +110,7 @@ namespace JSC {
             if (src != regT0)
                 move(src, regT0);
             tagReturnAsInt32();
-            loadPtr(Address(callFrameRegister, RegisterFile::CallerFrame * (int)sizeof(Register)), callFrameRegister);
+            loadPtr(payloadFor(RegisterFile::CallerFrame, callFrameRegister), callFrameRegister);
             ret();
         }
 
@@ -119,7 +119,7 @@ namespace JSC {
             if (src != regT0)
                 move(src, regT0);
             tagReturnAsJSCell();
-            loadPtr(Address(callFrameRegister, RegisterFile::CallerFrame * (int)sizeof(Register)), callFrameRegister);
+            loadPtr(payloadFor(RegisterFile::CallerFrame, callFrameRegister), callFrameRegister);
             ret();
         }
         
@@ -141,14 +141,14 @@ namespace JSC {
 #if USE(JSVALUE64)
             orPtr(tagTypeNumberRegister, regT0);
 #else
-            move(Imm32(JSValue::Int32Tag), regT1);
+            move(TrustedImm32(JSValue::Int32Tag), regT1);
 #endif
         }
 
         void tagReturnAsJSCell()
         {
 #if USE(JSVALUE32_64)
-            move(Imm32(JSValue::CellTag), regT1);
+            move(TrustedImm32(JSValue::CellTag), regT1);
 #endif
         }
         
diff --git a/Source/JavaScriptCore/jit/ThunkGenerators.cpp b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
index 9b40f12..1201696 100644
--- a/Source/JavaScriptCore/jit/ThunkGenerators.cpp
+++ b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
@@ -57,8 +57,8 @@ static void stringCharLoad(SpecializedThunkJIT& jit)
 
 static void charToString(SpecializedThunkJIT& jit, JSGlobalData* globalData, MacroAssembler::RegisterID src, MacroAssembler::RegisterID dst, MacroAssembler::RegisterID scratch)
 {
-    jit.appendFailure(jit.branch32(MacroAssembler::AboveOrEqual, src, MacroAssembler::Imm32(0x100)));
-    jit.move(MacroAssembler::ImmPtr(globalData->smallStrings.singleCharacterStrings()), scratch);
+    jit.appendFailure(jit.branch32(MacroAssembler::AboveOrEqual, src, MacroAssembler::TrustedImm32(0x100)));
+    jit.move(MacroAssembler::TrustedImmPtr(globalData->smallStrings.singleCharacterStrings()), scratch);
     jit.loadPtr(MacroAssembler::BaseIndex(scratch, src, MacroAssembler::ScalePtr, 0), dst);
     jit.appendFailure(jit.branchTestPtr(MacroAssembler::Zero, dst));
 }
@@ -115,16 +115,16 @@ MacroAssemblerCodePtr powThunkGenerator(JSGlobalData* globalData, ExecutablePool
     jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
     MacroAssembler::Jump nonIntExponent;
     jit.loadInt32Argument(1, SpecializedThunkJIT::regT0, nonIntExponent);
-    jit.appendFailure(jit.branch32(MacroAssembler::LessThan, SpecializedThunkJIT::regT0, MacroAssembler::Imm32(0)));
+    jit.appendFailure(jit.branch32(MacroAssembler::LessThan, SpecializedThunkJIT::regT0, MacroAssembler::TrustedImm32(0)));
     
     MacroAssembler::Jump exponentIsZero = jit.branchTest32(MacroAssembler::Zero, SpecializedThunkJIT::regT0);
     MacroAssembler::Label startLoop(jit.label());
 
-    MacroAssembler::Jump exponentIsEven = jit.branchTest32(MacroAssembler::Zero, SpecializedThunkJIT::regT0, MacroAssembler::Imm32(1));
+    MacroAssembler::Jump exponentIsEven = jit.branchTest32(MacroAssembler::Zero, SpecializedThunkJIT::regT0, MacroAssembler::TrustedImm32(1));
     jit.mulDouble(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1);
     exponentIsEven.link(&jit);
     jit.mulDouble(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT0);
-    jit.rshift32(MacroAssembler::Imm32(1), SpecializedThunkJIT::regT0);
+    jit.rshift32(MacroAssembler::TrustedImm32(1), SpecializedThunkJIT::regT0);
     jit.branchTest32(MacroAssembler::NonZero, SpecializedThunkJIT::regT0).linkTo(startLoop, &jit);
 
     exponentIsZero.link(&jit);
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index 912b51a..729dce9 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -31,7 +31,6 @@
 #include "JSFunction.h"
 #include "JSLock.h"
 #include "JSString.h"
-#include "PrototypeFunction.h"
 #include "SamplingTool.h"
 #include <math.h>
 #include <stdio.h>
@@ -142,28 +141,28 @@ long StopWatch::getElapsedMS()
 
 class GlobalObject : public JSGlobalObject {
 public:
-    GlobalObject(const Vector<UString>& arguments);
+    GlobalObject(JSGlobalData&, const Vector<UString>& arguments);
     virtual UString className() const { return "global"; }
 };
 COMPILE_ASSERT(!IsInteger<GlobalObject>::value, WTF_IsInteger_GlobalObject_false);
 ASSERT_CLASS_FITS_IN_CELL(GlobalObject);
 
-GlobalObject::GlobalObject(const Vector<UString>& arguments)
-    : JSGlobalObject()
+GlobalObject::GlobalObject(JSGlobalData& globalData, const Vector<UString>& arguments)
+    : JSGlobalObject(globalData)
 {
-    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), this, prototypeFunctionStructure(), 1, Identifier(globalExec(), "debug"), functionDebug));
-    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), this, prototypeFunctionStructure(), 1, Identifier(globalExec(), "print"), functionPrint));
-    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), this, prototypeFunctionStructure(), 0, Identifier(globalExec(), "quit"), functionQuit));
-    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), this, prototypeFunctionStructure(), 0, Identifier(globalExec(), "gc"), functionGC));
-    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), this, prototypeFunctionStructure(), 1, Identifier(globalExec(), "version"), functionVersion));
-    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), this, prototypeFunctionStructure(), 1, Identifier(globalExec(), "run"), functionRun));
-    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), this, prototypeFunctionStructure(), 1, Identifier(globalExec(), "load"), functionLoad));
-    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), this, prototypeFunctionStructure(), 1, Identifier(globalExec(), "checkSyntax"), functionCheckSyntax));
-    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), this, prototypeFunctionStructure(), 0, Identifier(globalExec(), "readline"), functionReadline));
+    putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 1, Identifier(globalExec(), "debug"), functionDebug));
+    putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 1, Identifier(globalExec(), "print"), functionPrint));
+    putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 0, Identifier(globalExec(), "quit"), functionQuit));
+    putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 0, Identifier(globalExec(), "gc"), functionGC));
+    putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 1, Identifier(globalExec(), "version"), functionVersion));
+    putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 1, Identifier(globalExec(), "run"), functionRun));
+    putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 1, Identifier(globalExec(), "load"), functionLoad));
+    putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 1, Identifier(globalExec(), "checkSyntax"), functionCheckSyntax));
+    putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 0, Identifier(globalExec(), "readline"), functionReadline));
 
 #if ENABLE(SAMPLING_FLAGS)
-    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), this, prototypeFunctionStructure(), 1, Identifier(globalExec(), "setSamplingFlags"), functionSetSamplingFlags));
-    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), this, prototypeFunctionStructure(), 1, Identifier(globalExec(), "clearSamplingFlags"), functionClearSamplingFlags));
+    putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 1, Identifier(globalExec(), "setSamplingFlags"), functionSetSamplingFlags));
+    putDirectFunction(globalExec(), new (globalExec()) JSFunction(globalExec(), this, functionStructure(), 1, Identifier(globalExec(), "clearSamplingFlags"), functionClearSamplingFlags));
 #endif
 
     JSObject* array = constructEmptyArray(globalExec());
@@ -213,7 +212,7 @@ EncodedJSValue JSC_HOST_CALL functionRun(ExecState* exec)
     if (!fillBufferWithContentsOfFile(fileName, script))
         return JSValue::encode(throwError(exec, createError(exec, "Could not open file.")));
 
-    GlobalObject* globalObject = new (&exec->globalData()) GlobalObject(Vector<UString>());
+    GlobalObject* globalObject = new (&exec->globalData()) GlobalObject(exec->globalData(), Vector<UString>());
 
     StopWatch stopWatch;
     stopWatch.start();
@@ -325,7 +324,15 @@ int jscmain(int argc, char** argv, JSGlobalData*);
 
 int main(int argc, char** argv)
 {
-#if defined(_DEBUG) && OS(WINDOWS)
+#if OS(WINDOWS)
+#if !OS(WINCE)
+    // Cygwin calls ::SetErrorMode(SEM_FAILCRITICALERRORS), which we will inherit. This is bad for
+    // testing/debugging, as it causes the post-mortem debugger not to be invoked. We reset the
+    // error mode here to work around Cygwin's behavior. See <http://webkit.org/b/55222>.
+    ::SetErrorMode(0);
+#endif
+
+#if defined(_DEBUG)
     _CrtSetReportFile(_CRT_WARN, _CRTDBG_FILE_STDERR);
     _CrtSetReportMode(_CRT_WARN, _CRTDBG_MODE_FILE);
     _CrtSetReportFile(_CRT_ERROR, _CRTDBG_FILE_STDERR);
@@ -334,7 +341,6 @@ int main(int argc, char** argv)
     _CrtSetReportMode(_CRT_ASSERT, _CRTDBG_MODE_FILE);
 #endif
 
-#if COMPILER(MSVC) && !OS(WINCE)
     timeBeginPeriod(1);
 #endif
 
@@ -360,6 +366,7 @@ int main(int argc, char** argv)
 static void cleanupGlobalData(JSGlobalData* globalData)
 {
     JSLock lock(SilenceAssertionsOnly);
+    globalData->clearBuiltinStructures();
     globalData->heap.destroy();
     globalData->deref();
 }
@@ -530,7 +537,7 @@ int jscmain(int argc, char** argv, JSGlobalData* globalData)
     Options options;
     parseArguments(argc, argv, options, globalData);
 
-    GlobalObject* globalObject = new (globalData) GlobalObject(options.arguments);
+    GlobalObject* globalObject = new (globalData) GlobalObject(*globalData, options.arguments);
     bool success = runWithScripts(globalObject, options.scripts, options.dump);
     if (options.interactive && success)
         runInteractive(globalObject);
diff --git a/Source/JavaScriptCore/jsc.pro b/Source/JavaScriptCore/jsc.pro
index b4db812..21ffeea 100644
--- a/Source/JavaScriptCore/jsc.pro
+++ b/Source/JavaScriptCore/jsc.pro
@@ -15,14 +15,9 @@ unix:!mac:!symbian:CONFIG += link_pkgconfig
 
 QMAKE_RPATHDIR += $$OUTPUT_DIR/lib
 
-!CONFIG(release, debug|release) {
-    OBJECTS_DIR = obj/debug
-} else { # Release
-    OBJECTS_DIR = obj/release
-}
 OBJECTS_DIR_WTR = $$OBJECTS_DIR$${QMAKE_DIR_SEP}
 include($$PWD/JavaScriptCore.pri)
-addJavaScriptCoreLib(.)
+prependJavaScriptCoreLib(.)
 
 symbian {
     TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
@@ -32,6 +27,10 @@ mac {
     LIBS_PRIVATE += -framework AppKit
 }
 
+win* {
+    LIBS += -ladvapi32
+}
+
 wince* {
     LIBS += mmtimer.lib
 }
diff --git a/Source/JavaScriptCore/parser/ASTBuilder.h b/Source/JavaScriptCore/parser/ASTBuilder.h
index 0e18d1d..9ab0f9d 100644
--- a/Source/JavaScriptCore/parser/ASTBuilder.h
+++ b/Source/JavaScriptCore/parser/ASTBuilder.h
@@ -76,9 +76,9 @@ public:
     ASTBuilder(JSGlobalData* globalData, Lexer* lexer)
         : m_globalData(globalData)
         , m_lexer(lexer)
+        , m_scope(globalData)
         , m_evalCount(0)
     {
-        m_scopes.append(Scope(globalData));
     }
     
     struct BinaryExprContext {
@@ -115,10 +115,10 @@ public:
 
     JSC::SourceElements* createSourceElements() { return new (m_globalData) JSC::SourceElements(m_globalData); }
 
-    ParserArenaData<DeclarationStacks::VarStack>* varDeclarations() { return m_scopes.last().m_varDeclarations; }
-    ParserArenaData<DeclarationStacks::FunctionStack>* funcDeclarations() { return m_scopes.last().m_funcDeclarations; }
-    int features() const { return m_scopes.last().m_features; }
-    int numConstants() const { return m_scopes.last().m_numConstants; }
+    ParserArenaData<DeclarationStacks::VarStack>* varDeclarations() { return m_scope.m_varDeclarations; }
+    ParserArenaData<DeclarationStacks::FunctionStack>* funcDeclarations() { return m_scope.m_funcDeclarations; }
+    int features() const { return m_scope.m_features; }
+    int numConstants() const { return m_scope.m_numConstants; }
 
     void appendToComma(CommaNode* commaNode, ExpressionNode* expr) { commaNode->append(expr); }
 
@@ -300,7 +300,7 @@ public:
         FuncDeclNode* decl = new (m_globalData) FuncDeclNode(m_globalData, *name, body, m_lexer->sourceCode(openBracePos, closeBracePos, bodyStartLine), parameters);
         if (*name == m_globalData->propertyNames->arguments)
             usesArguments();
-        m_scopes.last().m_funcDeclarations->data.append(decl->body());
+        m_scope.m_funcDeclarations->data.append(decl->body());
         body->setLoc(bodyStartLine, bodyEndLine);
         return decl;
     }
@@ -494,7 +494,7 @@ public:
     {
         if (m_globalData->propertyNames->arguments == *ident)
             usesArguments();
-        m_scopes.last().m_varDeclarations->data.append(std::make_pair(ident, attrs));
+        m_scope.m_varDeclarations->data.append(std::make_pair(ident, attrs));
     }
 
     ExpressionNode* combineCommaNodes(ExpressionNode* list, ExpressionNode* init)
@@ -611,17 +611,17 @@ private:
         node->setExceptionSourceCode(divot, divot - start, end - divot);
     }
 
-    void incConstants() { m_scopes.last().m_numConstants++; }
-    void usesThis() { m_scopes.last().m_features |= ThisFeature; }
-    void usesCatch() { m_scopes.last().m_features |= CatchFeature; }
-    void usesClosures() { m_scopes.last().m_features |= ClosureFeature; }
-    void usesArguments() { m_scopes.last().m_features |= ArgumentsFeature; }
-    void usesAssignment() { m_scopes.last().m_features |= AssignFeature; }
-    void usesWith() { m_scopes.last().m_features |= WithFeature; }
+    void incConstants() { m_scope.m_numConstants++; }
+    void usesThis() { m_scope.m_features |= ThisFeature; }
+    void usesCatch() { m_scope.m_features |= CatchFeature; }
+    void usesClosures() { m_scope.m_features |= ClosureFeature; }
+    void usesArguments() { m_scope.m_features |= ArgumentsFeature; }
+    void usesAssignment() { m_scope.m_features |= AssignFeature; }
+    void usesWith() { m_scope.m_features |= WithFeature; }
     void usesEval() 
     {
         m_evalCount++;
-        m_scopes.last().m_features |= EvalFeature;
+        m_scope.m_features |= EvalFeature;
     }
     ExpressionNode* createNumber(double d)
     {
@@ -630,7 +630,7 @@ private:
     
     JSGlobalData* m_globalData;
     Lexer* m_lexer;
-    Vector<Scope> m_scopes;
+    Scope m_scope;
     Vector<BinaryOperand, 10> m_binaryOperandStack;
     Vector<AssignmentInfo, 10> m_assignmentInfoStack;
     Vector<pair<int, int>, 10> m_binaryOperatorStack;
diff --git a/Source/JavaScriptCore/parser/JSParser.cpp b/Source/JavaScriptCore/parser/JSParser.cpp
index 993dd66..314691d 100644
--- a/Source/JavaScriptCore/parser/JSParser.cpp
+++ b/Source/JavaScriptCore/parser/JSParser.cpp
@@ -36,6 +36,7 @@ using namespace JSC;
 #include "SourceProvider.h"
 #include "SourceProviderCacheItem.h"
 #include <wtf/HashFunctions.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/WTFThreadData.h>
 #include <utility>
 
@@ -293,7 +294,31 @@ private:
             , m_labels(0)
         {
         }
-        
+
+        Scope(const Scope& rhs)
+            : m_globalData(rhs.m_globalData)
+            , m_shadowsArguments(rhs.m_shadowsArguments)
+            , m_usesEval(rhs.m_usesEval)
+            , m_needsFullActivation(rhs.m_needsFullActivation)
+            , m_allowsNewDecls(rhs.m_allowsNewDecls)
+            , m_strictMode(rhs.m_strictMode)
+            , m_isFunction(rhs.m_isFunction)
+            , m_isFunctionBoundary(rhs.m_isFunctionBoundary)
+            , m_isValidStrictMode(rhs.m_isValidStrictMode)
+            , m_loopDepth(rhs.m_loopDepth)
+            , m_switchDepth(rhs.m_switchDepth)
+            , m_labels(0)
+        {
+            if (rhs.m_labels) {
+                m_labels = adoptPtr(new LabelStack);
+                
+                typedef LabelStack::const_iterator iterator;
+                iterator end = rhs.m_labels->end();
+                for (iterator it = rhs.m_labels->begin(); it != end; ++it)
+                    m_labels->append(ScopeLabelInfo(it->m_ident, it->m_isLoop));
+            }
+        }
+
         void startSwitch() { m_switchDepth++; }
         void endSwitch() { m_switchDepth--; }
         void startLoop() { m_loopDepth++; }
@@ -305,7 +330,7 @@ private:
         void pushLabel(const Identifier* label, bool isLoop)
         {
             if (!m_labels)
-                m_labels = new LabelStack;
+                m_labels = adoptPtr(new LabelStack);
             m_labels->append(ScopeLabelInfo(label->impl(), isLoop));
         }
 
@@ -465,13 +490,13 @@ private:
         int m_switchDepth;
 
         typedef Vector<ScopeLabelInfo, 2> LabelStack;
-        LabelStack* m_labels;
+        OwnPtr<LabelStack> m_labels;
         IdentifierSet m_declaredVariables;
         IdentifierSet m_usedVariables;
         IdentifierSet m_closedVariables;
         IdentifierSet m_writtenVariables;
     };
-    
+
     typedef Vector<Scope, 10> ScopeStack;
 
     struct ScopeRef {
@@ -2140,3 +2165,10 @@ template <class TreeBuilder> TreeExpression JSParser::parseUnaryExpression(TreeB
 }
 
 }
+
+namespace WTF
+{
+    template <> struct VectorTraits<JSC::JSParser::Scope> : SimpleClassVectorTraits {
+        static const bool canInitializeWithMemset = false; // Not all Scope data members initialize to 0.
+    };
+}
diff --git a/Source/JavaScriptCore/parser/Lexer.h b/Source/JavaScriptCore/parser/Lexer.h
index d4145c1..9dc553a 100644
--- a/Source/JavaScriptCore/parser/Lexer.h
+++ b/Source/JavaScriptCore/parser/Lexer.h
@@ -71,11 +71,12 @@ namespace JSC {
         {
             m_error = 0;
             m_code = m_codeStart + offset;
-            m_current = *m_code;
             m_buffer8.resize(0);
             m_buffer16.resize(0);
-            if (UNLIKELY(m_code == m_codeEnd))
-                m_current = -1;
+            // Faster than an if-else sequence
+            m_current = -1;
+            if (LIKELY(m_code < m_codeEnd))
+                m_current = *m_code;
         }
         void setLineNumber(int line)
         {
diff --git a/Source/JavaScriptCore/profiler/CallIdentifier.h b/Source/JavaScriptCore/profiler/CallIdentifier.h
index a9827c0..1ba5ec6 100644
--- a/Source/JavaScriptCore/profiler/CallIdentifier.h
+++ b/Source/JavaScriptCore/profiler/CallIdentifier.h
@@ -63,7 +63,7 @@ namespace JSC {
                     key.m_url.impl()->hash(),
                     key.m_lineNumber
                 };
-                return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+                return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
             }
 
             static bool equal(const CallIdentifier& a, const CallIdentifier& b) { return a == b; }
diff --git a/Source/JavaScriptCore/profiler/ProfileGenerator.cpp b/Source/JavaScriptCore/profiler/ProfileGenerator.cpp
index 68d1733..5db38bc 100644
--- a/Source/JavaScriptCore/profiler/ProfileGenerator.cpp
+++ b/Source/JavaScriptCore/profiler/ProfileGenerator.cpp
@@ -40,19 +40,19 @@ namespace JSC {
 
 static const char* NonJSExecution = "(idle)";
 
-PassRefPtr<ProfileGenerator> ProfileGenerator::create(const UString& title, ExecState* originatingExec, unsigned uid)
+PassRefPtr<ProfileGenerator> ProfileGenerator::create(ExecState* exec, const UString& title, unsigned uid)
 {
-    return adoptRef(new ProfileGenerator(title, originatingExec, uid));
+    return adoptRef(new ProfileGenerator(exec, title, uid));
 }
 
-ProfileGenerator::ProfileGenerator(const UString& title, ExecState* originatingExec, unsigned uid)
-    : m_originatingGlobalExec(originatingExec ? originatingExec->lexicalGlobalObject()->globalExec() : 0)
-    , m_profileGroup(originatingExec ? originatingExec->lexicalGlobalObject()->profileGroup() : 0)
+ProfileGenerator::ProfileGenerator(ExecState* exec, const UString& title, unsigned uid)
+    : m_origin(exec ? exec->lexicalGlobalObject() : 0)
+    , m_profileGroup(exec ? exec->lexicalGlobalObject()->profileGroup() : 0)
 {
     m_profile = Profile::create(title, uid);
     m_currentNode = m_head = m_profile->head();
-    if (originatingExec)
-        addParentForConsoleStart(originatingExec);
+    if (exec)
+        addParentForConsoleStart(exec);
 }
 
 void ProfileGenerator::addParentForConsoleStart(ExecState* exec)
@@ -80,7 +80,7 @@ void ProfileGenerator::willExecute(ExecState* callerCallFrame, const CallIdentif
         JAVASCRIPTCORE_PROFILE_WILL_EXECUTE(m_profileGroup, const_cast<char*>(name.data()), const_cast<char*>(url.data()), callIdentifier.m_lineNumber);
     }
 
-    if (!m_originatingGlobalExec)
+    if (!m_origin)
         return;
 
     ASSERT(m_currentNode);
@@ -95,7 +95,7 @@ void ProfileGenerator::didExecute(ExecState* callerCallFrame, const CallIdentifi
         JAVASCRIPTCORE_PROFILE_DID_EXECUTE(m_profileGroup, const_cast<char*>(name.data()), const_cast<char*>(url.data()), callIdentifier.m_lineNumber);
     }
 
-    if (!m_originatingGlobalExec)
+    if (!m_origin)
         return;
 
     ASSERT(m_currentNode);
diff --git a/Source/JavaScriptCore/profiler/ProfileGenerator.h b/Source/JavaScriptCore/profiler/ProfileGenerator.h
index cbed73b..8c8b817 100644
--- a/Source/JavaScriptCore/profiler/ProfileGenerator.h
+++ b/Source/JavaScriptCore/profiler/ProfileGenerator.h
@@ -34,6 +34,7 @@
 namespace JSC {
 
     class ExecState;
+    class JSGlobalObject;
     class Profile;
     class ProfileNode;
     class UString;
@@ -41,12 +42,12 @@ namespace JSC {
 
     class ProfileGenerator : public RefCounted<ProfileGenerator>  {
     public:
-        static PassRefPtr<ProfileGenerator> create(const UString& title, ExecState* originatingExec, unsigned uid);
+        static PassRefPtr<ProfileGenerator> create(ExecState*, const UString& title, unsigned uid);
 
         // Members
         const UString& title() const;
         PassRefPtr<Profile> profile() const { return m_profile; }
-        ExecState* originatingGlobalExec() const { return m_originatingGlobalExec; }
+        JSGlobalObject* origin() const { return m_origin; }
         unsigned profileGroup() const { return m_profileGroup; }
 
         // Collecting
@@ -61,14 +62,14 @@ namespace JSC {
         typedef void (ProfileGenerator::*ProfileFunction)(ExecState* callerOrHandlerCallFrame, const CallIdentifier& callIdentifier);
 
     private:
-        ProfileGenerator(const UString& title, ExecState* originatingExec, unsigned uid);
+        ProfileGenerator(ExecState*, const UString& title, unsigned uid);
         void addParentForConsoleStart(ExecState*);
 
         void removeProfileStart();
         void removeProfileEnd();
 
         RefPtr<Profile> m_profile;
-        ExecState* m_originatingGlobalExec;
+        JSGlobalObject* m_origin;
         unsigned m_profileGroup;
         RefPtr<ProfileNode> m_head;
         RefPtr<ProfileNode> m_currentNode;
diff --git a/Source/JavaScriptCore/profiler/Profiler.cpp b/Source/JavaScriptCore/profiler/Profiler.cpp
index 9ac73fd..bcaaaac 100644
--- a/Source/JavaScriptCore/profiler/Profiler.cpp
+++ b/Source/JavaScriptCore/profiler/Profiler.cpp
@@ -66,25 +66,25 @@ void Profiler::startProfiling(ExecState* exec, const UString& title)
 
     // Check if we currently have a Profile for this global ExecState and title.
     // If so return early and don't create a new Profile.
-    ExecState* globalExec = exec ? exec->lexicalGlobalObject()->globalExec() : 0;
+    JSGlobalObject* origin = exec ? exec->lexicalGlobalObject() : 0;
 
     for (size_t i = 0; i < m_currentProfiles.size(); ++i) {
         ProfileGenerator* profileGenerator = m_currentProfiles[i].get();
-        if (profileGenerator->originatingGlobalExec() == globalExec && profileGenerator->title() == title)
+        if (profileGenerator->origin() == origin && profileGenerator->title() == title)
             return;
     }
 
     s_sharedEnabledProfilerReference = this;
-    RefPtr<ProfileGenerator> profileGenerator = ProfileGenerator::create(title, exec, ++ProfilesUID);
+    RefPtr<ProfileGenerator> profileGenerator = ProfileGenerator::create(exec, title, ++ProfilesUID);
     m_currentProfiles.append(profileGenerator);
 }
 
 PassRefPtr<Profile> Profiler::stopProfiling(ExecState* exec, const UString& title)
 {
-    ExecState* globalExec = exec ? exec->lexicalGlobalObject()->globalExec() : 0;
+    JSGlobalObject* origin = exec ? exec->lexicalGlobalObject() : 0;
     for (ptrdiff_t i = m_currentProfiles.size() - 1; i >= 0; --i) {
         ProfileGenerator* profileGenerator = m_currentProfiles[i].get();
-        if (profileGenerator->originatingGlobalExec() == globalExec && (title.isNull() || profileGenerator->title() == title)) {
+        if (profileGenerator->origin() == origin && (title.isNull() || profileGenerator->title() == title)) {
             profileGenerator->stopProfiling();
             RefPtr<Profile> returnProfile = profileGenerator->profile();
 
@@ -99,10 +99,23 @@ PassRefPtr<Profile> Profiler::stopProfiling(ExecState* exec, const UString& titl
     return 0;
 }
 
+void Profiler::stopProfiling(JSGlobalObject* origin)
+{
+    for (ptrdiff_t i = m_currentProfiles.size() - 1; i >= 0; --i) {
+        ProfileGenerator* profileGenerator = m_currentProfiles[i].get();
+        if (profileGenerator->origin() == origin) {
+            profileGenerator->stopProfiling();
+            m_currentProfiles.remove(i);
+            if (!m_currentProfiles.size())
+                s_sharedEnabledProfilerReference = 0;
+        }
+    }
+}
+
 static inline void dispatchFunctionToProfiles(ExecState* callerOrHandlerCallFrame, const Vector<RefPtr<ProfileGenerator> >& profiles, ProfileGenerator::ProfileFunction function, const CallIdentifier& callIdentifier, unsigned currentProfileTargetGroup)
 {
     for (size_t i = 0; i < profiles.size(); ++i) {
-        if (profiles[i]->profileGroup() == currentProfileTargetGroup || !profiles[i]->originatingGlobalExec())
+        if (profiles[i]->profileGroup() == currentProfileTargetGroup || !profiles[i]->origin())
             (profiles[i].get()->*function)(callerOrHandlerCallFrame, callIdentifier);
     }
 }
@@ -150,14 +163,14 @@ CallIdentifier Profiler::createCallIdentifier(ExecState* exec, JSValue functionV
         return CallIdentifier(GlobalCodeExecution, defaultSourceURL, defaultLineNumber);
     if (!functionValue.isObject())
         return CallIdentifier("(unknown)", defaultSourceURL, defaultLineNumber);
-    if (asObject(functionValue)->inherits(&JSFunction::info)) {
+    if (asObject(functionValue)->inherits(&JSFunction::s_info)) {
         JSFunction* function = asFunction(functionValue);
         if (!function->executable()->isHostFunction())
             return createCallIdentifierFromFunctionImp(exec, function);
     }
-    if (asObject(functionValue)->inherits(&JSFunction::info))
+    if (asObject(functionValue)->inherits(&JSFunction::s_info))
         return CallIdentifier(static_cast<JSFunction*>(asObject(functionValue))->name(exec), defaultSourceURL, defaultLineNumber);
-    if (asObject(functionValue)->inherits(&InternalFunction::info))
+    if (asObject(functionValue)->inherits(&InternalFunction::s_info))
         return CallIdentifier(static_cast<InternalFunction*>(asObject(functionValue))->name(exec), defaultSourceURL, defaultLineNumber);
     return CallIdentifier(makeUString("(", asObject(functionValue)->className(), " object)"), defaultSourceURL, defaultLineNumber);
 }
diff --git a/Source/JavaScriptCore/profiler/Profiler.h b/Source/JavaScriptCore/profiler/Profiler.h
index f88746d..86366c1 100644
--- a/Source/JavaScriptCore/profiler/Profiler.h
+++ b/Source/JavaScriptCore/profiler/Profiler.h
@@ -38,6 +38,7 @@ namespace JSC {
 
     class ExecState;
     class JSGlobalData;
+    class JSGlobalObject;
     class JSObject;
     class JSValue;
     class ProfileGenerator;
@@ -57,6 +58,7 @@ namespace JSC {
 
         void startProfiling(ExecState*, const UString& title);
         PassRefPtr<Profile> stopProfiling(ExecState*, const UString& title);
+        void stopProfiling(JSGlobalObject*);
 
         void willExecute(ExecState* callerCallFrame, JSValue function);
         void willExecute(ExecState* callerCallFrame, const UString& sourceURL, int startingLineNumber);
diff --git a/Source/JavaScriptCore/qt/ChangeLog b/Source/JavaScriptCore/qt/ChangeLog
index 11018b4..22484b7 100644
--- a/Source/JavaScriptCore/qt/ChangeLog
+++ b/Source/JavaScriptCore/qt/ChangeLog
@@ -1,3 +1,23 @@
+2011-03-01  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Clean up the project files and move common options to WebKit.pri.
+
+        * api/QtScript.pro: Deduplicate options.
+
+2011-02-24  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] MinGW build fails to link
+        https://bugs.webkit.org/show_bug.cgi?id=55050
+
+        Prepend the libraries of subcomponents instead of appending them
+        to fix the library order according to the dependency of the libraries
+
+        * api/QtScript.pro:
+
 2010-09-29  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
 
         Reviewed by Andreas Kling.
diff --git a/Source/JavaScriptCore/qt/api/QtScript.pro b/Source/JavaScriptCore/qt/api/QtScript.pro
index 490758c..22e8b0c 100644
--- a/Source/JavaScriptCore/qt/api/QtScript.pro
+++ b/Source/JavaScriptCore/qt/api/QtScript.pro
@@ -7,17 +7,12 @@ INCLUDEPATH += $$PWD
 CONFIG += building-libs
 
 isEmpty(JSC_GENERATED_SOURCES_DIR):JSC_GENERATED_SOURCES_DIR = ../../generated
-!CONFIG(release, debug|release) {
-    OBJECTS_DIR = obj/debug
-} else { # Release
-    OBJECTS_DIR = obj/release
-}
 
 isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../..
 include($$PWD/../../../WebKit.pri)
 
 include($$PWD/../../JavaScriptCore.pri)
-addJavaScriptCoreLib(../..)
+prependJavaScriptCoreLib(../..)
 
 INCLUDEPATH += $$PWD/../../API
 
diff --git a/Source/JavaScriptCore/runtime/ArgList.cpp b/Source/JavaScriptCore/runtime/ArgList.cpp
index a862ea0..f46d108 100644
--- a/Source/JavaScriptCore/runtime/ArgList.cpp
+++ b/Source/JavaScriptCore/runtime/ArgList.cpp
@@ -23,6 +23,8 @@
 
 #include "JSValue.h"
 #include "JSCell.h"
+#include "JSObject.h"
+#include "ScopeChain.h"
 
 using std::min;
 
@@ -37,12 +39,12 @@ void ArgList::getSlice(int startIndex, ArgList& result) const
     result = ArgList(m_args + startIndex, m_argCount - startIndex);
 }
 
-void MarkedArgumentBuffer::markLists(MarkStack& markStack, ListSet& markSet)
+void MarkedArgumentBuffer::markLists(HeapRootMarker& heapRootMarker, ListSet& markSet)
 {
     ListSet::iterator end = markSet.end();
     for (ListSet::iterator it = markSet.begin(); it != end; ++it) {
         MarkedArgumentBuffer* list = *it;
-        markStack.deprecatedAppendValues(list->m_buffer, list->m_size);
+        heapRootMarker.mark(reinterpret_cast<JSValue*>(list->m_buffer), list->m_size);
     }
 }
 
@@ -54,8 +56,8 @@ void MarkedArgumentBuffer::slowAppend(JSValue v)
     // our Vector's inline capacity, though, our values move to the 
     // heap, where they do need explicit marking.
     if (!m_markSet) {
-        // We can only register for explicit marking once we know which heap
-        // is the current one, i.e., when a non-immediate value is appended.
+        // FIXME: Even if v is not a JSCell*, if previous values in the buffer
+        // are, then they won't be marked!
         if (Heap* heap = Heap::heap(v)) {
             ListSet& markSet = heap->markListSet();
             markSet.add(this);
diff --git a/Source/JavaScriptCore/runtime/ArgList.h b/Source/JavaScriptCore/runtime/ArgList.h
index 57e3c20..a794a04 100644
--- a/Source/JavaScriptCore/runtime/ArgList.h
+++ b/Source/JavaScriptCore/runtime/ArgList.h
@@ -67,12 +67,12 @@ namespace JSC {
         {
         }
 
-        void initialize(Register* buffer, size_t size)
+        void initialize(WriteBarrier<Unknown>* buffer, size_t size)
         {
             ASSERT(!m_markSet);
             ASSERT(isEmpty());
 
-            m_buffer = buffer;
+            m_buffer = reinterpret_cast<Register*>(buffer);
             m_size = size;
 #ifndef NDEBUG
             m_isReadOnly = true;
@@ -141,7 +141,7 @@ namespace JSC {
         const_iterator begin() const { return m_buffer; }
         const_iterator end() const { return m_buffer + m_size; }
 
-        static void markLists(MarkStack&, ListSet&);
+        static void markLists(HeapRootMarker&, ListSet&);
 
     private:
         void slowAppend(JSValue);
diff --git a/Source/JavaScriptCore/runtime/Arguments.cpp b/Source/JavaScriptCore/runtime/Arguments.cpp
index 305b247..e201b91 100644
--- a/Source/JavaScriptCore/runtime/Arguments.cpp
+++ b/Source/JavaScriptCore/runtime/Arguments.cpp
@@ -35,7 +35,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(Arguments);
 
-const ClassInfo Arguments::info = { "Arguments", 0, 0, 0 };
+const ClassInfo Arguments::s_info = { "Arguments", &JSNonFinalObject::s_info, 0, 0 };
 
 Arguments::~Arguments()
 {
@@ -48,11 +48,11 @@ void Arguments::markChildren(MarkStack& markStack)
     JSObject::markChildren(markStack);
 
     if (d->registerArray)
-        markStack.deprecatedAppendValues(d->registerArray.get(), d->numParameters);
+        markStack.appendValues(d->registerArray.get(), d->numParameters);
 
     if (d->extraArguments) {
         unsigned numExtraArguments = d->numArguments - d->numParameters;
-        markStack.deprecatedAppendValues(d->extraArguments, numExtraArguments);
+        markStack.appendValues(d->extraArguments, numExtraArguments);
     }
 
     markStack.append(&d->callee);
@@ -74,9 +74,9 @@ void Arguments::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxS
         unsigned parametersLength = min(min(d->numParameters, d->numArguments), maxSize);
         unsigned i = 0;
         for (; i < parametersLength; ++i)
-            buffer[i] = d->registers[d->firstParameterIndex + i].jsValue();
+            buffer[i] = d->registers[d->firstParameterIndex + i].get();
         for (; i < d->numArguments; ++i)
-            buffer[i] = d->extraArguments[i - d->numParameters].jsValue();
+            buffer[i] = d->extraArguments[i - d->numParameters].get();
         return;
     }
     
@@ -84,13 +84,13 @@ void Arguments::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxS
     unsigned i = 0;
     for (; i < parametersLength; ++i) {
         if (!d->deletedArguments[i])
-            buffer[i] = d->registers[d->firstParameterIndex + i].jsValue();
+            buffer[i] = d->registers[d->firstParameterIndex + i].get();
         else
             buffer[i] = get(exec, i);
     }
     for (; i < d->numArguments; ++i) {
         if (!d->deletedArguments[i])
-            buffer[i] = d->extraArguments[i - d->numParameters].jsValue();
+            buffer[i] = d->extraArguments[i - d->numParameters].get();
         else
             buffer[i] = get(exec, i);
     }
@@ -119,9 +119,9 @@ void Arguments::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
         unsigned parametersLength = min(d->numParameters, d->numArguments);
         unsigned i = 0;
         for (; i < parametersLength; ++i)
-            args.append(d->registers[d->firstParameterIndex + i].jsValue());
+            args.append(d->registers[d->firstParameterIndex + i].get());
         for (; i < d->numArguments; ++i)
-            args.append(d->extraArguments[i - d->numParameters].jsValue());
+            args.append(d->extraArguments[i - d->numParameters].get());
         return;
     }
 
@@ -129,13 +129,13 @@ void Arguments::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
     unsigned i = 0;
     for (; i < parametersLength; ++i) {
         if (!d->deletedArguments[i])
-            args.append(d->registers[d->firstParameterIndex + i].jsValue());
+            args.append(d->registers[d->firstParameterIndex + i].get());
         else
             args.append(get(exec, i));
     }
     for (; i < d->numArguments; ++i) {
         if (!d->deletedArguments[i])
-            args.append(d->extraArguments[i - d->numParameters].jsValue());
+            args.append(d->extraArguments[i - d->numParameters].get());
         else
             args.append(get(exec, i));
     }
@@ -145,9 +145,9 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& sl
 {
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters) {
-            slot.setRegisterSlot(&d->registers[d->firstParameterIndex + i]);
+            slot.setValue(d->registers[d->firstParameterIndex + i].get());
         } else
-            slot.setValue(d->extraArguments[i - d->numParameters].jsValue());
+            slot.setValue(d->extraArguments[i - d->numParameters].get());
         return true;
     }
 
@@ -184,9 +184,9 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     unsigned i = propertyName.toArrayIndex(isArrayIndex);
     if (isArrayIndex && i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters) {
-            slot.setRegisterSlot(&d->registers[d->firstParameterIndex + i]);
+            slot.setValue(d->registers[d->firstParameterIndex + i].get());
         } else
-            slot.setValue(d->extraArguments[i - d->numParameters].jsValue());
+            slot.setValue(d->extraArguments[i - d->numParameters].get());
         return true;
     }
 
@@ -215,9 +215,9 @@ bool Arguments::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     unsigned i = propertyName.toArrayIndex(isArrayIndex);
     if (isArrayIndex && i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters) {
-            descriptor.setDescriptor(d->registers[d->firstParameterIndex + i].jsValue(), DontEnum);
+            descriptor.setDescriptor(d->registers[d->firstParameterIndex + i].get(), DontEnum);
         } else
-            descriptor.setDescriptor(d->extraArguments[i - d->numParameters].jsValue(), DontEnum);
+            descriptor.setDescriptor(d->extraArguments[i - d->numParameters].get(), DontEnum);
         return true;
     }
     
@@ -257,9 +257,9 @@ void Arguments::put(ExecState* exec, unsigned i, JSValue value)
 {
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters)
-            d->registers[d->firstParameterIndex + i] = JSValue(value);
+            d->registers[d->firstParameterIndex + i].set(exec->globalData(), d->activation ? static_cast<JSCell*>(d->activation.get()) : static_cast<JSCell*>(this), value);
         else
-            d->extraArguments[i - d->numParameters] = JSValue(value);
+            d->extraArguments[i - d->numParameters].set(exec->globalData(), this, value);
         return;
     }
 
@@ -273,9 +273,9 @@ void Arguments::put(ExecState* exec, const Identifier& propertyName, JSValue val
     unsigned i = propertyName.toArrayIndex(isArrayIndex);
     if (isArrayIndex && i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters)
-            d->registers[d->firstParameterIndex + i] = JSValue(value);
+            d->registers[d->firstParameterIndex + i].set(exec->globalData(), d->activation ? static_cast<JSCell*>(d->activation.get()) : static_cast<JSCell*>(this), value);
         else
-            d->extraArguments[i - d->numParameters] = JSValue(value);
+            d->extraArguments[i - d->numParameters].set(exec->globalData(), this, value);
         return;
     }
 
diff --git a/Source/JavaScriptCore/runtime/Arguments.h b/Source/JavaScriptCore/runtime/Arguments.h
index 658538b..b5aa46b 100644
--- a/Source/JavaScriptCore/runtime/Arguments.h
+++ b/Source/JavaScriptCore/runtime/Arguments.h
@@ -29,7 +29,6 @@
 #include "JSGlobalObject.h"
 #include "Interpreter.h"
 #include "ObjectConstructor.h"
-#include "PrototypeFunction.h"
 
 namespace JSC {
 
@@ -43,12 +42,12 @@ namespace JSC {
         ptrdiff_t firstParameterIndex;
         unsigned numArguments;
 
-        Register* registers;
-        OwnArrayPtr<Register> registerArray;
+        WriteBarrier<Unknown>* registers;
+        OwnArrayPtr<WriteBarrier<Unknown> > registerArray;
 
-        Register* extraArguments;
+        WriteBarrier<Unknown>* extraArguments;
         OwnArrayPtr<bool> deletedArguments;
-        Register extraArgumentsFixedBuffer[4];
+        WriteBarrier<Unknown> extraArgumentsFixedBuffer[4];
 
         WriteBarrier<JSFunction> callee;
         bool overrodeLength : 1;
@@ -58,7 +57,7 @@ namespace JSC {
     };
 
 
-    class Arguments : public JSObject {
+    class Arguments : public JSNonFinalObject {
     public:
         // Use an enum because otherwise gcc insists on doing a memory
         // read.
@@ -70,7 +69,7 @@ namespace JSC {
         Arguments(CallFrame*, NoParametersType);
         virtual ~Arguments();
 
-        static const ClassInfo info;
+        static const ClassInfo s_info;
 
         virtual void markChildren(MarkStack&);
 
@@ -84,17 +83,18 @@ namespace JSC {
         }
         
         void copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize);
-        void copyRegisters();
+        void copyRegisters(JSGlobalData&);
         bool isTornOff() const { return d->registerArray; }
         void setActivation(JSGlobalData& globalData, JSActivation* activation)
         {
+            ASSERT(!d->registerArray);
             d->activation.set(globalData, this, activation);
             d->registers = &activation->registerAt(0);
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
     protected:
@@ -113,8 +113,6 @@ namespace JSC {
         void createStrictModeCallerIfNecessary(ExecState*);
         void createStrictModeCalleeIfNecessary(ExecState*);
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-
         void init(CallFrame*);
 
         OwnPtr<ArgumentsData> d;
@@ -124,7 +122,7 @@ namespace JSC {
 
     inline Arguments* asArguments(JSValue value)
     {
-        ASSERT(asObject(value)->inherits(&Arguments::info));
+        ASSERT(asObject(value)->inherits(&Arguments::s_info));
         return static_cast<Arguments*>(asObject(value));
     }
 
@@ -145,9 +143,11 @@ namespace JSC {
     }
 
     inline Arguments::Arguments(CallFrame* callFrame)
-        : JSObject(callFrame->lexicalGlobalObject()->argumentsStructure())
+        : JSNonFinalObject(callFrame->globalData(), callFrame->lexicalGlobalObject()->argumentsStructure())
         , d(adoptPtr(new ArgumentsData))
     {
+        ASSERT(inherits(&s_info));
+
         JSFunction* callee;
         ptrdiff_t firstParameterIndex;
         Register* argv;
@@ -158,19 +158,19 @@ namespace JSC {
         d->firstParameterIndex = firstParameterIndex;
         d->numArguments = numArguments;
 
-        d->registers = callFrame->registers();
+        d->registers = reinterpret_cast<WriteBarrier<Unknown>*>(callFrame->registers());
 
-        Register* extraArguments;
+        WriteBarrier<Unknown>* extraArguments;
         if (d->numArguments <= d->numParameters)
             extraArguments = 0;
         else {
             unsigned numExtraArguments = d->numArguments - d->numParameters;
-            if (numExtraArguments > sizeof(d->extraArgumentsFixedBuffer) / sizeof(Register))
-                extraArguments = new Register[numExtraArguments];
+            if (numExtraArguments > sizeof(d->extraArgumentsFixedBuffer) / sizeof(WriteBarrier<Unknown>))
+                extraArguments = new WriteBarrier<Unknown>[numExtraArguments];
             else
                 extraArguments = d->extraArgumentsFixedBuffer;
             for (unsigned i = 0; i < numExtraArguments; ++i)
-                extraArguments[i] = argv[d->numParameters + i];
+                extraArguments[i].set(callFrame->globalData(), this, argv[d->numParameters + i].jsValue());
         }
 
         d->extraArguments = extraArguments;
@@ -181,13 +181,14 @@ namespace JSC {
         d->overrodeCaller = false;
         d->isStrictMode = callFrame->codeBlock()->isStrictMode();
         if (d->isStrictMode)
-            copyRegisters();
+            copyRegisters(callFrame->globalData());
     }
 
     inline Arguments::Arguments(CallFrame* callFrame, NoParametersType)
-        : JSObject(callFrame->lexicalGlobalObject()->argumentsStructure())
+        : JSNonFinalObject(callFrame->globalData(), callFrame->lexicalGlobalObject()->argumentsStructure())
         , d(adoptPtr(new ArgumentsData))
     {
+        ASSERT(inherits(&s_info));
         ASSERT(!asFunction(callFrame->callee())->jsExecutable()->parameterCount());
 
         unsigned numArguments = callFrame->argumentCount();
@@ -195,15 +196,15 @@ namespace JSC {
         d->numParameters = 0;
         d->numArguments = numArguments;
 
-        Register* extraArguments;
+        WriteBarrier<Unknown>* extraArguments;
         if (numArguments > sizeof(d->extraArgumentsFixedBuffer) / sizeof(Register))
-            extraArguments = new Register[numArguments];
+            extraArguments = new WriteBarrier<Unknown>[numArguments];
         else
             extraArguments = d->extraArgumentsFixedBuffer;
 
         Register* argv = callFrame->registers() - RegisterFile::CallFrameHeaderSize - numArguments - 1;
         for (unsigned i = 0; i < numArguments; ++i)
-            extraArguments[i] = argv[i];
+            extraArguments[i].set(callFrame->globalData(), this, argv[i].jsValue());
 
         d->extraArguments = extraArguments;
 
@@ -213,10 +214,10 @@ namespace JSC {
         d->overrodeCaller = false;
         d->isStrictMode = callFrame->codeBlock()->isStrictMode();
         if (d->isStrictMode)
-            copyRegisters();
+            copyRegisters(callFrame->globalData());
     }
 
-    inline void Arguments::copyRegisters()
+    inline void Arguments::copyRegisters(JSGlobalData& globalData)
     {
         ASSERT(!isTornOff());
 
@@ -226,29 +227,28 @@ namespace JSC {
         int registerOffset = d->numParameters + RegisterFile::CallFrameHeaderSize;
         size_t registerArraySize = d->numParameters;
 
-        OwnArrayPtr<Register> registerArray = adoptArrayPtr(new Register[registerArraySize]);
-        memcpy(registerArray.get(), d->registers - registerOffset, registerArraySize * sizeof(Register));
+        OwnArrayPtr<WriteBarrier<Unknown> > registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[registerArraySize]);
+        for (size_t i = 0; i < registerArraySize; i++)
+            registerArray[i].set(globalData, this, d->registers[i - registerOffset].get());
         d->registers = registerArray.get() + registerOffset;
         d->registerArray = registerArray.release();
     }
 
     // This JSActivation function is defined here so it can get at Arguments::setRegisters.
-    inline void JSActivation::copyRegisters()
+    inline void JSActivation::copyRegisters(JSGlobalData& globalData)
     {
-        ASSERT(!d()->registerArray);
+        ASSERT(!m_registerArray);
 
-        size_t numParametersMinusThis = d()->functionExecutable->parameterCount();
-        size_t numVars = d()->functionExecutable->capturedVariableCount();
-        size_t numLocals = numVars + numParametersMinusThis;
+        size_t numLocals = m_numCapturedVars + m_numParametersMinusThis;
 
         if (!numLocals)
             return;
 
-        int registerOffset = numParametersMinusThis + RegisterFile::CallFrameHeaderSize;
+        int registerOffset = m_numParametersMinusThis + RegisterFile::CallFrameHeaderSize;
         size_t registerArraySize = numLocals + RegisterFile::CallFrameHeaderSize;
 
-        OwnArrayPtr<Register> registerArray = copyRegisterArray(d()->registers - registerOffset, registerArraySize);
-        Register* registers = registerArray.get() + registerOffset;
+        OwnArrayPtr<WriteBarrier<Unknown> > registerArray = copyRegisterArray(globalData, m_registers - registerOffset, registerArraySize, m_numParametersMinusThis + 1);
+        WriteBarrier<Unknown>* registers = registerArray.get() + registerOffset;
         setRegisters(registers, registerArray.release());
     }
 
diff --git a/Source/JavaScriptCore/runtime/ArrayConstructor.cpp b/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
index 5d0adbd..050e989 100644
--- a/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -30,7 +30,6 @@
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Lookup.h"
-#include "PrototypeFunction.h"
 
 namespace JSC {
 
@@ -38,7 +37,7 @@ ASSERT_CLASS_FITS_IN_CELL(ArrayConstructor);
     
 static EncodedJSValue JSC_HOST_CALL arrayConstructorIsArray(ExecState*);
 
-ArrayConstructor::ArrayConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, ArrayPrototype* arrayPrototype, Structure* prototypeFunctionStructure)
+ArrayConstructor::ArrayConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, ArrayPrototype* arrayPrototype, Structure* functionStructure)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, arrayPrototype->classInfo()->className))
 {
     // ECMA 15.4.3.1 Array.prototype
@@ -48,21 +47,23 @@ ArrayConstructor::ArrayConstructor(ExecState* exec, JSGlobalObject* globalObject
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
 
     // ES5
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().isArray, arrayConstructorIsArray), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().isArray, arrayConstructorIsArray), DontEnum);
 }
 
 static inline JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
 {
+    JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
+
     // a single numeric argument denotes the array size (!)
     if (args.size() == 1 && args.at(0).isNumber()) {
         uint32_t n = args.at(0).toUInt32(exec);
         if (n != args.at(0).toNumber(exec))
             return throwError(exec, createRangeError(exec, "Array size is not a small enough positive integer."));
-        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), n, CreateInitialized);
+        return new (exec) JSArray(exec->globalData(), globalObject->arrayStructure(), n, CreateInitialized);
     }
 
     // otherwise the array is constructed with the arguments in it
-    return new (exec) JSArray(exec->globalData(), exec->lexicalGlobalObject()->arrayStructure(), args);
+    return new (exec) JSArray(exec->globalData(), globalObject->arrayStructure(), args);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithArrayConstructor(ExecState* exec)
@@ -94,7 +95,7 @@ CallType ArrayConstructor::getCallData(CallData& callData)
 
 EncodedJSValue JSC_HOST_CALL arrayConstructorIsArray(ExecState* exec)
 {
-    return JSValue::encode(jsBoolean(exec->argument(0).inherits(&JSArray::info)));
+    return JSValue::encode(jsBoolean(exec->argument(0).inherits(&JSArray::s_info)));
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ArrayConstructor.h b/Source/JavaScriptCore/runtime/ArrayConstructor.h
index 5e1408f..97b26c5 100644
--- a/Source/JavaScriptCore/runtime/ArrayConstructor.h
+++ b/Source/JavaScriptCore/runtime/ArrayConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class ArrayConstructor : public InternalFunction {
     public:
-        ArrayConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, ArrayPrototype*, Structure*);
+        ArrayConstructor(ExecState*, JSGlobalObject*, Structure*, ArrayPrototype*, Structure*);
 
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
index 70c0d06..29caece 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -85,7 +85,7 @@ static inline bool isNumericCompareFunction(ExecState* exec, CallType callType,
 
 // ------------------------------ ArrayPrototype ----------------------------
 
-const ClassInfo ArrayPrototype::info = {"Array", &JSArray::info, 0, ExecState::arrayTable};
+const ClassInfo ArrayPrototype::s_info = {"Array", &JSArray::s_info, 0, ExecState::arrayTable};
 
 /* Source for ArrayPrototype.lut.h
 @begin arrayTable 16
@@ -114,9 +114,10 @@ const ClassInfo ArrayPrototype::info = {"Array", &JSArray::info, 0, ExecState::a
 */
 
 // ECMA 15.4.4
-ArrayPrototype::ArrayPrototype(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
-    : JSArray(structure)
+ArrayPrototype::ArrayPrototype(JSGlobalObject* globalObject, Structure* structure)
+    : JSArray(globalObject->globalData(), structure)
 {
+    ASSERT(inherits(&s_info));
     putAnonymousValue(globalObject->globalData(), 0, globalObject);
 }
 
@@ -164,16 +165,20 @@ static unsigned argumentClampedIndexFromStartOrEnd(ExecState* exec, int argument
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
+
     bool isRealArray = isJSArray(&exec->globalData(), thisValue);
-    if (!isRealArray && !thisValue.inherits(&JSArray::info))
+    if (!isRealArray && !thisValue.inherits(&JSArray::s_info))
         return throwVMTypeError(exec);
     JSArray* thisObj = asArray(thisValue);
     
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     StringRecursionChecker checker(exec, thisObj);
     if (EncodedJSValue earlyReturnValue = checker.earlyReturnValue())
         return earlyReturnValue;
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned totalSize = length ? length - 1 : 0;
 #if OS(SYMBIAN)
     // Symbian has very limited stack size available.
@@ -224,16 +229,20 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&JSArray::info))
+
+    if (!thisValue.inherits(&JSArray::s_info))
         return throwVMTypeError(exec);
     JSObject* thisObj = asArray(thisValue);
 
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     StringRecursionChecker checker(exec, thisObj);
     if (EncodedJSValue earlyReturnValue = checker.earlyReturnValue())
         return earlyReturnValue;
 
     JSStringBuilder strBuffer;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
         if (k >= 1)
             strBuffer.append(',');
@@ -259,6 +268,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
     StringRecursionChecker checker(exec, thisObj);
     if (EncodedJSValue earlyReturnValue = checker.earlyReturnValue())
@@ -270,7 +282,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
     if (!exec->argument(0).isUndefined())
         separator = exec->argument(0).toString(exec);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned k = 0;
     if (isJSArray(&exec->globalData(), thisObj)) {
         JSArray* array = asArray(thisObj);
@@ -330,7 +341,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec)
     size_t i = 0;
     size_t argCount = exec->argumentCount();
     while (1) {
-        if (curArg.inherits(&JSArray::info)) {
+        if (curArg.inherits(&JSArray::s_info)) {
             unsigned length = curArg.get(exec, exec->propertyNames().length).toUInt32(exec);
             JSObject* curObject = curArg.toObject(exec);
             for (unsigned k = 0; k < length; ++k) {
@@ -354,12 +365,16 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
+
     if (isJSArray(&exec->globalData(), thisValue))
         return JSValue::encode(asArray(thisValue)->pop());
 
     JSObject* thisObj = thisValue.toThisObject(exec);
-    JSValue result;
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
+    JSValue result;
     if (length == 0) {
         putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length));
         result = jsUndefined();
@@ -374,6 +389,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
+
     if (isJSArray(&exec->globalData(), thisValue) && exec->argumentCount() == 1) {
         JSArray* array = asArray(thisValue);
         array->push(exec, exec->argument(0));
@@ -382,6 +398,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec)
 
     JSObject* thisObj = thisValue.toThisObject(exec);
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     for (unsigned n = 0; n < exec->argumentCount(); n++)
         thisObj->put(exec, length + n, exec->argument(n));
     length += exec->argumentCount();
@@ -393,8 +412,10 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-    unsigned middle = length / 2;
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
+    unsigned middle = length / 2;
     for (unsigned k = 0; k < middle; k++) {
         unsigned lk1 = length - k - 1;
         JSValue obj2 = getProperty(exec, thisObj, lk1);
@@ -419,6 +440,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec)
     JSValue result;
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     if (length == 0) {
         putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length));
         result = jsUndefined();
@@ -450,6 +474,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState* exec)
     JSValue result = resObj;
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, length);
     unsigned end = argumentClampedIndexFromStartOrEnd(exec, 1, length, length);
 
@@ -465,12 +492,15 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (!length || exec->hadException())
+        return JSValue::encode(thisObj);
 
     JSValue function = exec->argument(0);
     CallData callData;
     CallType callType = getCallData(function, callData);
 
-    if (thisObj->classInfo() == &JSArray::info) {
+    if (thisObj->classInfo() == &JSArray::s_info) {
         if (isNumericCompareFunction(exec, callType, callData))
             asArray(thisObj)->sortNumeric(exec, function, callType, callData);
         else if (callType != CallTypeNone)
@@ -480,19 +510,18 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
         return JSValue::encode(thisObj);
     }
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-
-    if (!length)
-        return JSValue::encode(thisObj);
-
     // "Min" sort. Not the fastest, but definitely less code than heapsort
     // or quicksort, and much less swapping than bubblesort/insertionsort.
     for (unsigned i = 0; i < length - 1; ++i) {
         JSValue iObj = thisObj->get(exec, i);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
         unsigned themin = i;
         JSValue minObj = iObj;
         for (unsigned j = i + 1; j < length; ++j) {
             JSValue jObj = thisObj->get(exec, j);
+            if (exec->hadException())
+                return JSValue::encode(jsUndefined());
             double compareResult;
             if (jObj.isUndefined())
                 compareResult = 1; // don't check minObj because there's no need to differentiate == (0) from > (1)
@@ -522,14 +551,16 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
 {
-    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
-
     // 15.4.4.12
 
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     if (!exec->argumentCount())
         return JSValue::encode(constructEmptyArray(exec));
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, length);
 
     unsigned deleteCount = length - begin;
@@ -543,7 +574,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
             deleteCount = static_cast<unsigned>(deleteDouble);
     }
 
-    JSArray* resObj = new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), deleteCount, CreateCompact);
+    JSArray* resObj = new (exec) JSArray(exec->globalData(), exec->lexicalGlobalObject()->arrayStructure(), deleteCount, CreateCompact);
     JSValue result = resObj;
     JSGlobalData& globalData = exec->globalData();
     for (unsigned k = 0; k < deleteCount; k++)
@@ -588,10 +619,13 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState* exec)
 {
-    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
-
     // 15.4.4.13
+
+    JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     unsigned nrArgs = exec->argumentCount();
     if ((nrArgs) && (length)) {
         if (isJSArray(&exec->globalData(), thisObj))
@@ -615,6 +649,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -626,7 +663,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
     JSArray* resultArray = constructEmptyArray(exec);
 
     unsigned filterIndex = 0;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned k = 0;
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
@@ -650,20 +686,19 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
     }
     for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
-
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
-
         JSValue v = slot.getValue(exec, k);
 
-        MarkedArgumentBuffer eachArguments;
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
 
+        MarkedArgumentBuffer eachArguments;
         eachArguments.append(v);
         eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
         JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
-
         if (result.toBoolean(exec))
             resultArray->put(exec, filterIndex++, v);
     }
@@ -673,6 +708,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -682,8 +720,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
 
     JSObject* applyThis = exec->argument(1).isUndefinedOrNull() ? exec->globalThisValue() : exec->argument(1).toObject(exec);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-
     JSArray* resultArray = constructEmptyArray(exec, length);
     unsigned k = 0;
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
@@ -706,15 +742,19 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
         PropertySlot slot(thisObj);
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
-
         JSValue v = slot.getValue(exec, k);
 
-        MarkedArgumentBuffer eachArguments;
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
 
+        MarkedArgumentBuffer eachArguments;
         eachArguments.append(v);
         eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
+
         JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
         resultArray->put(exec, k, result);
     }
@@ -730,6 +770,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -741,7 +784,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
 
     JSValue result = jsBoolean(true);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned k = 0;
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
@@ -762,18 +804,18 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
     }
     for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
-
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
         MarkedArgumentBuffer eachArguments;
-
         eachArguments.append(slot.getValue(exec, k));
         eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
-        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
 
+        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
         if (!predicateResult) {
             result = jsBoolean(false);
             break;
@@ -786,6 +828,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -795,7 +840,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
 
     JSObject* applyThis = exec->argument(1).isUndefinedOrNull() ? exec->globalThisValue() : exec->argument(1).toObject(exec);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned k = 0;
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
@@ -823,6 +867,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
         eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
+
         call(exec, function, callType, callData, applyThis, eachArguments);
     }
     return JSValue::encode(jsUndefined());
@@ -831,6 +878,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
     JSValue function = exec->argument(0);
     CallData callData;
@@ -842,7 +892,6 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
 
     JSValue result = jsBoolean(false);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned k = 0;
     if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
         JSFunction* f = asFunction(function);
@@ -871,8 +920,10 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
         eachArguments.append(jsNumber(k));
         eachArguments.append(thisObj);
 
-        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
 
+        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
         if (predicateResult) {
             result = jsBoolean(true);
             break;
@@ -884,7 +935,10 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
-    
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     JSValue function = exec->argument(0);
     CallData callData;
     CallType callType = getCallData(function, callData);
@@ -893,9 +947,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
 
     unsigned i = 0;
     JSValue rv;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (!length && exec->argumentCount() == 1)
         return throwVMTypeError(exec);
+
     JSArray* array = 0;
     if (isJSArray(&exec->globalData(), thisObj))
         array = asArray(thisObj);
@@ -937,6 +991,8 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
 
     for (; i < length && !exec->hadException(); ++i) {
         JSValue prop = getProperty(exec, thisObj, i);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
         if (!prop)
             continue;
         
@@ -954,7 +1010,10 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
 {
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
-    
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
     JSValue function = exec->argument(0);
     CallData callData;
     CallType callType = getCallData(function, callData);
@@ -963,9 +1022,9 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
     
     unsigned i = 0;
     JSValue rv;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (!length && exec->argumentCount() == 1)
         return throwVMTypeError(exec);
+
     JSArray* array = 0;
     if (isJSArray(&exec->globalData(), thisObj))
         array = asArray(thisObj);
@@ -1006,6 +1065,8 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
     for (; i < length && !exec->hadException(); ++i) {
         unsigned idx = length - i - 1;
         JSValue prop = getProperty(exec, thisObj, idx);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
         if (!prop)
             continue;
         
@@ -1022,13 +1083,13 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec)
 {
-    // JavaScript 1.5 Extension by Mozilla
-    // Documentation: http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Objects:Array:indexOf
+    // 15.4.4.14
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
-
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
-    unsigned index = argumentClampedIndexFromStartOrEnd(exec, 1, length);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
 
+    unsigned index = argumentClampedIndexFromStartOrEnd(exec, 1, length);
     JSValue searchElement = exec->argument(0);
     for (; index < length; ++index) {
         JSValue e = getProperty(exec, thisObj, index);
@@ -1043,10 +1104,8 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec)
 {
-    // JavaScript 1.6 Extension by Mozilla
-    // Documentation: http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Objects:Array:lastIndexOf
+    // 15.4.4.15
     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
-
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (!length)
         return JSValue::encode(jsNumber(-1));
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.h b/Source/JavaScriptCore/runtime/ArrayPrototype.h
index 42665e3..6dadf51 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.h
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.h
@@ -28,17 +28,16 @@ namespace JSC {
 
     class ArrayPrototype : public JSArray {
     public:
-        explicit ArrayPrototype(JSGlobalObject*, NonNullPassRefPtr<Structure>);
+        explicit ArrayPrototype(JSGlobalObject*, Structure*);
 
         bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-        static const ClassInfo info;
+        static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
diff --git a/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h b/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
index 0f6a646..df7b7f6 100644
--- a/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
+++ b/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h
@@ -39,7 +39,7 @@ namespace JSC {
             , m_object(object)
         {
             if (!m_object->structure()->isDictionary())
-                m_object->setStructure(Structure::toCacheableDictionaryTransition(m_object->structure()));
+                m_object->setStructure(globalData, Structure::toCacheableDictionaryTransition(globalData, m_object->structure()));
         }
 
         ~BatchedTransitionOptimizer()
diff --git a/Source/JavaScriptCore/runtime/BooleanConstructor.cpp b/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
index 21ef5bb..a1a4ed4 100644
--- a/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
@@ -28,7 +28,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(BooleanConstructor);
 
-BooleanConstructor::BooleanConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, BooleanPrototype* booleanPrototype)
+BooleanConstructor::BooleanConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, BooleanPrototype* booleanPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, booleanPrototype->classInfo()->className))
 {
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, booleanPrototype, DontEnum | DontDelete | ReadOnly);
@@ -40,7 +40,7 @@ BooleanConstructor::BooleanConstructor(ExecState* exec, JSGlobalObject* globalOb
 // ECMA 15.6.2
 JSObject* constructBoolean(ExecState* exec, const ArgList& args)
 {
-    BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), exec->lexicalGlobalObject()->booleanObjectStructure());
+    BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), asInternalFunction(exec->callee())->globalObject()->booleanObjectStructure());
     obj->setInternalValue(exec->globalData(), jsBoolean(args.at(0).toBoolean(exec)));
     return obj;
 }
@@ -69,9 +69,9 @@ CallType BooleanConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSValue immediateBooleanValue)
+JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSGlobalObject* globalObject, JSValue immediateBooleanValue)
 {
-    BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), exec->lexicalGlobalObject()->booleanObjectStructure());
+    BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), globalObject->booleanObjectStructure());
     obj->setInternalValue(exec->globalData(), immediateBooleanValue);
     return obj;
 }
diff --git a/Source/JavaScriptCore/runtime/BooleanConstructor.h b/Source/JavaScriptCore/runtime/BooleanConstructor.h
index 0f3efa7..fa0d05e 100644
--- a/Source/JavaScriptCore/runtime/BooleanConstructor.h
+++ b/Source/JavaScriptCore/runtime/BooleanConstructor.h
@@ -29,14 +29,14 @@ namespace JSC {
 
     class BooleanConstructor : public InternalFunction {
     public:
-        BooleanConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, BooleanPrototype*);
+        BooleanConstructor(ExecState*, JSGlobalObject*, Structure*, BooleanPrototype*);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
     };
 
-    JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSValue);
+    JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSGlobalObject*, JSValue);
     JSObject* constructBoolean(ExecState*, const ArgList&);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/BooleanObject.cpp b/Source/JavaScriptCore/runtime/BooleanObject.cpp
index 71ff2d2..e24a30a 100644
--- a/Source/JavaScriptCore/runtime/BooleanObject.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanObject.cpp
@@ -25,11 +25,12 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(BooleanObject);
 
-const ClassInfo BooleanObject::info = { "Boolean", 0, 0, 0 };
+const ClassInfo BooleanObject::s_info = { "Boolean", &JSWrapperObject::s_info, 0, 0 };
 
-BooleanObject::BooleanObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure)
+BooleanObject::BooleanObject(JSGlobalData& globalData, Structure* structure)
     : JSWrapperObject(globalData, structure)
 {
+    ASSERT(inherits(&s_info));
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/BooleanObject.h b/Source/JavaScriptCore/runtime/BooleanObject.h
index ff10ef6..def44b4 100644
--- a/Source/JavaScriptCore/runtime/BooleanObject.h
+++ b/Source/JavaScriptCore/runtime/BooleanObject.h
@@ -27,14 +27,13 @@ namespace JSC {
 
     class BooleanObject : public JSWrapperObject {
     public:
-        explicit BooleanObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure>);
+        explicit BooleanObject(JSGlobalData&, Structure*);
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-        static const ClassInfo info;
+        static const ClassInfo s_info;
         
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
     };
 
@@ -42,7 +41,7 @@ namespace JSC {
 
     inline BooleanObject* asBooleanObject(JSValue value)
     {
-        ASSERT(asObject(value)->inherits(&BooleanObject::info));
+        ASSERT(asObject(value)->inherits(&BooleanObject::s_info));
         return static_cast<BooleanObject*>(asObject(value));
     }
 
diff --git a/Source/JavaScriptCore/runtime/BooleanPrototype.cpp b/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
index 54d621c..20990e1 100644
--- a/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
@@ -26,7 +26,6 @@
 #include "JSFunction.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
-#include "PrototypeFunction.h"
 
 namespace JSC {
 
@@ -38,13 +37,13 @@ static EncodedJSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState*);
 
 // ECMA 15.6.4
 
-BooleanPrototype::BooleanPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
+BooleanPrototype::BooleanPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* functionStructure)
     : BooleanObject(exec->globalData(), structure)
 {
     setInternalValue(exec->globalData(), jsBoolean(false));
 
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().toString, booleanProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, booleanProtoFuncValueOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().toString, booleanProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().valueOf, booleanProtoFuncValueOf), DontEnum);
 }
 
 
@@ -61,7 +60,7 @@ EncodedJSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec)
     if (thisValue == jsBoolean(true))
         return JSValue::encode(jsNontrivialString(exec, "true"));
 
-    if (!thisValue.inherits(&BooleanObject::info))
+    if (!thisValue.inherits(&BooleanObject::s_info))
         return throwVMTypeError(exec);
 
     if (asBooleanObject(thisValue)->internalValue() == jsBoolean(false))
@@ -77,7 +76,7 @@ EncodedJSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState* exec)
     if (thisValue.isBoolean())
         return JSValue::encode(thisValue);
 
-    if (!thisValue.inherits(&BooleanObject::info))
+    if (!thisValue.inherits(&BooleanObject::s_info))
         return throwVMTypeError(exec);
 
     return JSValue::encode(asBooleanObject(thisValue)->internalValue());
diff --git a/Source/JavaScriptCore/runtime/BooleanPrototype.h b/Source/JavaScriptCore/runtime/BooleanPrototype.h
index ddadc43..5ccbd2b 100644
--- a/Source/JavaScriptCore/runtime/BooleanPrototype.h
+++ b/Source/JavaScriptCore/runtime/BooleanPrototype.h
@@ -27,7 +27,7 @@ namespace JSC {
 
     class BooleanPrototype : public BooleanObject {
     public:
-        BooleanPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure);
+        BooleanPrototype(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/CallData.h b/Source/JavaScriptCore/runtime/CallData.h
index 32e1094..b138f54 100644
--- a/Source/JavaScriptCore/runtime/CallData.h
+++ b/Source/JavaScriptCore/runtime/CallData.h
@@ -30,7 +30,6 @@
 #define CallData_h
 
 #include "JSValue.h"
-#include "NativeFunctionWrapper.h"
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/runtime/CommonIdentifiers.h b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
index 6587a8f..478a639 100644
--- a/Source/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -39,25 +39,18 @@
     macro(compile) \
     macro(configurable) \
     macro(constructor) \
-    macro(create) \
-    macro(defineProperty) \
-    macro(defineProperties) \
     macro(enumerable) \
     macro(eval) \
     macro(exec) \
     macro(fromCharCode) \
     macro(global) \
     macro(get) \
-    macro(getPrototypeOf) \
-    macro(getOwnPropertyDescriptor) \
-    macro(getOwnPropertyNames) \
     macro(hasOwnProperty) \
     macro(ignoreCase) \
     macro(index) \
     macro(input) \
     macro(isArray) \
     macro(isPrototypeOf) \
-    macro(keys) \
     macro(length) \
     macro(message) \
     macro(multiline) \
diff --git a/Source/JavaScriptCore/runtime/Completion.cpp b/Source/JavaScriptCore/runtime/Completion.cpp
index eeb8b0d..ac19705 100644
--- a/Source/JavaScriptCore/runtime/Completion.cpp
+++ b/Source/JavaScriptCore/runtime/Completion.cpp
@@ -39,7 +39,7 @@ Completion checkSyntax(ExecState* exec, const SourceCode& source)
     JSLock lock(exec);
     ASSERT(exec->globalData().identifierTable == wtfThreadData().currentIdentifierTable());
 
-    RefPtr<ProgramExecutable> program = ProgramExecutable::create(exec, source);
+    ProgramExecutable* program = ProgramExecutable::create(exec, source);
     JSObject* error = program->checkSyntax(exec);
     if (error)
         return Completion(Throw, error);
@@ -47,19 +47,21 @@ Completion checkSyntax(ExecState* exec, const SourceCode& source)
     return Completion(Normal);
 }
 
-Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& source, JSValue thisValue)
+Completion evaluate(ExecState* exec, ScopeChainNode* scopeChain, const SourceCode& source, JSValue thisValue)
 {
     JSLock lock(exec);
     ASSERT(exec->globalData().identifierTable == wtfThreadData().currentIdentifierTable());
 
-    RefPtr<ProgramExecutable> program = ProgramExecutable::create(exec, source);
-    JSObject* error = program->compile(exec, scopeChain.node());
-    if (error)
-        return Completion(Throw, error);
+    ProgramExecutable* program = ProgramExecutable::create(exec, source);
+    if (!program) {
+        JSValue exception = exec->globalData().exception;
+        exec->globalData().exception = JSValue();
+        return Completion(Throw, exception);
+    }
 
     JSObject* thisObj = (!thisValue || thisValue.isUndefinedOrNull()) ? exec->dynamicGlobalObject() : thisValue.toObject(exec);
 
-    JSValue result = exec->interpreter()->execute(program.get(), exec, scopeChain.node(), thisObj);
+    JSValue result = exec->interpreter()->execute(program, exec, scopeChain, thisObj);
 
     if (exec->hadException()) {
         JSValue exception = exec->exception();
diff --git a/Source/JavaScriptCore/runtime/Completion.h b/Source/JavaScriptCore/runtime/Completion.h
index 63b315e..1dd25fd 100644
--- a/Source/JavaScriptCore/runtime/Completion.h
+++ b/Source/JavaScriptCore/runtime/Completion.h
@@ -28,7 +28,7 @@
 namespace JSC {
 
     class ExecState;
-    class ScopeChain;
+    class ScopeChainNode;
     class SourceCode;
 
     enum ComplType { Normal, Break, Continue, ReturnValue, Throw, Interrupted, Terminated };
@@ -56,7 +56,7 @@ namespace JSC {
     };
 
     Completion checkSyntax(ExecState*, const SourceCode&);
-    Completion evaluate(ExecState*, ScopeChain&, const SourceCode&, JSValue thisValue = JSValue());
+    Completion evaluate(ExecState*, ScopeChainNode*, const SourceCode&, JSValue thisValue = JSValue());
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/DateConstructor.cpp b/Source/JavaScriptCore/runtime/DateConstructor.cpp
index f1f3956..9bbb688 100644
--- a/Source/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/DateConstructor.cpp
@@ -30,7 +30,6 @@
 #include "JSString.h"
 #include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
-#include "PrototypeFunction.h"
 #include <math.h>
 #include <time.h>
 #include <wtf/DateMath.h>
@@ -58,20 +57,20 @@ static EncodedJSValue JSC_HOST_CALL dateParse(ExecState*);
 static EncodedJSValue JSC_HOST_CALL dateNow(ExecState*);
 static EncodedJSValue JSC_HOST_CALL dateUTC(ExecState*);
 
-DateConstructor::DateConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure, DatePrototype* datePrototype)
+DateConstructor::DateConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* functionStructure, DatePrototype* datePrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, datePrototype->classInfo()->className))
 {
-      putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, datePrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, datePrototype, DontEnum | DontDelete | ReadOnly);
 
-      putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().parse, dateParse), DontEnum);
-      putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 7, exec->propertyNames().UTC, dateUTC), DontEnum);
-      putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().now, dateNow), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().parse, dateParse), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 7, exec->propertyNames().UTC, dateUTC), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().now, dateNow), DontEnum);
 
-      putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(7), ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(7), ReadOnly | DontEnum | DontDelete);
 }
 
 // ECMA 15.9.3
-JSObject* constructDate(ExecState* exec, const ArgList& args)
+JSObject* constructDate(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args)
 {
     int numArgs = args.size();
 
@@ -80,7 +79,7 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
     if (numArgs == 0) // new Date() ECMA 15.9.3.3
         value = jsCurrentTime();
     else if (numArgs == 1) {
-        if (args.at(0).inherits(&DateInstance::info))
+        if (args.at(0).inherits(&DateInstance::s_info))
             value = asDateInstance(args.at(0))->internalNumber();
         else {
             JSValue primitive = args.at(0).toPrimitive(exec);
@@ -122,13 +121,13 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
         }
     }
 
-    return new (exec) DateInstance(exec, value);
+    return new (exec) DateInstance(exec, globalObject->dateStructure(), value);
 }
     
 static EncodedJSValue JSC_HOST_CALL constructWithDateConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructDate(exec, args));
+    return JSValue::encode(constructDate(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 ConstructType DateConstructor::getConstructData(ConstructData& constructData)
diff --git a/Source/JavaScriptCore/runtime/DateConstructor.h b/Source/JavaScriptCore/runtime/DateConstructor.h
index c8ca456..23a0311 100644
--- a/Source/JavaScriptCore/runtime/DateConstructor.h
+++ b/Source/JavaScriptCore/runtime/DateConstructor.h
@@ -29,14 +29,14 @@ namespace JSC {
 
     class DateConstructor : public InternalFunction {
     public:
-        DateConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure, DatePrototype*);
+        DateConstructor(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure, DatePrototype*);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
     };
 
-    JSObject* constructDate(ExecState*, const ArgList&);
+    JSObject* constructDate(ExecState*, JSGlobalObject*, const ArgList&);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/DateConversion.cpp b/Source/JavaScriptCore/runtime/DateConversion.cpp
index d4b8232..1418876 100644
--- a/Source/JavaScriptCore/runtime/DateConversion.cpp
+++ b/Source/JavaScriptCore/runtime/DateConversion.cpp
@@ -44,6 +44,8 @@
 #include "DateConversion.h"
 
 #include "CallFrame.h"
+#include "JSObject.h"
+#include "ScopeChain.h"
 #include "UString.h"
 #include <wtf/DateMath.h>
 #include <wtf/StringExtras.h>
diff --git a/Source/JavaScriptCore/runtime/DateInstance.cpp b/Source/JavaScriptCore/runtime/DateInstance.cpp
index 44e8b7d..d8ca072 100644
--- a/Source/JavaScriptCore/runtime/DateInstance.cpp
+++ b/Source/JavaScriptCore/runtime/DateInstance.cpp
@@ -32,23 +32,19 @@ using namespace WTF;
 
 namespace JSC {
 
-const ClassInfo DateInstance::info = {"Date", 0, 0, 0};
+const ClassInfo DateInstance::s_info = {"Date", &JSWrapperObject::s_info, 0, 0};
 
-DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure)
+DateInstance::DateInstance(ExecState* exec, Structure* structure)
     : JSWrapperObject(exec->globalData(), structure)
 {
+    ASSERT(inherits(&s_info));
     setInternalValue(exec->globalData(), jsNaN());
 }
 
-DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure, double time)
+DateInstance::DateInstance(ExecState* exec, Structure* structure, double time)
     : JSWrapperObject(exec->globalData(), structure)
 {
-    setInternalValue(exec->globalData(), jsNumber(timeClip(time)));
-}
-
-DateInstance::DateInstance(ExecState* exec, double time)
-    : JSWrapperObject(exec->globalData(), exec->lexicalGlobalObject()->dateStructure())
-{
+    ASSERT(inherits(&s_info));
     setInternalValue(exec->globalData(), jsNumber(timeClip(time)));
 }
 
diff --git a/Source/JavaScriptCore/runtime/DateInstance.h b/Source/JavaScriptCore/runtime/DateInstance.h
index 77d46de..6195c85 100644
--- a/Source/JavaScriptCore/runtime/DateInstance.h
+++ b/Source/JavaScriptCore/runtime/DateInstance.h
@@ -31,13 +31,12 @@ namespace JSC {
 
     class DateInstance : public JSWrapperObject {
     public:
-        DateInstance(ExecState*, double);
-        DateInstance(ExecState*, NonNullPassRefPtr<Structure>, double);
-        explicit DateInstance(ExecState*, NonNullPassRefPtr<Structure>);
+        DateInstance(ExecState*, Structure*, double);
+        explicit DateInstance(ExecState*, Structure*);
 
         double internalNumber() const { return internalValue().uncheckedGetNumber(); }
 
-        static JS_EXPORTDATA const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo s_info;
 
         const GregorianDateTime* gregorianDateTime(ExecState* exec) const
         {
@@ -53,18 +52,14 @@ namespace JSC {
             return calculateGregorianDateTimeUTC(exec);
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
-    protected:
-        static const unsigned StructureFlags = OverridesMarkChildren | JSWrapperObject::StructureFlags;
-
     private:
         const GregorianDateTime* calculateGregorianDateTime(ExecState*) const;
         const GregorianDateTime* calculateGregorianDateTimeUTC(ExecState*) const;
-        virtual const ClassInfo* classInfo() const { return &info; }
 
         mutable RefPtr<DateInstanceData> m_data;
     };
@@ -73,7 +68,7 @@ namespace JSC {
 
     inline DateInstance* asDateInstance(JSValue value)
     {
-        ASSERT(asObject(value)->inherits(&DateInstance::info));
+        ASSERT(asObject(value)->inherits(&DateInstance::s_info));
         return static_cast<DateInstance*>(asObject(value));
     }
 
diff --git a/Source/JavaScriptCore/runtime/DatePrototype.cpp b/Source/JavaScriptCore/runtime/DatePrototype.cpp
index 5838b60..444fa98 100644
--- a/Source/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/Source/JavaScriptCore/runtime/DatePrototype.cpp
@@ -130,7 +130,7 @@ enum LocaleDateTimeFormat { LocaleDateAndTime, LocaleDate, LocaleTime };
 #if PLATFORM(MAC)
 
 // FIXME: Since this is superior to the strftime-based version, why limit this to PLATFORM(MAC)?
-// Instead we should consider using this whenever PLATFORM(CF) is true.
+// Instead we should consider using this whenever USE(CF) is true.
 
 static CFDateFormatterStyle styleFromArgString(const UString& string, CFDateFormatterStyle defaultStyle)
 {
@@ -374,7 +374,7 @@ static bool fillStructuresUsingDateArgs(ExecState *exec, int maxArgs, double *ms
     return ok;
 }
 
-const ClassInfo DatePrototype::info = {"Date", &DateInstance::info, 0, ExecState::dateTable};
+const ClassInfo DatePrototype::s_info = {"Date", &DateInstance::s_info, 0, ExecState::dateTable};
 
 /* Source for DatePrototype.lut.h
 @begin dateTable
@@ -429,9 +429,11 @@ const ClassInfo DatePrototype::info = {"Date", &DateInstance::info, 0, ExecState
 
 // ECMA 15.9.4
 
-DatePrototype::DatePrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
+DatePrototype::DatePrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure)
     : DateInstance(exec, structure)
 {
+    ASSERT(inherits(&s_info));
+
     // The constructor will be added later, after DateConstructor has been built.
     putAnonymousValue(exec->globalData(), 0, globalObject);
 }
@@ -452,7 +454,7 @@ bool DatePrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier&
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -470,7 +472,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -488,7 +490,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
     
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -507,7 +509,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -523,7 +525,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -539,7 +541,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -549,7 +551,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -559,7 +561,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -569,7 +571,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     return JSValue::encode(asDateInstance(thisValue)->internalValue());
@@ -578,7 +580,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -592,7 +594,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -606,7 +608,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -624,7 +626,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -638,7 +640,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -652,7 +654,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -666,7 +668,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -680,7 +682,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -694,7 +696,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -708,7 +710,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -722,7 +724,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -736,7 +738,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -750,7 +752,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -764,7 +766,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -778,7 +780,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -792,7 +794,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -808,7 +810,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -824,7 +826,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -838,7 +840,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -852,7 +854,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec)
 static EncodedJSValue setNewValueFromTimeArgs(ExecState* exec, int numArgsToUse, bool inputIsUTC)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
@@ -889,7 +891,7 @@ static EncodedJSValue setNewValueFromTimeArgs(ExecState* exec, int numArgsToUse,
 static EncodedJSValue setNewValueFromDateArgs(ExecState* exec, int numArgsToUse, bool inputIsUTC)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
@@ -1013,7 +1015,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCFullYear(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);     
@@ -1054,7 +1056,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&DateInstance::info))
+    if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
diff --git a/Source/JavaScriptCore/runtime/DatePrototype.h b/Source/JavaScriptCore/runtime/DatePrototype.h
index e3672aa..2e1030d 100644
--- a/Source/JavaScriptCore/runtime/DatePrototype.h
+++ b/Source/JavaScriptCore/runtime/DatePrototype.h
@@ -29,22 +29,23 @@ namespace JSC {
 
     class DatePrototype : public DateInstance {
     public:
-        DatePrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>);
+        DatePrototype(ExecState*, JSGlobalObject*, Structure*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-        static const ClassInfo info;
+        static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | DateInstance::StructureFlags;
 
+        COMPILE_ASSERT(!DateInstance::AnonymousSlotCount, DatePrototype_stomps_on_your_anonymous_slot);
+        static const unsigned AnonymousSlotCount = 1;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/Error.cpp b/Source/JavaScriptCore/runtime/Error.cpp
index b84f5ea..7eda19f 100644
--- a/Source/JavaScriptCore/runtime/Error.cpp
+++ b/Source/JavaScriptCore/runtime/Error.cpp
@@ -167,7 +167,7 @@ JSObject* throwSyntaxError(ExecState* exec)
 
 class StrictModeTypeErrorFunction : public InternalFunction {
 public:
-    StrictModeTypeErrorFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const UString& message)
+    StrictModeTypeErrorFunction(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, const UString& message)
         : InternalFunction(&exec->globalData(), globalObject, structure, exec->globalData().propertyNames->emptyIdentifier)
         , m_message(message)
     {
diff --git a/Source/JavaScriptCore/runtime/ErrorConstructor.cpp b/Source/JavaScriptCore/runtime/ErrorConstructor.cpp
index 2e53b95..df112dd 100644
--- a/Source/JavaScriptCore/runtime/ErrorConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorConstructor.cpp
@@ -29,7 +29,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(ErrorConstructor);
 
-ErrorConstructor::ErrorConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, ErrorPrototype* errorPrototype)
+ErrorConstructor::ErrorConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, ErrorPrototype* errorPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, errorPrototype->classInfo()->className))
 {
     // ECMA 15.11.3.1 Error.prototype
@@ -42,7 +42,7 @@ ErrorConstructor::ErrorConstructor(ExecState* exec, JSGlobalObject* globalObject
 static EncodedJSValue JSC_HOST_CALL constructWithErrorConstructor(ExecState* exec)
 {
     JSValue message = exec->argumentCount() ? exec->argument(0) : jsUndefined();
-    Structure* errorStructure = exec->lexicalGlobalObject()->errorStructure();
+    Structure* errorStructure = asInternalFunction(exec->callee())->globalObject()->errorStructure();
     return JSValue::encode(ErrorInstance::create(exec, errorStructure, message));
 }
 
@@ -55,7 +55,7 @@ ConstructType ErrorConstructor::getConstructData(ConstructData& constructData)
 static EncodedJSValue JSC_HOST_CALL callErrorConstructor(ExecState* exec)
 {
     JSValue message = exec->argumentCount() ? exec->argument(0) : jsUndefined();
-    Structure* errorStructure = exec->lexicalGlobalObject()->errorStructure();
+    Structure* errorStructure = asInternalFunction(exec->callee())->globalObject()->errorStructure();
     return JSValue::encode(ErrorInstance::create(exec, errorStructure, message));
 }
 
diff --git a/Source/JavaScriptCore/runtime/ErrorConstructor.h b/Source/JavaScriptCore/runtime/ErrorConstructor.h
index 3d0d706..ceec005 100644
--- a/Source/JavaScriptCore/runtime/ErrorConstructor.h
+++ b/Source/JavaScriptCore/runtime/ErrorConstructor.h
@@ -30,7 +30,7 @@ namespace JSC {
 
     class ErrorConstructor : public InternalFunction {
     public:
-        ErrorConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, ErrorPrototype*);
+        ErrorConstructor(ExecState*, JSGlobalObject*, Structure*, ErrorPrototype*);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.cpp b/Source/JavaScriptCore/runtime/ErrorInstance.cpp
index a6208d5..ed95ba4 100644
--- a/Source/JavaScriptCore/runtime/ErrorInstance.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorInstance.cpp
@@ -23,28 +23,30 @@
 
 namespace JSC {
 
-const ClassInfo ErrorInstance::info = { "Error", 0, 0, 0 };
+const ClassInfo ErrorInstance::s_info = { "Error", &JSNonFinalObject::s_info, 0, 0 };
 
-ErrorInstance::ErrorInstance(JSGlobalData* globalData, NonNullPassRefPtr<Structure> structure)
-    : JSObject(structure)
+ErrorInstance::ErrorInstance(JSGlobalData* globalData, Structure* structure)
+    : JSNonFinalObject(*globalData, structure)
     , m_appendSourceToMessage(false)
 {
+    ASSERT(inherits(&s_info));
     putDirect(*globalData, globalData->propertyNames->message, jsString(globalData, ""));
 }
 
-ErrorInstance::ErrorInstance(JSGlobalData* globalData, NonNullPassRefPtr<Structure> structure, const UString& message)
-    : JSObject(structure)
+ErrorInstance::ErrorInstance(JSGlobalData* globalData, Structure* structure, const UString& message)
+    : JSNonFinalObject(*globalData, structure)
     , m_appendSourceToMessage(false)
 {
+    ASSERT(inherits(&s_info));
     putDirect(*globalData, globalData->propertyNames->message, jsString(globalData, message));
 }
 
-ErrorInstance* ErrorInstance::create(JSGlobalData* globalData, NonNullPassRefPtr<Structure> structure, const UString& message)
+ErrorInstance* ErrorInstance::create(JSGlobalData* globalData, Structure* structure, const UString& message)
 {
     return new (globalData) ErrorInstance(globalData, structure, message);
 }
 
-ErrorInstance* ErrorInstance::create(ExecState* exec, NonNullPassRefPtr<Structure> structure, JSValue message)
+ErrorInstance* ErrorInstance::create(ExecState* exec, Structure* structure, JSValue message)
 {
     if (message.isUndefined())
         return new (exec) ErrorInstance(&exec->globalData(), structure);
diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.h b/Source/JavaScriptCore/runtime/ErrorInstance.h
index b3bebec..afcf158 100644
--- a/Source/JavaScriptCore/runtime/ErrorInstance.h
+++ b/Source/JavaScriptCore/runtime/ErrorInstance.h
@@ -25,14 +25,17 @@
 
 namespace JSC {
 
-    class ErrorInstance : public JSObject {
+    class ErrorInstance : public JSNonFinalObject {
     public:
+        static const ClassInfo s_info;
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-        static const ClassInfo info;
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
+        {
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        }
 
-        static ErrorInstance* create(JSGlobalData*, NonNullPassRefPtr<Structure>, const UString&);
-        static ErrorInstance* create(ExecState* exec, NonNullPassRefPtr<Structure>, JSValue message);
+        static ErrorInstance* create(JSGlobalData*, Structure*, const UString&);
+        static ErrorInstance* create(ExecState*, Structure*, JSValue message);
 
 
         bool appendSourceToMessage() { return m_appendSourceToMessage; }
@@ -42,8 +45,8 @@ namespace JSC {
         virtual bool isErrorInstance() const { return true; }
 
     protected:
-        explicit ErrorInstance(JSGlobalData*, NonNullPassRefPtr<Structure>);
-        explicit ErrorInstance(JSGlobalData*, NonNullPassRefPtr<Structure>, const UString&);
+        explicit ErrorInstance(JSGlobalData*, Structure*);
+        explicit ErrorInstance(JSGlobalData*, Structure*, const UString&);
 
         bool m_appendSourceToMessage;
     };
diff --git a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
index b4e0a7c..a57e947 100644
--- a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -25,7 +25,6 @@
 #include "JSString.h"
 #include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
-#include "PrototypeFunction.h"
 #include "StringRecursionChecker.h"
 #include "UString.h"
 
@@ -36,13 +35,13 @@ ASSERT_CLASS_FITS_IN_CELL(ErrorPrototype);
 static EncodedJSValue JSC_HOST_CALL errorProtoFuncToString(ExecState*);
 
 // ECMA 15.9.4
-ErrorPrototype::ErrorPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
+ErrorPrototype::ErrorPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* functionStructure)
     : ErrorInstance(&exec->globalData(), structure)
 {
     // The constructor will be added later in ErrorConstructor's constructor
 
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().name, jsNontrivialString(exec, "Error"), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().toString, errorProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().toString, errorProtoFuncToString), DontEnum);
 }
 
 EncodedJSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/ErrorPrototype.h b/Source/JavaScriptCore/runtime/ErrorPrototype.h
index fce2742..9437d3a 100644
--- a/Source/JavaScriptCore/runtime/ErrorPrototype.h
+++ b/Source/JavaScriptCore/runtime/ErrorPrototype.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class ErrorPrototype : public ErrorInstance {
     public:
-        ErrorPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure);
+        ErrorPrototype(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
index 4a58800..1d74315 100644
--- a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -41,10 +41,10 @@
 
 namespace JSC {
 
-class InterruptedExecutionError : public JSObject {
+class InterruptedExecutionError : public JSNonFinalObject {
 public:
     InterruptedExecutionError(JSGlobalData* globalData)
-        : JSObject(globalData->interruptedExecutionErrorStructure)
+        : JSNonFinalObject(*globalData, globalData->interruptedExecutionErrorStructure.get())
     {
     }
 
@@ -58,10 +58,10 @@ JSObject* createInterruptedExecutionException(JSGlobalData* globalData)
     return new (globalData) InterruptedExecutionError(globalData);
 }
 
-class TerminatedExecutionError : public JSObject {
+class TerminatedExecutionError : public JSNonFinalObject {
 public:
     TerminatedExecutionError(JSGlobalData* globalData)
-        : JSObject(globalData->terminatedExecutionErrorStructure)
+        : JSNonFinalObject(*globalData, globalData->terminatedExecutionErrorStructure.get())
     {
     }
 
diff --git a/Source/JavaScriptCore/runtime/Executable.cpp b/Source/JavaScriptCore/runtime/Executable.cpp
index 25c551b..fa14ad5 100644
--- a/Source/JavaScriptCore/runtime/Executable.cpp
+++ b/Source/JavaScriptCore/runtime/Executable.cpp
@@ -33,20 +33,25 @@
 #include "UStringBuilder.h"
 #include "Vector.h"
 
+#if ENABLE(DFG_JIT)
+#include "DFGByteCodeParser.h"
+#include "DFGJITCompiler.h"
+#endif
+
 namespace JSC {
 
-#if ENABLE(JIT)
+const ClassInfo ExecutableBase::s_info = { "Executable", 0, 0, 0 };
+
+const ClassInfo NativeExecutable::s_info = { "NativeExecutable", &ExecutableBase::s_info, 0, 0 };
+
 NativeExecutable::~NativeExecutable()
 {
 }
-#endif
 
-VPtrHackExecutable::~VPtrHackExecutable()
-{
-}
+const ClassInfo EvalExecutable::s_info = { "EvalExecutable", &ScriptExecutable::s_info, 0, 0 };
 
 EvalExecutable::EvalExecutable(ExecState* exec, const SourceCode& source, bool inStrictContext)
-    : ScriptExecutable(exec, source, inStrictContext)
+    : ScriptExecutable(exec->globalData().evalExecutableStructure.get(), exec, source, inStrictContext)
 {
 }
 
@@ -54,8 +59,10 @@ EvalExecutable::~EvalExecutable()
 {
 }
 
+const ClassInfo ProgramExecutable::s_info = { "ProgramExecutable", &ScriptExecutable::s_info, 0, 0 };
+
 ProgramExecutable::ProgramExecutable(ExecState* exec, const SourceCode& source)
-    : ScriptExecutable(exec, source, false)
+    : ScriptExecutable(exec->globalData().programExecutableStructure.get(), exec, source, false)
 {
 }
 
@@ -63,8 +70,10 @@ ProgramExecutable::~ProgramExecutable()
 {
 }
 
+const ClassInfo FunctionExecutable::s_info = { "FunctionExecutable", &ScriptExecutable::s_info, 0, 0 };
+
 FunctionExecutable::FunctionExecutable(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool inStrictContext, int firstLine, int lastLine)
-    : ScriptExecutable(globalData, source, inStrictContext)
+    : ScriptExecutable(globalData->functionExecutableStructure.get(), globalData, source, inStrictContext)
     , m_numCapturedVariables(0)
     , m_forceUsesArguments(forceUsesArguments)
     , m_parameters(parameters)
@@ -76,7 +85,7 @@ FunctionExecutable::FunctionExecutable(JSGlobalData* globalData, const Identifie
 }
 
 FunctionExecutable::FunctionExecutable(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool inStrictContext, int firstLine, int lastLine)
-    : ScriptExecutable(exec, source, inStrictContext)
+    : ScriptExecutable(exec->globalData().functionExecutableStructure.get(), exec, source, inStrictContext)
     , m_numCapturedVariables(0)
     , m_forceUsesArguments(forceUsesArguments)
     , m_parameters(parameters)
@@ -87,9 +96,6 @@ FunctionExecutable::FunctionExecutable(ExecState* exec, const Identifier& name,
     m_lastLine = lastLine;
 }
 
-FunctionExecutable::~FunctionExecutable()
-{
-}
 
 JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scopeChainNode)
 {
@@ -103,12 +109,11 @@ JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scope
     }
     recordParse(evalNode->features(), evalNode->hasCapturedVariables(), evalNode->lineNo(), evalNode->lastLine());
 
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
+    JSGlobalObject* globalObject = scopeChainNode->globalObject.get();
 
     ASSERT(!m_evalCodeBlock);
-    m_evalCodeBlock = adoptPtr(new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth()));
-    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(evalNode.get(), scopeChain, m_evalCodeBlock->symbolTable(), m_evalCodeBlock.get())));
+    m_evalCodeBlock = adoptPtr(new EvalCodeBlock(this, globalObject, source().provider(), scopeChainNode->localDepth()));
+    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(evalNode.get(), scopeChainNode, m_evalCodeBlock->symbolTable(), m_evalCodeBlock.get())));
     if ((exception = generator->generate())) {
         m_evalCodeBlock.clear();
         evalNode->destroyData();
@@ -130,6 +135,13 @@ JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scope
     return 0;
 }
 
+void EvalExecutable::markChildren(MarkStack& markStack)
+{
+    ScriptExecutable::markChildren(markStack);
+    if (m_evalCodeBlock)
+        m_evalCodeBlock->markAggregate(markStack);
+}
+
 JSObject* ProgramExecutable::checkSyntax(ExecState* exec)
 {
     JSObject* exception = 0;
@@ -156,11 +168,10 @@ JSObject* ProgramExecutable::compileInternal(ExecState* exec, ScopeChainNode* sc
     }
     recordParse(programNode->features(), programNode->hasCapturedVariables(), programNode->lineNo(), programNode->lastLine());
 
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
+    JSGlobalObject* globalObject = scopeChainNode->globalObject.get();
     
     m_programCodeBlock = adoptPtr(new ProgramCodeBlock(this, GlobalCode, globalObject, source().provider()));
-    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(programNode.get(), scopeChain, &globalObject->symbolTable(), m_programCodeBlock.get())));
+    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(programNode.get(), scopeChainNode, &globalObject->symbolTable(), m_programCodeBlock.get())));
     if ((exception = generator->generate())) {
         m_programCodeBlock.clear();
         programNode->destroyData();
@@ -182,6 +193,41 @@ JSObject* ProgramExecutable::compileInternal(ExecState* exec, ScopeChainNode* sc
    return 0;
 }
 
+#if ENABLE(JIT)
+static bool tryDFGCompile(JSGlobalData* globalData, CodeBlock* codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck)
+{
+#if ENABLE(DFG_JIT)
+#if ENABLE(DFG_JIT_RESTRICTIONS)
+    // FIXME: No flow control yet supported, don't bother scanning the bytecode if there are any jump targets.
+    // FIXME: temporarily disable property accesses until we fix regressions.
+    if (codeBlock->numberOfJumpTargets() || codeBlock->numberOfStructureStubInfos())
+        return false;
+#endif
+
+    DFG::Graph dfg;
+    if (!parse(dfg, globalData, codeBlock))
+        return false;
+
+    DFG::JITCompiler dataFlowJIT(globalData, dfg, codeBlock);
+    dataFlowJIT.compileFunction(jitCode, jitCodeWithArityCheck);
+    return true;
+#else
+    UNUSED_PARAM(globalData);
+    UNUSED_PARAM(codeBlock);
+    UNUSED_PARAM(jitCode);
+    UNUSED_PARAM(jitCodeWithArityCheck);
+    return false;
+#endif
+}
+#endif
+
+void ProgramExecutable::markChildren(MarkStack& markStack)
+{
+    ScriptExecutable::markChildren(markStack);
+    if (m_programCodeBlock)
+        m_programCodeBlock->markAggregate(markStack);
+}
+
 JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChainNode* scopeChainNode)
 {
     JSObject* exception = 0;
@@ -196,12 +242,11 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChain
     body->finishParsing(m_parameters, m_name);
     recordParse(body->features(), body->hasCapturedVariables(), body->lineNo(), body->lastLine());
 
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
+    JSGlobalObject* globalObject = scopeChainNode->globalObject.get();
 
     ASSERT(!m_codeBlockForCall);
     m_codeBlockForCall = adoptPtr(new FunctionCodeBlock(this, FunctionCode, globalObject, source().provider(), source().startOffset(), false));
-    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(body.get(), scopeChain, m_codeBlockForCall->symbolTable(), m_codeBlockForCall.get())));
+    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(body.get(), scopeChainNode, m_codeBlockForCall->symbolTable(), m_codeBlockForCall.get())));
     if ((exception = generator->generate())) {
         m_codeBlockForCall.clear();
         body->destroyData();
@@ -217,7 +262,10 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChain
 
 #if ENABLE(JIT)
     if (exec->globalData().canUseJIT()) {
-        m_jitCodeForCall = JIT::compile(scopeChainNode->globalData, m_codeBlockForCall.get(), &m_jitCodeForCallWithArityCheck);
+        bool dfgCompiled = tryDFGCompile(&exec->globalData(), m_codeBlockForCall.get(), m_jitCodeForCall, m_jitCodeForCallWithArityCheck);
+        if (!dfgCompiled)
+            m_jitCodeForCall = JIT::compile(scopeChainNode->globalData, m_codeBlockForCall.get(), &m_jitCodeForCallWithArityCheck);
+
 #if !ENABLE(OPCODE_SAMPLING)
         if (!BytecodeGenerator::dumpsGeneratedCode())
             m_codeBlockForCall->discardBytecode();
@@ -242,12 +290,11 @@ JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, Scope
     body->finishParsing(m_parameters, m_name);
     recordParse(body->features(), body->hasCapturedVariables(), body->lineNo(), body->lastLine());
 
-    ScopeChain scopeChain(scopeChainNode);
-    JSGlobalObject* globalObject = scopeChain.globalObject();
+    JSGlobalObject* globalObject = scopeChainNode->globalObject.get();
 
     ASSERT(!m_codeBlockForConstruct);
     m_codeBlockForConstruct = adoptPtr(new FunctionCodeBlock(this, FunctionCode, globalObject, source().provider(), source().startOffset(), true));
-    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(body.get(), scopeChain, m_codeBlockForConstruct->symbolTable(), m_codeBlockForConstruct.get())));
+    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(body.get(), scopeChainNode, m_codeBlockForConstruct->symbolTable(), m_codeBlockForConstruct.get())));
     if ((exception = generator->generate())) {
         m_codeBlockForConstruct.clear();
         body->destroyData();
@@ -274,8 +321,9 @@ JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, Scope
     return 0;
 }
 
-void FunctionExecutable::markAggregate(MarkStack& markStack)
+void FunctionExecutable::markChildren(MarkStack& markStack)
 {
+    ScriptExecutable::markChildren(markStack);
     if (m_codeBlockForCall)
         m_codeBlockForCall->markAggregate(markStack);
     if (m_codeBlockForConstruct)
@@ -294,7 +342,7 @@ void FunctionExecutable::discardCode()
 #endif
 }
 
-PassRefPtr<FunctionExecutable> FunctionExecutable::fromGlobalCode(const Identifier& functionName, ExecState* exec, Debugger* debugger, const SourceCode& source, JSObject** exception)
+FunctionExecutable* FunctionExecutable::fromGlobalCode(const Identifier& functionName, ExecState* exec, Debugger* debugger, const SourceCode& source, JSObject** exception)
 {
     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
     RefPtr<ProgramNode> program = exec->globalData().parser->parse<ProgramNode>(lexicalGlobalObject, debugger, exec, source, 0, JSParseNormal, exception);
diff --git a/Source/JavaScriptCore/runtime/Executable.h b/Source/JavaScriptCore/runtime/Executable.h
index 544e487..fbe33cf 100644
--- a/Source/JavaScriptCore/runtime/Executable.h
+++ b/Source/JavaScriptCore/runtime/Executable.h
@@ -44,7 +44,7 @@ namespace JSC {
 
     struct ExceptionInfo;
 
-    class ExecutableBase : public RefCounted<ExecutableBase> {
+    class ExecutableBase : public JSCell {
         friend class JIT;
 
     protected:
@@ -52,21 +52,24 @@ namespace JSC {
         static const int NUM_PARAMETERS_NOT_COMPILED = -1;
     
     public:
-        ExecutableBase(int numParameters)
-            : m_numParametersForCall(numParameters)
+        ExecutableBase(JSGlobalData& globalData, Structure* structure, int numParameters)
+            : JSCell(globalData, structure)
+            , m_numParametersForCall(numParameters)
             , m_numParametersForConstruct(numParameters)
         {
         }
 
-        virtual ~ExecutableBase() {}
-
         bool isHostFunction() const
         {
             ASSERT((m_numParametersForCall == NUM_PARAMETERS_IS_HOST) == (m_numParametersForConstruct == NUM_PARAMETERS_IS_HOST));
             return m_numParametersForCall == NUM_PARAMETERS_IS_HOST;
         }
 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, &s_info); }
+
     protected:
+        static const unsigned StructureFlags = 0;
+        static const ClassInfo s_info;
         int m_numParametersForCall;
         int m_numParametersForConstruct;
 
@@ -92,24 +95,33 @@ namespace JSC {
 #endif
     };
 
-#if ENABLE(JIT)
     class NativeExecutable : public ExecutableBase {
         friend class JIT;
     public:
-        static PassRefPtr<NativeExecutable> create(MacroAssemblerCodePtr callThunk, NativeFunction function, MacroAssemblerCodePtr constructThunk, NativeFunction constructor)
+#if ENABLE(JIT)
+        static NativeExecutable* create(JSGlobalData& globalData, MacroAssemblerCodePtr callThunk, NativeFunction function, MacroAssemblerCodePtr constructThunk, NativeFunction constructor)
         {
             if (!callThunk)
-                return adoptRef(new NativeExecutable(JITCode(), function, JITCode(), constructor));
-            return adoptRef(new NativeExecutable(JITCode::HostFunction(callThunk), function, JITCode::HostFunction(constructThunk), constructor));
+                return new (&globalData) NativeExecutable(globalData, JITCode(), function, JITCode(), constructor);
+            return new (&globalData) NativeExecutable(globalData, JITCode::HostFunction(callThunk), function, JITCode::HostFunction(constructThunk), constructor);
         }
+#else
+        static NativeExecutable* create(JSGlobalData& globalData, NativeFunction function, NativeFunction constructor)
+        {
+            return new (&globalData) NativeExecutable(globalData, function, constructor);
+        }
+#endif
 
         ~NativeExecutable();
 
         NativeFunction function() { return m_function; }
 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(LeafType, StructureFlags), AnonymousSlotCount, &s_info); }
+
     private:
-        NativeExecutable(JITCode callThunk, NativeFunction function, JITCode constructThunk, NativeFunction constructor)
-            : ExecutableBase(NUM_PARAMETERS_IS_HOST)
+#if ENABLE(JIT)
+        NativeExecutable(JSGlobalData& globalData, JITCode callThunk, NativeFunction function, JITCode constructThunk, NativeFunction constructor)
+            : ExecutableBase(globalData, globalData.nativeExecutableStructure.get(), NUM_PARAMETERS_IS_HOST)
             , m_function(function)
             , m_constructor(constructor)
         {
@@ -118,28 +130,26 @@ namespace JSC {
             m_jitCodeForCallWithArityCheck = callThunk.addressForCall();
             m_jitCodeForConstructWithArityCheck = constructThunk.addressForCall();
         }
+#else
+        NativeExecutable(JSGlobalData& globalData, NativeFunction function, NativeFunction constructor)
+            : ExecutableBase(globalData, globalData.nativeExecutableStructure.get(), NUM_PARAMETERS_IS_HOST)
+            , m_function(function)
+            , m_constructor(constructor)
+        {
+        }
+#endif
 
         NativeFunction m_function;
         // Probably should be a NativeConstructor, but this will currently require rewriting the JIT
         // trampoline. It may be easier to make NativeFunction be passed 'this' as a part of the ArgList.
         NativeFunction m_constructor;
-    };
-#endif
-
-    class VPtrHackExecutable : public ExecutableBase {
-    public:
-        VPtrHackExecutable()
-            : ExecutableBase(NUM_PARAMETERS_IS_HOST)
-        {
-        }
-
-        ~VPtrHackExecutable();
+        static const ClassInfo s_info;
     };
 
     class ScriptExecutable : public ExecutableBase {
     public:
-        ScriptExecutable(JSGlobalData* globalData, const SourceCode& source, bool isInStrictContext)
-            : ExecutableBase(NUM_PARAMETERS_NOT_COMPILED)
+        ScriptExecutable(Structure* structure, JSGlobalData* globalData, const SourceCode& source, bool isInStrictContext)
+            : ExecutableBase(*globalData, structure, NUM_PARAMETERS_NOT_COMPILED)
             , m_source(source)
             , m_features(isInStrictContext ? StrictModeFeature : 0)
         {
@@ -152,8 +162,8 @@ namespace JSC {
 #endif
         }
 
-        ScriptExecutable(ExecState* exec, const SourceCode& source, bool isInStrictContext)
-            : ExecutableBase(NUM_PARAMETERS_NOT_COMPILED)
+        ScriptExecutable(Structure* structure, ExecState* exec, const SourceCode& source, bool isInStrictContext)
+            : ExecutableBase(exec->globalData(), structure, NUM_PARAMETERS_NOT_COMPILED)
             , m_source(source)
             , m_features(isInStrictContext ? StrictModeFeature : 0)
         {
@@ -200,6 +210,7 @@ namespace JSC {
 
         JSObject* compile(ExecState* exec, ScopeChainNode* scopeChainNode)
         {
+            ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_evalCodeBlock)
                 error = compileInternal(exec, scopeChainNode);
@@ -213,7 +224,7 @@ namespace JSC {
             return *m_evalCodeBlock;
         }
 
-        static PassRefPtr<EvalExecutable> create(ExecState* exec, const SourceCode& source, bool isInStrictContext) { return adoptRef(new EvalExecutable(exec, source, isInStrictContext)); }
+        static EvalExecutable* create(ExecState* exec, const SourceCode& source, bool isInStrictContext) { return new (exec) EvalExecutable(exec, source, isInStrictContext); }
 
 #if ENABLE(JIT)
         JITCode& generatedJITCode()
@@ -221,26 +232,31 @@ namespace JSC {
             return generatedJITCodeForCall();
         }
 #endif
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
 
     private:
+        static const unsigned StructureFlags = OverridesMarkChildren | ScriptExecutable::StructureFlags;
+        static const ClassInfo s_info;
         EvalExecutable(ExecState*, const SourceCode&, bool);
 
         JSObject* compileInternal(ExecState*, ScopeChainNode*);
+        virtual void markChildren(MarkStack&);
 
         OwnPtr<EvalCodeBlock> m_evalCodeBlock;
     };
 
     class ProgramExecutable : public ScriptExecutable {
     public:
-        static PassRefPtr<ProgramExecutable> create(ExecState* exec, const SourceCode& source)
+        static ProgramExecutable* create(ExecState* exec, const SourceCode& source)
         {
-            return adoptRef(new ProgramExecutable(exec, source));
+            return new (exec) ProgramExecutable(exec, source);
         }
 
         ~ProgramExecutable();
 
         JSObject* compile(ExecState* exec, ScopeChainNode* scopeChainNode)
         {
+            ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_programCodeBlock)
                 error = compileInternal(exec, scopeChainNode);
@@ -262,11 +278,16 @@ namespace JSC {
             return generatedJITCodeForCall();
         }
 #endif
+        
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
 
     private:
+        static const unsigned StructureFlags = OverridesMarkChildren | ScriptExecutable::StructureFlags;
+        static const ClassInfo s_info;
         ProgramExecutable(ExecState*, const SourceCode&);
 
         JSObject* compileInternal(ExecState*, ScopeChainNode*);
+        virtual void markChildren(MarkStack&);
 
         OwnPtr<ProgramCodeBlock> m_programCodeBlock;
     };
@@ -274,18 +295,16 @@ namespace JSC {
     class FunctionExecutable : public ScriptExecutable {
         friend class JIT;
     public:
-        static PassRefPtr<FunctionExecutable> create(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool isInStrictContext, int firstLine, int lastLine)
+        static FunctionExecutable* create(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool isInStrictContext, int firstLine, int lastLine)
         {
-            return adoptRef(new FunctionExecutable(exec, name, source, forceUsesArguments, parameters, isInStrictContext, firstLine, lastLine));
+            return new (exec) FunctionExecutable(exec, name, source, forceUsesArguments, parameters, isInStrictContext, firstLine, lastLine);
         }
 
-        static PassRefPtr<FunctionExecutable> create(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool isInStrictContext, int firstLine, int lastLine)
+        static FunctionExecutable* create(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool isInStrictContext, int firstLine, int lastLine)
         {
-            return adoptRef(new FunctionExecutable(globalData, name, source, forceUsesArguments, parameters, isInStrictContext, firstLine, lastLine));
+            return new (globalData) FunctionExecutable(globalData, name, source, forceUsesArguments, parameters, isInStrictContext, firstLine, lastLine);
         }
 
-        ~FunctionExecutable();
-
         JSFunction* make(ExecState* exec, ScopeChainNode* scopeChain)
         {
             return new (exec) JSFunction(exec, this, scopeChain);
@@ -304,6 +323,7 @@ namespace JSC {
 
         JSObject* compileForCall(ExecState* exec, ScopeChainNode* scopeChainNode)
         {
+            ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_codeBlockForCall)
                 error = compileForCallInternal(exec, scopeChainNode);
@@ -324,6 +344,7 @@ namespace JSC {
 
         JSObject* compileForConstruct(ExecState* exec, ScopeChainNode* scopeChainNode)
         {
+            ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_codeBlockForConstruct)
                 error = compileForConstructInternal(exec, scopeChainNode);
@@ -349,8 +370,9 @@ namespace JSC {
         SharedSymbolTable* symbolTable() const { return m_symbolTable; }
 
         void discardCode();
-        void markAggregate(MarkStack&);
-        static PassRefPtr<FunctionExecutable> fromGlobalCode(const Identifier&, ExecState*, Debugger*, const SourceCode&, JSObject** exception);
+        void markChildren(MarkStack&);
+        static FunctionExecutable* fromGlobalCode(const Identifier&, ExecState*, Debugger*, const SourceCode&, JSObject** exception);
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, 0); }
 
     private:
         FunctionExecutable(JSGlobalData*, const Identifier& name, const SourceCode&, bool forceUsesArguments, FunctionParameters*, bool, int firstLine, int lastLine);
@@ -358,7 +380,9 @@ namespace JSC {
 
         JSObject* compileForCallInternal(ExecState*, ScopeChainNode*);
         JSObject* compileForConstructInternal(ExecState*, ScopeChainNode*);
-
+        
+        static const unsigned StructureFlags = OverridesMarkChildren | ScriptExecutable::StructureFlags;
+        static const ClassInfo s_info;
         unsigned m_numCapturedVariables : 31;
         bool m_forceUsesArguments : 1;
 
@@ -398,13 +422,11 @@ namespace JSC {
         return m_executable->isHostFunction();
     }
 
-#if ENABLE(JIT)
     inline NativeFunction JSFunction::nativeFunction()
     {
         ASSERT(isHostFunction());
         return static_cast<NativeExecutable*>(m_executable.get())->function();
     }
-#endif
 }
 
 #endif
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
index 933b11f..9e7d8d5 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -37,7 +37,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(FunctionConstructor);
 
-FunctionConstructor::FunctionConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, FunctionPrototype* functionPrototype)
+FunctionConstructor::FunctionConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, FunctionPrototype* functionPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, functionPrototype->classInfo()->className))
 {
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, functionPrototype, DontEnum | DontDelete | ReadOnly);
@@ -49,7 +49,7 @@ FunctionConstructor::FunctionConstructor(ExecState* exec, JSGlobalObject* global
 static EncodedJSValue JSC_HOST_CALL constructWithFunctionConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructFunction(exec, args));
+    return JSValue::encode(constructFunction(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 ConstructType FunctionConstructor::getConstructData(ConstructData& constructData)
@@ -61,7 +61,7 @@ ConstructType FunctionConstructor::getConstructData(ConstructData& constructData
 static EncodedJSValue JSC_HOST_CALL callFunctionConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructFunction(exec, args));
+    return JSValue::encode(constructFunction(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 // ECMA 15.3.1 The Function Constructor Called as a Function
@@ -72,7 +72,7 @@ CallType FunctionConstructor::getCallData(CallData& callData)
 }
 
 // ECMA 15.3.2 The Function Constructor
-JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifier& functionName, const UString& sourceURL, int lineNumber)
+JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args, const Identifier& functionName, const UString& sourceURL, int lineNumber)
 {
     // Functions need to have a space following the opening { due to for web compatibility
     // see https://bugs.webkit.org/show_bug.cgi?id=24350
@@ -96,24 +96,23 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
         program = builder.toUString();
     }
 
-    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
     JSGlobalData& globalData = globalObject->globalData();
     SourceCode source = makeSource(program, sourceURL, lineNumber);
     JSObject* exception = 0;
-    RefPtr<FunctionExecutable> function = FunctionExecutable::fromGlobalCode(functionName, exec, exec->dynamicGlobalObject()->debugger(), source, &exception);
+    FunctionExecutable* function = FunctionExecutable::fromGlobalCode(functionName, exec, exec->dynamicGlobalObject()->debugger(), source, &exception);
     if (!function) {
         ASSERT(exception);
         return throwError(exec, exception);
     }
 
-    ScopeChain scopeChain(globalObject, &globalData, globalObject, exec->globalThisValue());
-    return new (exec) JSFunction(exec, function, scopeChain.node());
+    ScopeChainNode* scopeChain = new (exec) ScopeChainNode(0, globalObject, &globalData, globalObject, exec->globalThisValue());
+    return new (exec) JSFunction(exec, function, scopeChain);
 }
 
 // ECMA 15.3.2 The Function Constructor
-JSObject* constructFunction(ExecState* exec, const ArgList& args)
+JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args)
 {
-    return constructFunction(exec, args, Identifier(exec, "anonymous"), UString(), 1);
+    return constructFunction(exec, globalObject, args, Identifier(exec, "anonymous"), UString(), 1);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.h b/Source/JavaScriptCore/runtime/FunctionConstructor.h
index 6af4861..31a04c9 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.h
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.h
@@ -29,15 +29,15 @@ namespace JSC {
 
     class FunctionConstructor : public InternalFunction {
     public:
-        FunctionConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, FunctionPrototype*);
+        FunctionConstructor(ExecState*, JSGlobalObject*, Structure*, FunctionPrototype*);
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
     };
 
-    JSObject* constructFunction(ExecState*, const ArgList&, const Identifier& functionName, const UString& sourceURL, int lineNumber);
-    JSObject* constructFunction(ExecState*, const ArgList&);
+    JSObject* constructFunction(ExecState*, JSGlobalObject*, const ArgList&, const Identifier& functionName, const UString& sourceURL, int lineNumber);
+    JSObject* constructFunction(ExecState*, JSGlobalObject*, const ArgList&);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/FunctionPrototype.cpp b/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
index e651538..e2a4941 100644
--- a/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -28,7 +28,6 @@
 #include "JSStringBuilder.h"
 #include "Interpreter.h"
 #include "Lexer.h"
-#include "PrototypeFunction.h"
 
 namespace JSC {
 
@@ -38,18 +37,18 @@ static EncodedJSValue JSC_HOST_CALL functionProtoFuncToString(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionProtoFuncApply(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionProtoFuncCall(ExecState*);
 
-FunctionPrototype::FunctionPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
+FunctionPrototype::FunctionPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure)
     : InternalFunction(&exec->globalData(), globalObject, structure, exec->propertyNames().nullIdentifier)
 {
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
 }
 
-void FunctionPrototype::addFunctionProperties(ExecState* exec, JSGlobalObject* globalObject, Structure* prototypeFunctionStructure, NativeFunctionWrapper** callFunction, NativeFunctionWrapper** applyFunction)
+void FunctionPrototype::addFunctionProperties(ExecState* exec, JSGlobalObject* globalObject, Structure* functionStructure, JSFunction** callFunction, JSFunction** applyFunction)
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().toString, functionProtoFuncToString), DontEnum);
-    *applyFunction = new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 2, exec->propertyNames().apply, functionProtoFuncApply);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().toString, functionProtoFuncToString), DontEnum);
+    *applyFunction = new (exec) JSFunction(exec, globalObject, functionStructure, 2, exec->propertyNames().apply, functionProtoFuncApply);
     putDirectFunctionWithoutTransition(exec, *applyFunction, DontEnum);
-    *callFunction = new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().call, functionProtoFuncCall);
+    *callFunction = new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().call, functionProtoFuncCall);
     putDirectFunctionWithoutTransition(exec, *callFunction, DontEnum);
 }
 
@@ -86,7 +85,7 @@ static inline void insertSemicolonIfNeeded(UString& functionBody)
 EncodedJSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (thisValue.inherits(&JSFunction::info)) {
+    if (thisValue.inherits(&JSFunction::s_info)) {
         JSFunction* function = asFunction(thisValue);
         if (function->isHostFunction())
             return JSValue::encode(jsMakeNontrivialString(exec, "function ", function->name(exec), "() {\n    [native code]\n}"));
@@ -96,7 +95,7 @@ EncodedJSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec)
         return JSValue::encode(jsMakeNontrivialString(exec, "function ", function->name(exec), "(", executable->paramString(), ") ", sourceString));
     }
 
-    if (thisValue.inherits(&InternalFunction::info)) {
+    if (thisValue.inherits(&InternalFunction::s_info)) {
         InternalFunction* function = asInternalFunction(thisValue);
         return JSValue::encode(jsMakeNontrivialString(exec, "function ", function->name(exec), "() {\n    [native code]\n}"));
     }
@@ -118,11 +117,11 @@ EncodedJSValue JSC_HOST_CALL functionProtoFuncApply(ExecState* exec)
     if (!array.isUndefinedOrNull()) {
         if (!array.isObject())
             return throwVMTypeError(exec);
-        if (asObject(array)->classInfo() == &Arguments::info)
+        if (asObject(array)->classInfo() == &Arguments::s_info)
             asArguments(array)->fillArgList(exec, applyArgs);
         else if (isJSArray(&exec->globalData(), array))
             asArray(array)->fillArgList(exec, applyArgs);
-        else if (asObject(array)->inherits(&JSArray::info)) {
+        else if (asObject(array)->inherits(&JSArray::s_info)) {
             unsigned length = asArray(array)->get(exec, exec->propertyNames().length).toUInt32(exec);
             for (unsigned i = 0; i < length; ++i)
                 applyArgs.append(asArray(array)->get(exec, i));
diff --git a/Source/JavaScriptCore/runtime/FunctionPrototype.h b/Source/JavaScriptCore/runtime/FunctionPrototype.h
index 5661194..ab708dd 100644
--- a/Source/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/Source/JavaScriptCore/runtime/FunctionPrototype.h
@@ -25,16 +25,14 @@
 
 namespace JSC {
 
-    class PrototypeFunction;
-
     class FunctionPrototype : public InternalFunction {
     public:
-        FunctionPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>);
-        void addFunctionProperties(ExecState*, JSGlobalObject*, Structure* prototypeFunctionStructure, NativeFunctionWrapper** callFunction, NativeFunctionWrapper** applyFunction);
+        FunctionPrototype(ExecState*, JSGlobalObject*, Structure*);
+        void addFunctionProperties(ExecState*, JSGlobalObject*, Structure* functionStructure, JSFunction** callFunction, JSFunction** applyFunction);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto)
         {
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     private:
diff --git a/Source/JavaScriptCore/runtime/GCActivityCallback.cpp b/Source/JavaScriptCore/runtime/GCActivityCallback.cpp
index 161abfb..308d245 100644
--- a/Source/JavaScriptCore/runtime/GCActivityCallback.cpp
+++ b/Source/JavaScriptCore/runtime/GCActivityCallback.cpp
@@ -34,7 +34,7 @@ namespace JSC {
 struct DefaultGCActivityCallbackPlatformData {
 };
 
-DefaultGCActivityCallback::DefaultGCActivityCallback(Heap* heap)
+DefaultGCActivityCallback::DefaultGCActivityCallback(Heap*)
 {
 }
 
diff --git a/Source/JavaScriptCore/runtime/GCActivityCallback.h b/Source/JavaScriptCore/runtime/GCActivityCallback.h
index 9b6ef04..eabb4cc 100644
--- a/Source/JavaScriptCore/runtime/GCActivityCallback.h
+++ b/Source/JavaScriptCore/runtime/GCActivityCallback.h
@@ -32,7 +32,7 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
-#if PLATFORM(CF)
+#if USE(CF)
 #include <CoreFoundation/CoreFoundation.h>
 #endif
 
@@ -62,7 +62,7 @@ public:
     void operator()();
     void synchronize();
 
-#if PLATFORM(CF)
+#if USE(CF)
 protected:
     DefaultGCActivityCallback(Heap*, CFRunLoopRef);
     void commonConstructor(Heap*, CFRunLoopRef);
diff --git a/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp b/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp
index 211c423..2e878bf 100644
--- a/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp
+++ b/Source/JavaScriptCore/runtime/GCActivityCallbackCF.cpp
@@ -33,10 +33,12 @@
 #include "Heap.h"
 #include "JSGlobalData.h"
 #include "JSLock.h"
+#include "JSObject.h"
+#include "ScopeChain.h"
 #include <wtf/RetainPtr.h>
 #include <wtf/WTFThreadData.h>
 
-#if !PLATFORM(CF)
+#if !USE(CF)
 #error "This file should only be used on CF platforms."
 #endif
 
diff --git a/Source/JavaScriptCore/runtime/GCHandle.cpp b/Source/JavaScriptCore/runtime/GCHandle.cpp
deleted file mode 100644
index 297de38..0000000
--- a/Source/JavaScriptCore/runtime/GCHandle.cpp
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "GCHandle.h"
-
-namespace JSC {
-
-WeakGCHandlePool* WeakGCHandle::pool()
-{
-    uintptr_t pool = (reinterpret_cast<uintptr_t>(this) & WeakGCHandlePool::poolMask);
-    return reinterpret_cast<WeakGCHandlePool*>(pool);
-}
-
-WeakGCHandlePool::WeakGCHandlePool()
-{
-    ASSERT(sizeof(WeakGCHandlePool) <= WeakGCHandlePool::poolSize);
-    m_entriesSize = 0;
-    m_initialAlloc = 1;
-    m_entries[0].setNextInFreeList(0);
-}
-
-WeakGCHandle* WeakGCHandlePool::allocate(JSCell* cell)
-{
-    ASSERT(cell);
-    ASSERT(m_entries[0].isNext());
-    unsigned freeList = m_entries[0].getNextInFreeList();
-    ASSERT(freeList < WeakGCHandlePool::numPoolEntries);
-    ASSERT(m_entriesSize < WeakGCHandlePool::numPoolEntries);
-
-    if (m_entriesSize == WeakGCHandlePool::numPoolEntries - 1)
-        return 0;
-
-    if (freeList) {
-        unsigned i = freeList;
-        freeList = m_entries[i].getNextInFreeList();
-        m_entries[i].set(cell);
-        m_entries[0].setNextInFreeList(freeList);
-        ++m_entriesSize;
-        return &m_entries[i];
-    }
-
-    ASSERT(m_initialAlloc < WeakGCHandlePool::numPoolEntries);
-
-    unsigned i = m_initialAlloc;
-    ++m_initialAlloc;
-    m_entries[i].set(cell);
-    ++m_entriesSize;
-    return &m_entries[i];
-
-}
-
-void WeakGCHandlePool::free(WeakGCHandle* handle)
-{
-    ASSERT(handle->pool() == this);
-    ASSERT(m_entries[0].isNext());
-    unsigned freeList = m_entries[0].getNextInFreeList();
-    ASSERT(freeList < WeakGCHandlePool::numPoolEntries);
-    handle->setNextInFreeList(freeList);
-    m_entries[0].setNextInFreeList(handle - m_entries);
-    --m_entriesSize;
-}
-
-}
diff --git a/Source/JavaScriptCore/runtime/GCHandle.h b/Source/JavaScriptCore/runtime/GCHandle.h
deleted file mode 100644
index 8818f79..0000000
--- a/Source/JavaScriptCore/runtime/GCHandle.h
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef GCHandle_h
-#define GCHandle_h
-
-#include <wtf/Assertions.h>
-
-namespace JSC {
-
-class Heap;
-class JSCell;
-class WeakGCHandle;
-class WeakGCHandlePool;
-
-class WeakGCHandle {
-    friend class WeakGCHandlePool;
-
-public:
-    // Because JSCell objects are aligned, we can use the lower two bits as
-    // status flags. The least significant bit is set when the handle is not a
-    // pointer, i.e. when it's used as a offset for the free list in
-    // WeakGCHandlePool. The second least significant bit is set when the object
-    // the pointer corresponds to has been deleted by a garbage collection
-
-    bool isValidPtr() { return !(m_ptr & 3); }
-    bool isPtr() { return !(m_ptr & 1); }
-    bool isNext() { return (m_ptr & 3) == 1; }
-
-    void invalidate()
-    {
-        ASSERT(isValidPtr());
-        m_ptr |= 2;
-    }
-
-    JSCell* get()
-    {
-        ASSERT(isPtr());
-        return reinterpret_cast<JSCell*>(m_ptr & ~3);
-    }
-
-    void set(JSCell* p)
-    {
-        m_ptr = reinterpret_cast<uintptr_t>(p);
-        ASSERT(isPtr());
-    }
-
-    WeakGCHandlePool* pool();
-
-private:
-    uintptr_t getNextInFreeList()
-    {
-        ASSERT(isNext());
-        return m_ptr >> 2;
-    }
-
-    void setNextInFreeList(uintptr_t n)
-    {
-        m_ptr = (n << 2) | 1;
-        ASSERT(isNext());
-    }
-
-    uintptr_t m_ptr;
-};
-
-class WeakGCHandlePool {
-public:
-    static const size_t poolSize = 32 * 1024; // 32k
-    static const size_t poolMask = ~(poolSize - 1);
-    static const size_t numPoolEntries = (poolSize - sizeof(Heap*) - 3 * sizeof(unsigned)) / sizeof(WeakGCHandle);
-
-    WeakGCHandlePool();
-
-    WeakGCHandle* allocate(JSCell* cell);
-    void free(WeakGCHandle*);
-
-    bool isFull()
-    {
-        ASSERT(m_entriesSize < WeakGCHandlePool::numPoolEntries);
-        return m_entriesSize == WeakGCHandlePool::numPoolEntries - 1;
-    }
-
-    void update();
-
-private:
-    Heap* m_heap;
-    unsigned m_entriesSize;
-    unsigned m_initialAlloc;
-
-    WeakGCHandle m_entries[WeakGCHandlePool::numPoolEntries];
-};
-
-}
-#endif
diff --git a/Source/JavaScriptCore/runtime/GetterSetter.h b/Source/JavaScriptCore/runtime/GetterSetter.h
index ffab94d..a222c7a 100644
--- a/Source/JavaScriptCore/runtime/GetterSetter.h
+++ b/Source/JavaScriptCore/runtime/GetterSetter.h
@@ -26,6 +26,7 @@
 #include "JSCell.h"
 
 #include "CallFrame.h"
+#include "Structure.h"
 
 namespace JSC {
 
@@ -37,7 +38,7 @@ namespace JSC {
         friend class JIT;
     public:
         GetterSetter(ExecState* exec)
-            : JSCell(exec->globalData().getterSetterStructure.get())
+            : JSCell(exec->globalData(), exec->globalData().getterSetterStructure.get())
         {
         }
 
@@ -47,9 +48,9 @@ namespace JSC {
         void setGetter(JSGlobalData& globalData, JSObject* getter) { m_getter.set(globalData, this, getter); }
         JSObject* setter() const { return m_setter.get(); }
         void setSetter(JSGlobalData& globalData, JSObject* setter) { m_setter.set(globalData, this, setter); }
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(GetterSetterType, OverridesMarkChildren), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(GetterSetterType, OverridesMarkChildren), AnonymousSlotCount, 0);
         }
     private:
         virtual bool isGetterSetter() const;
diff --git a/Source/JavaScriptCore/runtime/GlobalEvalFunction.cpp b/Source/JavaScriptCore/runtime/GlobalEvalFunction.cpp
deleted file mode 100644
index 27207e2..0000000
--- a/Source/JavaScriptCore/runtime/GlobalEvalFunction.cpp
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
- *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
- *  Copyright (C) 2007 Maks Orlovich
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "GlobalEvalFunction.h"
-
-#include "JSGlobalObject.h"
-#include <wtf/Assertions.h>
-
-namespace JSC {
-
-ASSERT_CLASS_FITS_IN_CELL(GlobalEvalFunction);
-
-GlobalEvalFunction::GlobalEvalFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, int len, const Identifier& name, NativeFunction function, JSGlobalObject* cachedGlobalObject)
-    : PrototypeFunction(exec, globalObject, structure, len, name, function)
-    , m_cachedGlobalObject(exec->globalData(), this, cachedGlobalObject)
-{
-    ASSERT_ARG(cachedGlobalObject, cachedGlobalObject);
-}
-
-void GlobalEvalFunction::markChildren(MarkStack& markStack)
-{
-    PrototypeFunction::markChildren(markStack);
-    markStack.append(&m_cachedGlobalObject);
-}
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/GlobalEvalFunction.h b/Source/JavaScriptCore/runtime/GlobalEvalFunction.h
deleted file mode 100644
index 13f0946..0000000
--- a/Source/JavaScriptCore/runtime/GlobalEvalFunction.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
- *  Copyright (C) 2007 Maks Orlovich
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef GlobalEvalFunction_h
-#define GlobalEvalFunction_h
-
-#include "PrototypeFunction.h"
-
-namespace JSC {
-
-    class JSGlobalObject;
-
-    class GlobalEvalFunction : public PrototypeFunction {
-    public:
-        GlobalEvalFunction(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, int len, const Identifier&, NativeFunction, JSGlobalObject* expectedThisObject);
-        JSGlobalObject* cachedGlobalObject() const { return m_cachedGlobalObject.get(); }
-
-        static PassRefPtr<Structure> createStructure(JSValue prototype) 
-        { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
-        }
-
-    protected:
-        static const unsigned StructureFlags = ImplementsHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | PrototypeFunction::StructureFlags;
-
-    private:
-        virtual void markChildren(MarkStack&);
-
-        WriteBarrier<JSGlobalObject> m_cachedGlobalObject;
-    };
-
-} // namespace JSC
-
-#endif // GlobalEvalFunction_h
diff --git a/Source/JavaScriptCore/runtime/Identifier.cpp b/Source/JavaScriptCore/runtime/Identifier.cpp
index 28cfd0a..4a99b19 100644
--- a/Source/JavaScriptCore/runtime/Identifier.cpp
+++ b/Source/JavaScriptCore/runtime/Identifier.cpp
@@ -22,7 +22,9 @@
 #include "Identifier.h"
 
 #include "CallFrame.h"
+#include "JSObject.h"
 #include "NumericStrings.h"
+#include "ScopeChain.h"
 #include <new> // for placement new
 #include <string.h> // for strlen
 #include <wtf/Assertions.h>
@@ -89,7 +91,7 @@ bool Identifier::equal(const StringImpl* r, const UChar* s, unsigned length)
 struct IdentifierCStringTranslator {
     static unsigned hash(const char* c)
     {
-        return WTF::StringHasher::createHash<char>(c);
+        return StringHasher::computeHash<char>(c);
     }
 
     static bool equal(StringImpl* r, const char* s)
@@ -149,7 +151,7 @@ struct UCharBuffer {
 struct IdentifierUCharBufferTranslator {
     static unsigned hash(const UCharBuffer& buf)
     {
-        return WTF::StringHasher::createHash<UChar>(buf.s, buf.length);
+        return StringHasher::computeHash<UChar>(buf.s, buf.length);
     }
 
     static bool equal(StringImpl* str, const UCharBuffer& buf)
@@ -215,7 +217,7 @@ PassRefPtr<StringImpl> Identifier::add(JSGlobalData* globalData, const UChar* s,
 {
     if (length == 1) {
         UChar c = s[0];
-        if (c <= 0xFF)
+        if (c <= maxSingleCharacterString)
             return add(globalData, globalData->smallStrings.singleCharacterStringRep(c));
     }
     if (!length)
@@ -242,7 +244,7 @@ PassRefPtr<StringImpl> Identifier::addSlowCase(JSGlobalData* globalData, StringI
 
     if (r->length() == 1) {
         UChar c = r->characters()[0];
-        if (c <= 0xFF)
+        if (c <= maxSingleCharacterString)
             r = globalData->smallStrings.singleCharacterStringRep(c);
             if (r->isIdentifier())
                 return r;
diff --git a/Source/JavaScriptCore/runtime/InternalFunction.cpp b/Source/JavaScriptCore/runtime/InternalFunction.cpp
index f19ae0d..c3b07f8 100644
--- a/Source/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/Source/JavaScriptCore/runtime/InternalFunction.cpp
@@ -29,34 +29,33 @@
 
 namespace JSC {
 
-ASSERT_CLASS_FITS_IN_CELL(InternalFunction);
+// Ensure the compiler generates a vtable for InternalFunction!
+void InternalFunction::vtableAnchor() {}
 
-const ClassInfo InternalFunction::info = { "Function", 0, 0, 0 };
+ASSERT_CLASS_FITS_IN_CELL(InternalFunction);
 
-const ClassInfo* InternalFunction::classInfo() const
-{
-    return &info;
-}
+const ClassInfo InternalFunction::s_info = { "Function", &JSObjectWithGlobalObject::s_info, 0, 0 };
 
-InternalFunction::InternalFunction(NonNullPassRefPtr<Structure> structure)
-    : JSObjectWithGlobalObject(structure)
+InternalFunction::InternalFunction(VPtrStealingHackType)
+    : JSObjectWithGlobalObject(VPtrStealingHack)
 {
 }
 
-InternalFunction::InternalFunction(JSGlobalData* globalData, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const Identifier& name)
+InternalFunction::InternalFunction(JSGlobalData* globalData, JSGlobalObject* globalObject, Structure* structure, const Identifier& name)
     : JSObjectWithGlobalObject(globalObject, structure)
 {
+    ASSERT(inherits(&s_info));
     putDirect(*globalData, globalData->propertyNames->name, jsString(globalData, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
 }
 
 const UString& InternalFunction::name(ExecState* exec)
 {
-    return asString(getDirect(exec->globalData().propertyNames->name))->tryGetValue();
+    return asString(getDirect(exec->globalData(), exec->globalData().propertyNames->name))->tryGetValue();
 }
 
 const UString InternalFunction::displayName(ExecState* exec)
 {
-    JSValue displayName = getDirect(exec->globalData().propertyNames->displayName);
+    JSValue displayName = getDirect(exec->globalData(), exec->globalData().propertyNames->displayName);
     
     if (displayName && isJSString(&exec->globalData(), displayName))
         return asString(displayName)->tryGetValue();
diff --git a/Source/JavaScriptCore/runtime/InternalFunction.h b/Source/JavaScriptCore/runtime/InternalFunction.h
index 401f17b..28e260e 100644
--- a/Source/JavaScriptCore/runtime/InternalFunction.h
+++ b/Source/JavaScriptCore/runtime/InternalFunction.h
@@ -33,35 +33,36 @@ namespace JSC {
 
     class InternalFunction : public JSObjectWithGlobalObject {
     public:
-        virtual const ClassInfo* classInfo() const; 
-        static JS_EXPORTDATA const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo s_info;
 
         const UString& name(ExecState*);
         const UString displayName(ExecState*);
         const UString calculatedDisplayName(ExecState*);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+            return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
     protected:
         static const unsigned StructureFlags = ImplementsHasInstance | JSObject::StructureFlags;
 
         // Only used to allow us to determine the JSFunction vptr
-        InternalFunction(NonNullPassRefPtr<Structure> structure);
+        InternalFunction(VPtrStealingHackType);
 
-        InternalFunction(JSGlobalData*, JSGlobalObject*, NonNullPassRefPtr<Structure>, const Identifier&);
+        InternalFunction(JSGlobalData*, JSGlobalObject*, Structure*, const Identifier&);
 
     private:
         virtual CallType getCallData(CallData&) = 0;
+
+        virtual void vtableAnchor();
     };
 
     InternalFunction* asInternalFunction(JSValue);
 
     inline InternalFunction* asInternalFunction(JSValue value)
     {
-        ASSERT(asObject(value)->inherits(&InternalFunction::info));
+        ASSERT(asObject(value)->inherits(&InternalFunction::s_info));
         return static_cast<InternalFunction*>(asObject(value));
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h b/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
index a113e91..0165488 100644
--- a/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
+++ b/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
@@ -25,6 +25,7 @@
 
 #include "JSCell.h"
 #include "CallFrame.h"
+#include "Structure.h"
 
 namespace JSC {
 
@@ -35,15 +36,15 @@ namespace JSC {
 
         virtual bool isAPIValueWrapper() const { return true; }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames), AnonymousSlotCount, 0);
         }
 
         
     private:
         JSAPIValueWrapper(ExecState* exec, JSValue value)
-            : JSCell(exec->globalData().apiWrapperStructure.get())
+            : JSCell(exec->globalData(), exec->globalData().apiWrapperStructure.get())
         {
             m_value.set(exec->globalData(), this, value);
             ASSERT(!value.isCell());
diff --git a/Source/JavaScriptCore/runtime/JSActivation.cpp b/Source/JavaScriptCore/runtime/JSActivation.cpp
index 6fb5ced..4e36641 100644
--- a/Source/JavaScriptCore/runtime/JSActivation.cpp
+++ b/Source/JavaScriptCore/runtime/JSActivation.cpp
@@ -37,16 +37,25 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSActivation);
 
-const ClassInfo JSActivation::info = { "JSActivation", 0, 0, 0 };
+const ClassInfo JSActivation::s_info = { "JSActivation", &Base::s_info, 0, 0 };
 
-JSActivation::JSActivation(CallFrame* callFrame, NonNullPassRefPtr<FunctionExecutable> functionExecutable)
-    : Base(callFrame->globalData().activationStructure, new JSActivationData(functionExecutable, callFrame->registers()))
+JSActivation::JSActivation(CallFrame* callFrame, FunctionExecutable* functionExecutable)
+    : Base(callFrame->globalData(), callFrame->globalData().activationStructure.get(), functionExecutable->symbolTable(), callFrame->registers())
+    , m_numParametersMinusThis(static_cast<int>(functionExecutable->parameterCount()))
+    , m_numCapturedVars(functionExecutable->capturedVariableCount())
+    , m_requiresDynamicChecks(functionExecutable->usesEval())
+    , m_argumentsRegister(functionExecutable->generatedBytecode().argumentsRegister())
 {
+    ASSERT(inherits(&s_info));
+
+    // We have to manually ref and deref the symbol table as JSVariableObject
+    // doesn't know about SharedSymbolTable
+    static_cast<SharedSymbolTable*>(m_symbolTable)->ref();
 }
 
 JSActivation::~JSActivation()
 {
-    delete d();
+    static_cast<SharedSymbolTable*>(m_symbolTable)->deref();
 }
 
 void JSActivation::markChildren(MarkStack& markStack)
@@ -54,33 +63,29 @@ void JSActivation::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     // No need to mark our registers if they're still in the RegisterFile.
-    Register* registerArray = d()->registerArray.get();
+    WriteBarrier<Unknown>* registerArray = m_registerArray.get();
     if (!registerArray)
         return;
 
-    size_t numParametersMinusThis = d()->functionExecutable->parameterCount();
-
-    size_t count = numParametersMinusThis;
-    markStack.deprecatedAppendValues(registerArray, count);
-
-    size_t numVars = d()->functionExecutable->capturedVariableCount();
+    markStack.appendValues(registerArray, m_numParametersMinusThis);
 
     // Skip the call frame, which sits between the parameters and vars.
-    markStack.deprecatedAppendValues(registerArray + count + RegisterFile::CallFrameHeaderSize, numVars, MayContainNullValues);
+    markStack.appendValues(registerArray + m_numParametersMinusThis + RegisterFile::CallFrameHeaderSize, m_numCapturedVars, MayContainNullValues);
 }
 
 inline bool JSActivation::symbolTableGet(const Identifier& propertyName, PropertySlot& slot)
 {
     SymbolTableEntry entry = symbolTable().inlineGet(propertyName.impl());
-    if (!entry.isNull()) {
-        ASSERT(entry.getIndex() < static_cast<int>(d()->functionExecutable->capturedVariableCount()));
-        slot.setRegisterSlot(&registerAt(entry.getIndex()));
-        return true;
-    }
-    return false;
+    if (entry.isNull())
+        return false;
+    if (entry.getIndex() >= m_numCapturedVars)
+        return false;
+
+    slot.setValue(registerAt(entry.getIndex()).get());
+    return true;
 }
 
-inline bool JSActivation::symbolTablePut(const Identifier& propertyName, JSValue value)
+inline bool JSActivation::symbolTablePut(JSGlobalData& globalData, const Identifier& propertyName, JSValue value)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
     
@@ -89,8 +94,10 @@ inline bool JSActivation::symbolTablePut(const Identifier& propertyName, JSValue
         return false;
     if (entry.isReadOnly())
         return true;
-    ASSERT(entry.getIndex() < static_cast<int>(d()->functionExecutable->capturedVariableCount()));
-    registerAt(entry.getIndex()) = value;
+    if (entry.getIndex() >= m_numCapturedVars)
+        return false;
+
+    registerAt(entry.getIndex()).set(globalData, this, value);
     return true;
 }
 
@@ -98,15 +105,17 @@ void JSActivation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& prope
 {
     SymbolTable::const_iterator end = symbolTable().end();
     for (SymbolTable::const_iterator it = symbolTable().begin(); it != end; ++it) {
-        ASSERT(it->second.getIndex() < static_cast<int>(d()->functionExecutable->capturedVariableCount()));
-        if (!(it->second.getAttributes() & DontEnum) || (mode == IncludeDontEnumProperties))
-            propertyNames.add(Identifier(exec, it->first.get()));
+        if (it->second.getAttributes() & DontEnum && mode != IncludeDontEnumProperties)
+            continue;
+        if (it->second.getIndex() >= m_numCapturedVars)
+            continue;
+        propertyNames.add(Identifier(exec, it->first.get()));
     }
     // Skip the JSVariableObject implementation of getOwnPropertyNames
     JSObject::getOwnPropertyNames(exec, propertyNames, mode);
 }
 
-inline bool JSActivation::symbolTablePutWithAttributes(const Identifier& propertyName, JSValue value, unsigned attributes)
+inline bool JSActivation::symbolTablePutWithAttributes(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
     
@@ -115,10 +124,11 @@ inline bool JSActivation::symbolTablePutWithAttributes(const Identifier& propert
         return false;
     SymbolTableEntry& entry = iter->second;
     ASSERT(!entry.isNull());
-    if (entry.getIndex() >= static_cast<int>(d()->functionExecutable->capturedVariableCount()))
+    if (entry.getIndex() >= m_numCapturedVars)
         return false;
+
     entry.setAttributes(attributes);
-    registerAt(entry.getIndex()) = value;
+    registerAt(entry.getIndex()).set(globalData, this, value);
     return true;
 }
 
@@ -132,7 +142,7 @@ bool JSActivation::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     if (symbolTableGet(propertyName, slot))
         return true;
 
-    if (WriteBarrierBase<Unknown>* location = getDirectLocation(propertyName)) {
+    if (WriteBarrierBase<Unknown>* location = getDirectLocation(exec->globalData(), propertyName)) {
         slot.setValue(location->get());
         return true;
     }
@@ -148,7 +158,7 @@ void JSActivation::put(ExecState* exec, const Identifier& propertyName, JSValue
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
-    if (symbolTablePut(propertyName, value))
+    if (symbolTablePut(exec->globalData(), propertyName, value))
         return;
 
     // We don't call through to JSObject because __proto__ and getter/setter 
@@ -163,7 +173,7 @@ void JSActivation::putWithAttributes(ExecState* exec, const Identifier& property
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
-    if (symbolTablePutWithAttributes(propertyName, value, attributes))
+    if (symbolTablePutWithAttributes(exec->globalData(), propertyName, value, attributes))
         return;
 
     // We don't call through to JSObject because __proto__ and getter/setter 
@@ -194,15 +204,15 @@ JSValue JSActivation::toStrictThisObject(ExecState*) const
     
 bool JSActivation::isDynamicScope(bool& requiresDynamicChecks) const
 {
-    requiresDynamicChecks = d()->functionExecutable->usesEval();
+    requiresDynamicChecks = m_requiresDynamicChecks;
     return false;
 }
 
 JSValue JSActivation::argumentsGetter(ExecState*, JSValue slotBase, const Identifier&)
 {
     JSActivation* activation = asActivation(slotBase);
-    CallFrame* callFrame = CallFrame::create(activation->d()->registers);
-    int argumentsRegister = activation->d()->functionExecutable->generatedBytecode().argumentsRegister();
+    CallFrame* callFrame = CallFrame::create(reinterpret_cast<Register*>(activation->m_registers));
+    int argumentsRegister = activation->m_argumentsRegister;
     if (JSValue arguments = callFrame->uncheckedR(argumentsRegister).jsValue())
         return arguments;
     int realArgumentsRegister = unmodifiedArgumentsRegister(argumentsRegister);
@@ -211,7 +221,7 @@ JSValue JSActivation::argumentsGetter(ExecState*, JSValue slotBase, const Identi
     callFrame->uncheckedR(argumentsRegister) = arguments;
     callFrame->uncheckedR(realArgumentsRegister) = arguments;
     
-    ASSERT(callFrame->uncheckedR(realArgumentsRegister).jsValue().inherits(&Arguments::info));
+    ASSERT(callFrame->uncheckedR(realArgumentsRegister).jsValue().inherits(&Arguments::s_info));
     return callFrame->uncheckedR(realArgumentsRegister).jsValue();
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSActivation.h b/Source/JavaScriptCore/runtime/JSActivation.h
index 6dd6d70..65642f1 100644
--- a/Source/JavaScriptCore/runtime/JSActivation.h
+++ b/Source/JavaScriptCore/runtime/JSActivation.h
@@ -42,7 +42,7 @@ namespace JSC {
     class JSActivation : public JSVariableObject {
         typedef JSVariableObject Base;
     public:
-        JSActivation(CallFrame*, NonNullPassRefPtr<FunctionExecutable>);
+        JSActivation(CallFrame*, FunctionExecutable*);
         virtual ~JSActivation();
 
         virtual void markChildren(MarkStack&);
@@ -62,53 +62,43 @@ namespace JSC {
         virtual JSObject* toThisObject(ExecState*) const;
         virtual JSValue toStrictThisObject(ExecState*) const;
 
-        void copyRegisters();
+        void copyRegisters(JSGlobalData&);
         
-        virtual const ClassInfo* classInfo() const { return &info; }
-        static const ClassInfo info;
+        static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); }
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
 
     private:
-        struct JSActivationData : public JSVariableObjectData {
-            JSActivationData(NonNullPassRefPtr<FunctionExecutable> _functionExecutable, Register* registers)
-                : JSVariableObjectData(_functionExecutable->symbolTable(), registers)
-                , functionExecutable(_functionExecutable)
-            {
-                // We have to manually ref and deref the symbol table as JSVariableObjectData
-                // doesn't know about SharedSymbolTable
-                functionExecutable->symbolTable()->ref();
-            }
-            ~JSActivationData()
-            {
-                static_cast<SharedSymbolTable*>(symbolTable)->deref();
-            }
-
-            RefPtr<FunctionExecutable> functionExecutable;
-        };
-
         bool symbolTableGet(const Identifier&, PropertySlot&);
         bool symbolTableGet(const Identifier&, PropertyDescriptor&);
         bool symbolTableGet(const Identifier&, PropertySlot&, bool& slotIsWriteable);
-        bool symbolTablePut(const Identifier&, JSValue);
-        bool symbolTablePutWithAttributes(const Identifier&, JSValue, unsigned attributes);
+        bool symbolTablePut(JSGlobalData&, const Identifier&, JSValue);
+        bool symbolTablePutWithAttributes(JSGlobalData&, const Identifier&, JSValue, unsigned attributes);
 
         static JSValue argumentsGetter(ExecState*, JSValue, const Identifier&);
         NEVER_INLINE PropertySlot::GetValueFunc getArgumentsGetter();
 
-        JSActivationData* d() const { return static_cast<JSActivationData*>(JSVariableObject::d); }
+        int m_numParametersMinusThis;
+        int m_numCapturedVars : 31;
+        bool m_requiresDynamicChecks : 1;
+        int m_argumentsRegister;
     };
 
     JSActivation* asActivation(JSValue);
 
     inline JSActivation* asActivation(JSValue value)
     {
-        ASSERT(asObject(value)->inherits(&JSActivation::info));
+        ASSERT(asObject(value)->inherits(&JSActivation::s_info));
         return static_cast<JSActivation*>(asObject(value));
     }
+    
+    ALWAYS_INLINE JSActivation* Register::activation() const
+    {
+        return asActivation(jsValue());
+    }
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index ded6d87..bf61097 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -92,7 +92,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSArray);
 // as long as it is 1/8 full. If more sparse than that, we use a map.
 static const unsigned minDensityMultiplier = 8;
 
-const ClassInfo JSArray::info = {"Array", 0, 0, 0};
+const ClassInfo JSArray::s_info = {"Array", &JSNonFinalObject::s_info, 0, 0};
 
 // We keep track of the size of the last array after it was grown.  We use this
 // as a simple heuristic for as the value to grow the next array from size 0.
@@ -127,25 +127,15 @@ inline void JSArray::checkConsistency(ConsistencyCheckType)
 #endif
 
 JSArray::JSArray(VPtrStealingHackType)
-    : JSObject(createStructure(jsNull()))
+    : JSNonFinalObject(VPtrStealingHack)
 {
-    unsigned initialCapacity = 0;
-
-    m_storage = static_cast<ArrayStorage*>(fastZeroedMalloc(storageSize(initialCapacity)));
-    m_storage->m_allocBase = m_storage;
-    m_indexBias = 0;
-    m_vectorLength = initialCapacity;
-
-    checkConsistency();
-    
-    // It's not safe to call Heap::heap(this) in order to report extra memory
-    // cost here, because the VPtrStealingHackType JSArray is not allocated on
-    // the heap. For the same reason, it's OK not to report extra cost.
 }
 
-JSArray::JSArray(NonNullPassRefPtr<Structure> structure)
-    : JSObject(structure)
+JSArray::JSArray(JSGlobalData& globalData, Structure* structure)
+    : JSNonFinalObject(globalData, structure)
 {
+    ASSERT(inherits(&s_info));
+
     unsigned initialCapacity = 0;
 
     m_storage = static_cast<ArrayStorage*>(fastZeroedMalloc(storageSize(initialCapacity)));
@@ -158,9 +148,11 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure)
     Heap::heap(this)->reportExtraMemoryCost(storageSize(0));
 }
 
-JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength, ArrayCreationMode creationMode)
-    : JSObject(structure)
+JSArray::JSArray(JSGlobalData& globalData, Structure* structure, unsigned initialLength, ArrayCreationMode creationMode)
+    : JSNonFinalObject(globalData, structure)
 {
+    ASSERT(inherits(&s_info));
+
     unsigned initialCapacity;
     if (creationMode == CreateCompact)
         initialCapacity = initialLength;
@@ -198,9 +190,11 @@ JSArray::JSArray(NonNullPassRefPtr<Structure> structure, unsigned initialLength,
     Heap::heap(this)->reportExtraMemoryCost(storageSize(initialCapacity));
 }
 
-JSArray::JSArray(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure, const ArgList& list)
-    : JSObject(structure)
+JSArray::JSArray(JSGlobalData& globalData, Structure* structure, const ArgList& list)
+    : JSNonFinalObject(globalData, structure)
 {
+    ASSERT(inherits(&s_info));
+
     unsigned initialCapacity = list.size();
     unsigned initialStorage;
     
diff --git a/Source/JavaScriptCore/runtime/JSArray.h b/Source/JavaScriptCore/runtime/JSArray.h
index b5caa47..8be8513 100644
--- a/Source/JavaScriptCore/runtime/JSArray.h
+++ b/Source/JavaScriptCore/runtime/JSArray.h
@@ -57,17 +57,15 @@ namespace JSC {
 
     enum ArrayCreationMode { CreateCompact, CreateInitialized };
 
-    class JSArray : public JSObject {
-        friend class JIT;
+    class JSArray : public JSNonFinalObject {
         friend class Walker;
 
     public:
-        enum VPtrStealingHackType { VPtrStealingHack };
         JSArray(VPtrStealingHackType);
 
-        explicit JSArray(NonNullPassRefPtr<Structure>);
-        JSArray(NonNullPassRefPtr<Structure>, unsigned initialLength, ArrayCreationMode);
-        JSArray(JSGlobalData&, NonNullPassRefPtr<Structure>, const ArgList& initialValues);
+        explicit JSArray(JSGlobalData&, Structure*);
+        JSArray(JSGlobalData&, Structure*, unsigned initialLength, ArrayCreationMode);
+        JSArray(JSGlobalData&, Structure*, const ArgList& initialValues);
         virtual ~JSArray();
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
@@ -75,7 +73,7 @@ namespace JSC {
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void put(ExecState*, unsigned propertyName, JSValue); // FIXME: Make protected and add setItem.
 
-        static JS_EXPORTDATA const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo s_info;
         
         unsigned length() const { return m_storage->m_length; }
         void setLength(unsigned); // OK to use on new arrays, but not if it might be a RegExpMatchArray.
@@ -125,13 +123,23 @@ namespace JSC {
         void fillArgList(ExecState*, MarkedArgumentBuffer&);
         void copyToRegisters(ExecState*, Register*, uint32_t);
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
         
         inline void markChildrenDirect(MarkStack& markStack);
 
+        static ptrdiff_t storageOffset()
+        {
+            return OBJECT_OFFSETOF(JSArray, m_storage);
+        }
+
+        static ptrdiff_t vectorLengthOffset()
+        {
+            return OBJECT_OFFSETOF(JSArray, m_vectorLength);
+        }
+
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
@@ -142,10 +150,8 @@ namespace JSC {
 
         void* subclassData() const;
         void setSubclassData(void*);
-        
-    private:
-        virtual const ClassInfo* classInfo() const { return &info; }
 
+    private:
         bool getOwnPropertySlotSlowCase(ExecState*, unsigned propertyName, PropertySlot&);
         void putSlowCase(ExecState*, unsigned propertyName, JSValue);
 
@@ -167,7 +173,7 @@ namespace JSC {
 
     inline JSArray* asArray(JSCell* cell)
     {
-        ASSERT(cell->inherits(&JSArray::info));
+        ASSERT(cell->inherits(&JSArray::s_info));
         return static_cast<JSArray*>(cell);
     }
 
@@ -176,11 +182,8 @@ namespace JSC {
         return asArray(value.asCell());
     }
 
-    inline bool isJSArray(JSGlobalData* globalData, JSValue v)
-    {
-        return v.isCell() && v.asCell()->vptr() == globalData->jsArrayVPtr;
-    }
     inline bool isJSArray(JSGlobalData* globalData, JSCell* cell) { return cell->vptr() == globalData->jsArrayVPtr; }
+    inline bool isJSArray(JSGlobalData* globalData, JSValue v) { return v.isCell() && isJSArray(globalData, v.asCell()); }
 
     inline void JSArray::markChildrenDirect(MarkStack& markStack)
     {
@@ -198,77 +201,6 @@ namespace JSC {
         }
     }
 
-    inline void MarkStack::markChildren(JSCell* cell)
-    {
-        ASSERT(Heap::isMarked(cell));
-        if (!cell->structure()->typeInfo().overridesMarkChildren()) {
-#ifdef NDEBUG
-            asObject(cell)->markChildrenDirect(*this);
-#else
-            ASSERT(!m_isCheckingForDefaultMarkViolation);
-            m_isCheckingForDefaultMarkViolation = true;
-            cell->markChildren(*this);
-            ASSERT(m_isCheckingForDefaultMarkViolation);
-            m_isCheckingForDefaultMarkViolation = false;
-#endif
-            return;
-        }
-        if (cell->vptr() == m_jsArrayVPtr) {
-            asArray(cell)->markChildrenDirect(*this);
-            return;
-        }
-        cell->markChildren(*this);
-    }
-
-    inline void MarkStack::drain()
-    {
-#if !ASSERT_DISABLED
-        ASSERT(!m_isDraining);
-        m_isDraining = true;
-#endif
-        while (!m_markSets.isEmpty() || !m_values.isEmpty()) {
-            while (!m_markSets.isEmpty() && m_values.size() < 50) {
-                ASSERT(!m_markSets.isEmpty());
-                MarkSet& current = m_markSets.last();
-                ASSERT(current.m_values);
-                JSValue* end = current.m_end;
-                ASSERT(current.m_values);
-                ASSERT(current.m_values != end);
-            findNextUnmarkedNullValue:
-                ASSERT(current.m_values != end);
-                JSValue value = *current.m_values;
-                current.m_values++;
-
-                JSCell* cell;
-                if (!value || !value.isCell() || Heap::testAndSetMarked(cell = value.asCell())) {
-                    if (current.m_values == end) {
-                        m_markSets.removeLast();
-                        continue;
-                    }
-                    goto findNextUnmarkedNullValue;
-                }
-
-                if (cell->structure()->typeInfo().type() < CompoundType) {
-                    if (current.m_values == end) {
-                        m_markSets.removeLast();
-                        continue;
-                    }
-                    goto findNextUnmarkedNullValue;
-                }
-
-                if (current.m_values == end)
-                    m_markSets.removeLast();
-
-                markChildren(cell);
-            }
-            while (!m_values.isEmpty())
-                markChildren(m_values.removeLast());
-        }
-#if !ASSERT_DISABLED
-        m_isDraining = false;
-#endif
-    }
-
     // Rule from ECMA 15.2 about what an array index is.
     // Must exactly match string form of an unsigned integer, and be less than 2^32 - 1.
     inline unsigned Identifier::toArrayIndex(bool& ok) const
diff --git a/Source/JavaScriptCore/runtime/JSByteArray.cpp b/Source/JavaScriptCore/runtime/JSByteArray.cpp
index 3f7d806..c2abaee 100644
--- a/Source/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSByteArray.cpp
@@ -33,12 +33,11 @@ using namespace WTF;
 
 namespace JSC {
 
-const ClassInfo JSByteArray::s_defaultInfo = { "ByteArray", 0, 0, 0 };
+const ClassInfo JSByteArray::s_defaultInfo = { "ByteArray", &Base::s_info, 0, 0 };
 
-JSByteArray::JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure> structure, ByteArray* storage, const JSC::ClassInfo* classInfo)
-    : JSObject(structure)
+JSByteArray::JSByteArray(ExecState* exec, Structure* structure, ByteArray* storage)
+    : JSNonFinalObject(exec->globalData(), structure)
     , m_storage(storage)
-    , m_classInfo(classInfo)
 {
     putDirect(exec->globalData(), exec->globalData().propertyNames->length, jsNumber(m_storage->length()), ReadOnly | DontDelete);
 }
@@ -51,10 +50,9 @@ JSByteArray::~JSByteArray()
 #endif
 
 
-PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype)
+Structure* JSByteArray::createStructure(JSGlobalData& globalData, JSValue prototype, const JSC::ClassInfo* classInfo)
 {
-    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
-    return result;
+    return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, classInfo);
 }
 
 bool JSByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/JavaScriptCore/runtime/JSByteArray.h b/Source/JavaScriptCore/runtime/JSByteArray.h
index 44bae2d..c481bb4 100644
--- a/Source/JavaScriptCore/runtime/JSByteArray.h
+++ b/Source/JavaScriptCore/runtime/JSByteArray.h
@@ -32,9 +32,11 @@
 
 namespace JSC {
 
-    class JSByteArray : public JSObject {
+    class JSByteArray : public JSNonFinalObject {
         friend class JSGlobalData;
     public:
+        typedef JSNonFinalObject Base;
+
         bool canAccessIndex(unsigned i) { return i < m_storage->length(); }
         JSValue getIndex(ExecState*, unsigned i)
         {
@@ -45,18 +47,25 @@ namespace JSC {
         void setIndex(unsigned i, int value)
         {
             ASSERT(canAccessIndex(i));
+            if (value & ~0xFF) {
+                if (value < 0)
+                    value = 0;
+                else
+                    value = 255;
+            }
             m_storage->data()[i] = static_cast<unsigned char>(value);
         }
-
+        
         void setIndex(unsigned i, double value)
         {
             ASSERT(canAccessIndex(i));
-            // The largest integer value that a double can represent without loss of precision
-            // is 2^53.  long long is the smallest integral type that gives correct results
-            // when casting numbers larger than 2^31 from a value of type double.
-            m_storage->data()[i] = static_cast<unsigned char>(static_cast<long long>(value));
+            if (!(value > 0)) // Clamp NaN to 0
+                value = 0;
+            else if (value > 255)
+                value = 255;
+            m_storage->data()[i] = static_cast<unsigned char>(value + 0.5);
         }
-
+        
         void setIndex(ExecState* exec, unsigned i, JSValue value)
         {
             double byteValue = value.toNumber(exec);
@@ -66,8 +75,8 @@ namespace JSC {
                 setIndex(i, byteValue);
         }
 
-        JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure>, WTF::ByteArray* storage, const JSC::ClassInfo* = &s_defaultInfo);
-        static PassRefPtr<Structure> createStructure(JSValue prototype);
+        JSByteArray(ExecState*, Structure*, WTF::ByteArray* storage);
+        static Structure* createStructure(JSGlobalData&, JSValue prototype, const JSC::ClassInfo* = &s_defaultInfo);
 
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
@@ -77,9 +86,8 @@ namespace JSC {
 
         virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
-        virtual const ClassInfo* classInfo() const { return m_classInfo; }
         static const ClassInfo s_defaultInfo;
-
+        
         size_t length() const { return m_storage->length(); }
 
         WTF::ByteArray* storage() const { return m_storage.get(); }
@@ -92,17 +100,14 @@ namespace JSC {
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
 
     private:
-        enum VPtrStealingHackType { VPtrStealingHack };
         JSByteArray(VPtrStealingHackType)
-            : JSObject(createStructure(jsNull()))
-            , m_classInfo(0)
+            : JSNonFinalObject(VPtrStealingHack)
         {
         }
 
         RefPtr<WTF::ByteArray> m_storage;
-        const ClassInfo* m_classInfo;
     };
-
+    
     JSByteArray* asByteArray(JSValue value);
     inline JSByteArray* asByteArray(JSValue value)
     {
diff --git a/Source/JavaScriptCore/runtime/JSCell.cpp b/Source/JavaScriptCore/runtime/JSCell.cpp
index 0cc1ab1..afd8450 100644
--- a/Source/JavaScriptCore/runtime/JSCell.cpp
+++ b/Source/JavaScriptCore/runtime/JSCell.cpp
@@ -119,7 +119,7 @@ bool JSCell::getOwnPropertySlot(ExecState* exec, const Identifier& identifier, P
     // This is not a general purpose implementation of getOwnPropertySlot.
     // It should only be called by JSValue::get.
     // It calls getPropertySlot, not getOwnPropertySlot.
-    JSObject* object = toObject(exec);
+    JSObject* object = toObject(exec, exec->lexicalGlobalObject());
     slot.setBase(object);
     if (!object->getPropertySlot(exec, identifier, slot))
         slot.setUndefined();
@@ -131,7 +131,7 @@ bool JSCell::getOwnPropertySlot(ExecState* exec, unsigned identifier, PropertySl
     // This is not a general purpose implementation of getOwnPropertySlot.
     // It should only be called by JSValue::get.
     // It calls getPropertySlot, not getOwnPropertySlot.
-    JSObject* object = toObject(exec);
+    JSObject* object = toObject(exec, exec->lexicalGlobalObject());
     slot.setBase(object);
     if (!object->getPropertySlot(exec, identifier, slot))
         slot.setUndefined();
@@ -140,32 +140,27 @@ bool JSCell::getOwnPropertySlot(ExecState* exec, unsigned identifier, PropertySl
 
 void JSCell::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
-    toObject(exec)->put(exec, identifier, value, slot);
+    toObject(exec, exec->lexicalGlobalObject())->put(exec, identifier, value, slot);
 }
 
 void JSCell::put(ExecState* exec, unsigned identifier, JSValue value)
 {
-    toObject(exec)->put(exec, identifier, value);
+    toObject(exec, exec->lexicalGlobalObject())->put(exec, identifier, value);
 }
 
 bool JSCell::deleteProperty(ExecState* exec, const Identifier& identifier)
 {
-    return toObject(exec)->deleteProperty(exec, identifier);
+    return toObject(exec, exec->lexicalGlobalObject())->deleteProperty(exec, identifier);
 }
 
 bool JSCell::deleteProperty(ExecState* exec, unsigned identifier)
 {
-    return toObject(exec)->deleteProperty(exec, identifier);
+    return toObject(exec, exec->lexicalGlobalObject())->deleteProperty(exec, identifier);
 }
 
 JSObject* JSCell::toThisObject(ExecState* exec) const
 {
-    return toObject(exec);
-}
-
-const ClassInfo* JSCell::classInfo() const
-{
-    return 0;
+    return toObject(exec, exec->lexicalGlobalObject());
 }
 
 JSValue JSCell::getJSNumber()
@@ -208,10 +203,20 @@ UString JSCell::toString(ExecState*) const
     return UString();
 }
 
-JSObject* JSCell::toObject(ExecState*) const
+JSObject* JSCell::toObject(ExecState*, JSGlobalObject*) const
 {
     ASSERT_NOT_REACHED();
     return 0;
 }
 
+bool isZombie(const JSCell* cell)
+{
+#if ENABLE(JSC_ZOMBIES)
+    return cell && cell->isZombie();
+#else
+    UNUSED_PARAM(cell);
+    return false;
+#endif
+}
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
index 66f6197..7ee871c 100644
--- a/Source/JavaScriptCore/runtime/JSCell.h
+++ b/Source/JavaScriptCore/runtime/JSCell.h
@@ -24,16 +24,19 @@
 #define JSCell_h
 
 #include "CallData.h"
+#include "CallFrame.h"
 #include "ConstructData.h"
 #include "Heap.h"
-#include "JSImmediate.h"
-#include "JSValue.h"
+#include "JSLock.h"
+#include "JSValueInlineMethods.h"
 #include "MarkStack.h"
-#include "Structure.h"
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
 
+    class JSGlobalObject;
+    class Structure;
+
 #if COMPILER(MSVC)
     // If WTF_MAKE_NONCOPYABLE is applied to JSCell we end up with a bunch of
     // undefined references to the JSCell copy constructor and assignment operator
@@ -52,10 +55,9 @@ namespace JSC {
         WTF_MAKE_NONCOPYABLE(JSCell);
 #endif
 
+        friend class ExecutableBase;
         friend class GetterSetter;
         friend class Heap;
-        friend class JIT;
-        friend class JSNumberCell;
         friend class JSObject;
         friend class JSPropertyNameIterator;
         friend class JSString;
@@ -65,16 +67,20 @@ namespace JSC {
         friend class JSGlobalData;
         friend class MarkedSpace;
         friend class MarkedBlock;
+        friend class ScopeChainNode;
+        friend class Structure;
+        friend class StructureChain;
+
+    protected:
+        enum VPtrStealingHackType { VPtrStealingHack };
 
     private:
-        explicit JSCell(Structure*);
+        explicit JSCell(VPtrStealingHackType) { }
+        JSCell(JSGlobalData&, Structure*);
         virtual ~JSCell();
 
     public:
-        static PassRefPtr<Structure> createDummyStructure()
-        {
-            return Structure::create(jsNull(), TypeInfo(UnspecifiedType), AnonymousSlotCount);
-        }
+        static Structure* createDummyStructure(JSGlobalData&);
 
         // Querying the type.
         bool isString() const;
@@ -105,7 +111,7 @@ namespace JSC {
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
+        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
 
         // Garbage collection.
         void* operator new(size_t, ExecState*);
@@ -118,7 +124,7 @@ namespace JSC {
 #endif
 
         // Object operations, with the toObject operation included.
-        virtual const ClassInfo* classInfo() const;
+        const ClassInfo* classInfo() const;
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual void put(ExecState*, unsigned propertyName, JSValue);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
@@ -135,6 +141,16 @@ namespace JSC {
         // property names, we want a similar interface with appropriate optimizations.)
         bool fastGetOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 
+        static ptrdiff_t structureOffset()
+        {
+            return OBJECT_OFFSETOF(JSCell, m_structure);
+        }
+
+        const void* addressOfStructure() const
+        {
+            return &m_structure;
+        }
+
     protected:
         static const unsigned AnonymousSlotCount = 0;
 
@@ -143,45 +159,28 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
         
-        Structure* m_structure;
+        WriteBarrier<Structure> m_structure;
     };
 
-    inline JSCell::JSCell(Structure* structure)
-        : m_structure(structure)
+    inline JSCell::JSCell(JSGlobalData& globalData, Structure* structure)
+        : m_structure(globalData, this, structure)
     {
+        // Very first set of allocations won't have a real structure.
+        ASSERT(m_structure || !globalData.dummyMarkableCellStructure);
     }
 
     inline JSCell::~JSCell()
     {
     }
 
-    inline bool JSCell::isObject() const
-    {
-        return m_structure->typeInfo().type() == ObjectType;
-    }
-
-    inline bool JSCell::isString() const
-    {
-        return m_structure->typeInfo().type() == StringType;
-    }
-
     inline Structure* JSCell::structure() const
     {
-        return m_structure;
-    }
-
-    inline void JSCell::markChildren(MarkStack&)
-    {
-    }
-
-    inline void* JSCell::operator new(size_t size, JSGlobalData* globalData)
-    {
-        return globalData->heap.allocate(size);
+        return m_structure.get();
     }
 
-    inline void* JSCell::operator new(size_t size, ExecState* exec)
+    inline void JSCell::markChildren(MarkStack& markStack)
     {
-        return exec->heap()->allocate(size);
+        markStack.append(&m_structure);
     }
 
     // --- JSValue inlines ----------------------------
@@ -211,6 +210,11 @@ namespace JSC {
         return isCell() ? asCell()->getString(exec) : UString();
     }
 
+    template <typename Base> UString HandleConverter<Base, Unknown>::getString(ExecState* exec) const
+    {
+        return jsValue().getString(exec);
+    }
+
     inline JSObject* JSValue::getObject() const
     {
         return isCell() ? asCell()->getObject() : 0;
@@ -245,14 +249,6 @@ namespace JSC {
         return false;
     }
 
-#if USE(JSVALUE64)
-    ALWAYS_INLINE JSCell* JSValue::asCell() const
-    {
-        ASSERT(isCell());
-        return m_ptr;
-    }
-#endif // USE(JSVALUE64)
-
     inline JSValue JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
     {
         return isCell() ? asCell()->toPrimitive(exec, preferredType) : asValue();
@@ -312,13 +308,6 @@ namespace JSC {
         return isUndefined() ? nonInlineNaN() : 0; // null and false both convert to 0.
     }
 
-    inline bool JSValue::needsThisConversion() const
-    {
-        if (UNLIKELY(!isCell()))
-            return true;
-        return asCell()->structure()->typeInfo().needsThisConversion();
-    }
-
     inline JSValue JSValue::getJSNumber()
     {
         if (isInt32() || isDouble())
@@ -330,57 +319,17 @@ namespace JSC {
 
     inline JSObject* JSValue::toObject(ExecState* exec) const
     {
-        return isCell() ? asCell()->toObject(exec) : toObjectSlowCase(exec);
+        return isCell() ? asCell()->toObject(exec, exec->lexicalGlobalObject()) : toObjectSlowCase(exec, exec->lexicalGlobalObject());
     }
 
-    inline JSObject* JSValue::toThisObject(ExecState* exec) const
-    {
-        return isCell() ? asCell()->toThisObject(exec) : toThisObjectSlowCase(exec);
-    }
-    
-    template <typename T> void MarkStack::append(DeprecatedPtr<T>* slot)
+    inline JSObject* JSValue::toObject(ExecState* exec, JSGlobalObject* globalObject) const
     {
-        internalAppend(slot->get());
-    }
-    
-    template <typename T> void MarkStack::append(WriteBarrierBase<T>* slot)
-    {
-        internalAppend(slot->get());
-    }
-
-    ALWAYS_INLINE void MarkStack::internalAppend(JSCell* cell)
-    {
-        ASSERT(!m_isCheckingForDefaultMarkViolation);
-        ASSERT(cell);
-        if (Heap::testAndSetMarked(cell))
-            return;
-        if (cell->structure()->typeInfo().type() >= CompoundType)
-            m_values.append(cell);
+        return isCell() ? asCell()->toObject(exec, globalObject) : toObjectSlowCase(exec, globalObject);
     }
 
-    ALWAYS_INLINE void MarkStack::deprecatedAppend(JSCell** value)
-    {
-        ASSERT(value);
-        internalAppend(*value);
-    }
-
-    ALWAYS_INLINE void MarkStack::deprecatedAppend(JSValue* value)
-    {
-        ASSERT(value);
-        internalAppend(*value);
-    }
-    
-    ALWAYS_INLINE void MarkStack::deprecatedAppend(Register* value)
-    {
-        ASSERT(value);
-        internalAppend(value->jsValue());
-    }
-
-    ALWAYS_INLINE void MarkStack::internalAppend(JSValue value)
+    inline JSObject* JSValue::toThisObject(ExecState* exec) const
     {
-        ASSERT(value);
-        if (value.isCell())
-            internalAppend(value.asCell());
+        return isCell() ? asCell()->toThisObject(exec) : toThisObjectSlowCase(exec);
     }
 
     inline Heap* Heap::heap(JSValue v)
@@ -398,25 +347,65 @@ namespace JSC {
 #if ENABLE(JSC_ZOMBIES)
     inline bool JSValue::isZombie() const
     {
-        return isCell() && asCell() && asCell()->isZombie();
+        return isCell() && asCell() > (JSCell*)0x1ffffffffL && asCell()->isZombie();
     }
 #endif
 
-    inline void* MarkedBlock::allocate(size_t& nextCell)
+    inline void* MarkedBlock::allocate()
     {
-        do {
-            ASSERT(nextCell < CELLS_PER_BLOCK);
-            if (!marked.testAndSet(nextCell)) { // Always false for the last cell in the block
-                JSCell* cell = reinterpret_cast<JSCell*>(&cells[nextCell++]);
+        while (m_nextAtom < m_endAtom) {
+            if (!m_marks.testAndSet(m_nextAtom)) {
+                JSCell* cell = reinterpret_cast<JSCell*>(&atoms()[m_nextAtom]);
+                m_nextAtom += m_atomsPerCell;
                 cell->~JSCell();
                 return cell;
             }
-            nextCell = marked.nextPossiblyUnset(nextCell);
-        } while (nextCell != CELLS_PER_BLOCK);
-        
-        nextCell = 0;
+            m_nextAtom += m_atomsPerCell;
+        }
+
         return 0;
     }
+    
+    inline MarkedSpace::SizeClass& MarkedSpace::sizeClassFor(size_t bytes)
+    {
+        ASSERT(bytes && bytes < maxCellSize);
+        if (bytes < preciseCutoff)
+            return m_preciseSizeClasses[(bytes - 1) / preciseStep];
+        return m_impreciseSizeClasses[(bytes - 1) / impreciseStep];
+    }
+
+    inline void* MarkedSpace::allocate(size_t bytes)
+    {
+        SizeClass& sizeClass = sizeClassFor(bytes);
+        return allocateFromSizeClass(sizeClass);
+    }
+    
+    inline void* Heap::allocate(size_t bytes)
+    {
+        ASSERT(globalData()->identifierTable == wtfThreadData().currentIdentifierTable());
+        ASSERT(JSLock::lockCount() > 0);
+        ASSERT(JSLock::currentThreadIsHoldingLock());
+        ASSERT(bytes <= MarkedSpace::maxCellSize);
+        ASSERT(m_operationInProgress == NoOperation);
+
+        m_operationInProgress = Allocation;
+        void* result = m_markedSpace.allocate(bytes);
+        m_operationInProgress = NoOperation;
+        if (result)
+            return result;
+
+        return allocateSlowCase(bytes);
+    }
+
+    inline void* JSCell::operator new(size_t size, JSGlobalData* globalData)
+    {
+        return globalData->heap.allocate(size);
+    }
+
+    inline void* JSCell::operator new(size_t size, ExecState* exec)
+    {
+        return exec->heap()->allocate(size);
+    }
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/JSChunk.cpp b/Source/JavaScriptCore/runtime/JSChunk.cpp
new file mode 100644
index 0000000..f064de8
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSChunk.cpp
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSChunk.h"
+
diff --git a/Source/JavaScriptCore/runtime/JSChunk.h b/Source/JavaScriptCore/runtime/JSChunk.h
new file mode 100644
index 0000000..bae2bc7
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSChunk.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSChunk_h
+#define JSChunk_h
+
+
+
+#endif // JSChunk_h
diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index c569722..a18e973 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -42,62 +42,54 @@ using namespace WTF;
 using namespace Unicode;
 
 namespace JSC {
-#if ENABLE(JIT)
 EncodedJSValue JSC_HOST_CALL callHostFunctionAsConstructor(ExecState* exec)
 {
     return throwVMError(exec, createNotAConstructorError(exec, exec->callee()));
 }
-#endif
 
 ASSERT_CLASS_FITS_IN_CELL(JSFunction);
 
-const ClassInfo JSFunction::info = { "Function", 0, 0, 0 };
+const ClassInfo JSFunction::s_info = { "Function", &Base::s_info, 0, 0 };
 
 bool JSFunction::isHostFunctionNonInline() const
 {
     return isHostFunction();
 }
 
-JSFunction::JSFunction(NonNullPassRefPtr<Structure> structure)
-    : Base(structure)
-    , m_executable(adoptRef(new VPtrHackExecutable()))
-    , m_scopeChain(NoScopeChain())
+JSFunction::JSFunction(VPtrStealingHackType)
+    : Base(VPtrStealingHack)
 {
 }
 
-#if ENABLE(JIT)
-JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, int length, const Identifier& name, PassRefPtr<NativeExecutable> thunk)
+JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, int length, const Identifier& name, NativeExecutable* thunk)
     : Base(globalObject, structure)
-    , m_executable(thunk)
-    , m_scopeChain(globalObject->globalScopeChain())
+    , m_executable(exec->globalData(), this, thunk)
+    , m_scopeChain(exec->globalData(), this, globalObject->globalScopeChain())
 {
+    ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
 }
-#endif
 
-JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, int length, const Identifier& name, NativeFunction func)
+JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, int length, const Identifier& name, NativeFunction func)
     : Base(globalObject, structure)
-#if ENABLE(JIT)
-    , m_executable(exec->globalData().getHostFunction(func))
-#endif
-    , m_scopeChain(globalObject->globalScopeChain())
+    , m_scopeChain(exec->globalData(), this, globalObject->globalScopeChain())
 {
+    ASSERT(inherits(&s_info));
+    // We separate out intialisation from setting the executable
+    // as getHostFunction may perform a GC allocation, so we have to be able to
+    // mark ourselves safely
+    m_executable.set(exec->globalData(), this, exec->globalData().getHostFunction(func));
     putDirect(exec->globalData(), exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
-#if ENABLE(JIT)
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
-#else
-    UNUSED_PARAM(length);
-    UNUSED_PARAM(func);
-    ASSERT_NOT_REACHED();
-#endif
 }
 
-JSFunction::JSFunction(ExecState* exec, NonNullPassRefPtr<FunctionExecutable> executable, ScopeChainNode* scopeChainNode)
-    : Base(scopeChainNode->globalObject, scopeChainNode->globalObject->functionStructure())
-    , m_executable(executable)
-    , m_scopeChain(scopeChainNode)
+JSFunction::JSFunction(ExecState* exec, FunctionExecutable* executable, ScopeChainNode* scopeChainNode)
+    : Base(scopeChainNode->globalObject.get(), scopeChainNode->globalObject->functionStructure())
+    , m_executable(exec->globalData(), this, executable)
+    , m_scopeChain(exec->globalData(), this, scopeChainNode)
 {
+    ASSERT(inherits(&s_info));
     const Identifier& name = static_cast<FunctionExecutable*>(m_executable.get())->name();
     putDirect(exec->globalData(), exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
 }
@@ -105,19 +97,6 @@ JSFunction::JSFunction(ExecState* exec, NonNullPassRefPtr<FunctionExecutable> ex
 JSFunction::~JSFunction()
 {
     ASSERT(vptr() == JSGlobalData::jsFunctionVPtr);
-
-    // JIT code for other functions may have had calls linked directly to the code for this function; these links
-    // are based on a check for the this pointer value for this JSFunction - which will no longer be valid once
-    // this memory is freed and may be reused (potentially for another, different JSFunction).
-    if (!isHostFunction()) {
-#if ENABLE(JIT_OPTIMIZE_CALL)
-        ASSERT(m_executable);
-        if (jsExecutable()->isGeneratedForCall())
-            jsExecutable()->generatedBytecodeForCall().unlinkCallers();
-        if (jsExecutable()->isGeneratedForConstruct())
-            jsExecutable()->generatedBytecodeForConstruct().unlinkCallers();
-#endif
-    }
 }
 
 static const char* StrictModeCallerAccessError = "Cannot access caller property of a strict mode function";
@@ -131,12 +110,12 @@ static void createDescriptorForThrowingProperty(ExecState* exec, PropertyDescrip
 
 const UString& JSFunction::name(ExecState* exec)
 {
-    return asString(getDirect(exec->globalData().propertyNames->name))->tryGetValue();
+    return asString(getDirect(exec->globalData(), exec->globalData().propertyNames->name))->tryGetValue();
 }
 
 const UString JSFunction::displayName(ExecState* exec)
 {
-    JSValue displayName = getDirect(exec->globalData().propertyNames->displayName);
+    JSValue displayName = getDirect(exec->globalData(), exec->globalData().propertyNames->displayName);
     
     if (displayName && isJSString(&exec->globalData(), displayName))
         return asString(displayName)->tryGetValue();
@@ -157,22 +136,24 @@ const UString JSFunction::calculatedDisplayName(ExecState* exec)
 void JSFunction::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
-    if (!isHostFunction()) {
-        jsExecutable()->markAggregate(markStack);
-        scope().markAggregate(markStack);
+
+    markStack.append(&m_scopeChain);
+    if (m_executable) {
+        // Delightful race condition: m_executable may not have been initialised
+        // if this is a host function, as the executable isn't necessarily created 
+        // until after the function has been allocated.
+        markStack.append(&m_executable);
     }
 }
 
 CallType JSFunction::getCallData(CallData& callData)
 {
-#if ENABLE(JIT)
     if (isHostFunction()) {
         callData.native.function = nativeFunction();
         return CallTypeHost;
     }
-#endif
     callData.js.functionExecutable = jsExecutable();
-    callData.js.scopeChain = scope().node();
+    callData.js.scopeChain = scope();
     return CallTypeJS;
 }
 
@@ -203,13 +184,13 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
         return Base::getOwnPropertySlot(exec, propertyName, slot);
 
     if (propertyName == exec->propertyNames().prototype) {
-        WriteBarrierBase<Unknown>* location = getDirectLocation(propertyName);
+        WriteBarrierBase<Unknown>* location = getDirectLocation(exec->globalData(), propertyName);
 
         if (!location) {
-            JSObject* prototype = new (exec) JSObject(scope().globalObject()->emptyObjectStructure());
+            JSObject* prototype = constructEmptyObject(exec, scope()->globalObject->emptyObjectStructure());
             prototype->putDirect(exec->globalData(), exec->propertyNames().constructor, this, DontEnum);
             putDirect(exec->globalData(), exec->propertyNames().prototype, prototype, DontDelete | DontEnum);
-            location = getDirectLocation(propertyName);
+            location = getDirectLocation(exec->globalData(), propertyName);
         }
 
         slot.setValue(this, location->get(), offsetForLocation(location));
@@ -336,7 +317,7 @@ ConstructType JSFunction::getConstructData(ConstructData& constructData)
     if (isHostFunction())
         return ConstructTypeNone;
     constructData.js.functionExecutable = jsExecutable();
-    constructData.js.scopeChain = scope().node();
+    constructData.js.scopeChain = scope();
     return ConstructTypeJS;
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSFunction.h b/Source/JavaScriptCore/runtime/JSFunction.h
index 3a2fe30..174cd38 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.h
+++ b/Source/JavaScriptCore/runtime/JSFunction.h
@@ -34,6 +34,7 @@ namespace JSC {
     class JSActivation;
     class JSGlobalObject;
     class NativeExecutable;
+    class VPtrHackExecutable;
 
     EncodedJSValue JSC_HOST_CALL callHostFunctionAsConstructor(ExecState*);
 
@@ -44,26 +45,24 @@ namespace JSC {
         typedef JSObjectWithGlobalObject Base;
 
     public:
-        JSFunction(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, int length, const Identifier&, NativeFunction);
-#if ENABLE(JIT)
-        JSFunction(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, int length, const Identifier&, PassRefPtr<NativeExecutable>);
-#endif
-        JSFunction(ExecState*, NonNullPassRefPtr<FunctionExecutable>, ScopeChainNode*);
+        JSFunction(ExecState*, JSGlobalObject*, Structure*, int length, const Identifier&, NativeFunction);
+        JSFunction(ExecState*, JSGlobalObject*, Structure*, int length, const Identifier&, NativeExecutable*);
+        JSFunction(ExecState*, FunctionExecutable*, ScopeChainNode*);
         virtual ~JSFunction();
 
         const UString& name(ExecState*);
         const UString displayName(ExecState*);
         const UString calculatedDisplayName(ExecState*);
 
-        ScopeChain& scope()
+        ScopeChainNode* scope()
         {
             ASSERT(!isHostFunctionNonInline());
-            return m_scopeChain;
+            return m_scopeChain.get();
         }
-        void setScope(const ScopeChain& scopeChain)
+        void setScope(JSGlobalData& globalData, ScopeChainNode* scopeChain)
         {
             ASSERT(!isHostFunctionNonInline());
-            m_scopeChain = scopeChain;
+            m_scopeChain.set(globalData, this, scopeChain);
         }
 
         ExecutableBase* executable() const { return m_executable.get(); }
@@ -72,11 +71,11 @@ namespace JSC {
         inline bool isHostFunction() const;
         FunctionExecutable* jsExecutable() const;
 
-        static JS_EXPORTDATA const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
         NativeFunction nativeFunction();
@@ -88,7 +87,7 @@ namespace JSC {
         const static unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
 
     private:
-        JSFunction(NonNullPassRefPtr<Structure>);
+        explicit JSFunction(VPtrStealingHackType);
 
         bool isHostFunctionNonInline() const;
 
@@ -100,21 +99,19 @@ namespace JSC {
 
         virtual void markChildren(MarkStack&);
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-
         static JSValue argumentsGetter(ExecState*, JSValue, const Identifier&);
         static JSValue callerGetter(ExecState*, JSValue, const Identifier&);
         static JSValue lengthGetter(ExecState*, JSValue, const Identifier&);
 
-        RefPtr<ExecutableBase> m_executable;
-        ScopeChain m_scopeChain;
+        WriteBarrier<ExecutableBase> m_executable;
+        WriteBarrier<ScopeChainNode> m_scopeChain;
     };
 
     JSFunction* asFunction(JSValue);
 
     inline JSFunction* asFunction(JSValue value)
     {
-        ASSERT(asObject(value)->inherits(&JSFunction::info));
+        ASSERT(asObject(value)->inherits(&JSFunction::s_info));
         return static_cast<JSFunction*>(asObject(value));
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.cpp b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
index ff88048..d9e5df0 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -45,6 +45,7 @@
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
 #include "JSStaticScopeObject.h"
+#include "JSZombie.h"
 #include "Lexer.h"
 #include "Lookup.h"
 #include "Nodes.h"
@@ -68,6 +69,27 @@
 
 using namespace WTF;
 
+namespace {
+
+using namespace JSC;
+
+class Recompiler {
+public:
+    void operator()(JSCell*);
+};
+
+inline void Recompiler::operator()(JSCell* cell)
+{
+    if (!cell->inherits(&JSFunction::s_info))
+        return;
+    JSFunction* function = asFunction(cell);
+    if (function->executable()->isHostFunction())
+        return;
+    function->jsExecutable()->discardCode();
+}
+
+} // namespace
+
 namespace JSC {
 
 extern JSC_CONST_HASHTABLE HashTable arrayTable;
@@ -75,6 +97,7 @@ extern JSC_CONST_HASHTABLE HashTable jsonTable;
 extern JSC_CONST_HASHTABLE HashTable dateTable;
 extern JSC_CONST_HASHTABLE HashTable mathTable;
 extern JSC_CONST_HASHTABLE HashTable numberTable;
+extern JSC_CONST_HASHTABLE HashTable objectConstructorTable;
 extern JSC_CONST_HASHTABLE HashTable regExpTable;
 extern JSC_CONST_HASHTABLE HashTable regExpConstructorTable;
 extern JSC_CONST_HASHTABLE HashTable stringTable;
@@ -84,6 +107,15 @@ void* JSGlobalData::jsByteArrayVPtr;
 void* JSGlobalData::jsStringVPtr;
 void* JSGlobalData::jsFunctionVPtr;
 
+#if COMPILER(GCC)
+// Work around for gcc trying to coalesce our reads of the various cell vptrs
+#define CLOBBER_MEMORY() do { \
+    asm volatile ("" : : : "memory"); \
+} while (false)
+#else
+#define CLOBBER_MEMORY() do { } while (false)
+#endif
+
 void JSGlobalData::storeVPtrs()
 {
     // Enough storage to fit a JSArray, JSByteArray, JSString, or JSFunction.
@@ -92,23 +124,23 @@ void JSGlobalData::storeVPtrs()
 
     COMPILE_ASSERT(sizeof(JSArray) <= sizeof(storage), sizeof_JSArray_must_be_less_than_storage);
     JSCell* jsArray = new (storage) JSArray(JSArray::VPtrStealingHack);
+    CLOBBER_MEMORY();
     JSGlobalData::jsArrayVPtr = jsArray->vptr();
-    jsArray->~JSCell();
 
     COMPILE_ASSERT(sizeof(JSByteArray) <= sizeof(storage), sizeof_JSByteArray_must_be_less_than_storage);
     JSCell* jsByteArray = new (storage) JSByteArray(JSByteArray::VPtrStealingHack);
+    CLOBBER_MEMORY();
     JSGlobalData::jsByteArrayVPtr = jsByteArray->vptr();
-    jsByteArray->~JSCell();
 
     COMPILE_ASSERT(sizeof(JSString) <= sizeof(storage), sizeof_JSString_must_be_less_than_storage);
     JSCell* jsString = new (storage) JSString(JSString::VPtrStealingHack);
+    CLOBBER_MEMORY();
     JSGlobalData::jsStringVPtr = jsString->vptr();
-    jsString->~JSCell();
 
     COMPILE_ASSERT(sizeof(JSFunction) <= sizeof(storage), sizeof_JSFunction_must_be_less_than_storage);
-    JSCell* jsFunction = new (storage) JSFunction(JSFunction::createStructure(jsNull()));
+    JSCell* jsFunction = new (storage) JSFunction(JSCell::VPtrStealingHack);
+    CLOBBER_MEMORY();
     JSGlobalData::jsFunctionVPtr = jsFunction->vptr();
-    jsFunction->~JSCell();
 }
 
 JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType threadStackType)
@@ -119,29 +151,19 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , jsonTable(fastNew<HashTable>(JSC::jsonTable))
     , mathTable(fastNew<HashTable>(JSC::mathTable))
     , numberTable(fastNew<HashTable>(JSC::numberTable))
+    , objectConstructorTable(fastNew<HashTable>(JSC::objectConstructorTable))
     , regExpTable(fastNew<HashTable>(JSC::regExpTable))
     , regExpConstructorTable(fastNew<HashTable>(JSC::regExpConstructorTable))
     , stringTable(fastNew<HashTable>(JSC::stringTable))
-    , activationStructure(JSActivation::createStructure(jsNull()))
-    , interruptedExecutionErrorStructure(JSObject::createStructure(jsNull()))
-    , terminatedExecutionErrorStructure(JSObject::createStructure(jsNull()))
-    , staticScopeStructure(JSStaticScopeObject::createStructure(jsNull()))
-    , strictEvalActivationStructure(StrictEvalActivation::createStructure(jsNull()))
-    , stringStructure(JSString::createStructure(jsNull()))
-    , notAnObjectStructure(JSNotAnObject::createStructure(jsNull()))
-    , propertyNameIteratorStructure(JSPropertyNameIterator::createStructure(jsNull()))
-    , getterSetterStructure(GetterSetter::createStructure(jsNull()))
-    , apiWrapperStructure(JSAPIValueWrapper::createStructure(jsNull()))
-    , dummyMarkableCellStructure(JSCell::createDummyStructure())
     , identifierTable(globalDataType == Default ? wtfThreadData().currentIdentifierTable() : createIdentifierTable())
     , propertyNames(new CommonIdentifiers(this))
     , emptyList(new MarkedArgumentBuffer)
     , lexer(new Lexer(this))
     , parser(new Parser)
-    , interpreter(new Interpreter)
+    , interpreter(0)
     , heap(this)
+    , globalObjectCount(0)
     , dynamicGlobalObject(0)
-    , firstStringifierToMark(0)
     , cachedUTCOffset(NaN)
     , maxReentryDepth(threadStackType == ThreadStackTypeSmall ? MaxSmallThreadReentryDepth : MaxLargeThreadReentryDepth)
     , m_regExpCache(new RegExpCache(this))
@@ -152,14 +174,44 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , exclusiveThread(0)
 #endif
 {
+    interpreter = new Interpreter(*this);
     if (globalDataType == Default)
         m_stack = wtfThreadData().stack();
 
+    // Need to be careful to keep everything consistent here
+    IdentifierTable* existingEntryIdentifierTable = wtfThreadData().setCurrentIdentifierTable(identifierTable);
+    JSLock lock(SilenceAssertionsOnly);
+    structureStructure.set(*this, Structure::createStructure(*this));
+    activationStructure.set(*this, JSActivation::createStructure(*this, jsNull()));
+    interruptedExecutionErrorStructure.set(*this, JSNonFinalObject::createStructure(*this, jsNull()));
+    terminatedExecutionErrorStructure.set(*this, JSNonFinalObject::createStructure(*this, jsNull()));
+    staticScopeStructure.set(*this, JSStaticScopeObject::createStructure(*this, jsNull()));
+    strictEvalActivationStructure.set(*this, StrictEvalActivation::createStructure(*this, jsNull()));
+    stringStructure.set(*this, JSString::createStructure(*this, jsNull()));
+    notAnObjectStructure.set(*this, JSNotAnObject::createStructure(*this, jsNull()));
+    propertyNameIteratorStructure.set(*this, JSPropertyNameIterator::createStructure(*this, jsNull()));
+    getterSetterStructure.set(*this, GetterSetter::createStructure(*this, jsNull()));
+    apiWrapperStructure.set(*this, JSAPIValueWrapper::createStructure(*this, jsNull()));
+    scopeChainNodeStructure.set(*this, ScopeChainNode::createStructure(*this, jsNull()));
+    executableStructure.set(*this, ExecutableBase::createStructure(*this, jsNull()));
+    nativeExecutableStructure.set(*this, NativeExecutable::createStructure(*this, jsNull()));
+    evalExecutableStructure.set(*this, EvalExecutable::createStructure(*this, jsNull()));
+    programExecutableStructure.set(*this, ProgramExecutable::createStructure(*this, jsNull()));
+    functionExecutableStructure.set(*this, FunctionExecutable::createStructure(*this, jsNull()));
+    dummyMarkableCellStructure.set(*this, JSCell::createDummyStructure(*this));
+    structureChainStructure.set(*this, StructureChain::createStructure(*this, jsNull()));
+
+#if ENABLE(JSC_ZOMBIES)
+    zombieStructure.set(*this, JSZombie::createStructure(*this, jsNull()));
+#endif
+
+    wtfThreadData().setCurrentIdentifierTable(existingEntryIdentifierTable);
+
 #if PLATFORM(MAC)
     startProfilerServerIfNeeded();
 #endif
 #if ENABLE(JIT) && ENABLE(INTERPRETER)
-#if PLATFORM(CF)
+#if USE(CF)
     CFStringRef canUseJITKey = CFStringCreateWithCString(0 , "JavaScriptCoreUseJIT", kCFStringEncodingMacRoman);
     CFBooleanRef canUseJIT = (CFBooleanRef)CFPreferencesCopyAppValue(canUseJITKey, kCFPreferencesCurrentApplication);
     if (canUseJIT) {
@@ -186,6 +238,33 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
 #endif
 }
 
+void JSGlobalData::clearBuiltinStructures()
+{
+    structureStructure.clear();
+    activationStructure.clear();
+    interruptedExecutionErrorStructure.clear();
+    terminatedExecutionErrorStructure.clear();
+    staticScopeStructure.clear();
+    strictEvalActivationStructure.clear();
+    stringStructure.clear();
+    notAnObjectStructure.clear();
+    propertyNameIteratorStructure.clear();
+    getterSetterStructure.clear();
+    apiWrapperStructure.clear();
+    scopeChainNodeStructure.clear();
+    executableStructure.clear();
+    nativeExecutableStructure.clear();
+    evalExecutableStructure.clear();
+    programExecutableStructure.clear();
+    functionExecutableStructure.clear();
+    dummyMarkableCellStructure.clear();
+    structureChainStructure.clear();
+    
+#if ENABLE(JSC_ZOMBIES)
+    zombieStructure.clear();
+#endif
+}
+
 JSGlobalData::~JSGlobalData()
 {
     // By the time this is destroyed, heap.destroy() must already have been called.
@@ -201,6 +280,7 @@ JSGlobalData::~JSGlobalData()
     jsonTable->deleteTable();
     mathTable->deleteTable();
     numberTable->deleteTable();
+    objectConstructorTable->deleteTable();
     regExpTable->deleteTable();
     regExpConstructorTable->deleteTable();
     stringTable->deleteTable();
@@ -210,6 +290,7 @@ JSGlobalData::~JSGlobalData()
     fastDelete(const_cast<HashTable*>(jsonTable));
     fastDelete(const_cast<HashTable*>(mathTable));
     fastDelete(const_cast<HashTable*>(numberTable));
+    fastDelete(const_cast<HashTable*>(objectConstructorTable));
     fastDelete(const_cast<HashTable*>(regExpTable));
     fastDelete(const_cast<HashTable*>(regExpConstructorTable));
     fastDelete(const_cast<HashTable*>(stringTable));
@@ -244,10 +325,7 @@ PassRefPtr<JSGlobalData> JSGlobalData::create(ThreadStackType type)
 
 PassRefPtr<JSGlobalData> JSGlobalData::createLeaked(ThreadStackType type)
 {
-    Structure::startIgnoringLeaks();
-    RefPtr<JSGlobalData> data = create(type);
-    Structure::stopIgnoringLeaks();
-    return data.release();
+    return create(type);
 }
 
 bool JSGlobalData::sharedInstanceExists()
@@ -275,14 +353,19 @@ JSGlobalData*& JSGlobalData::sharedInstanceInternal()
 }
 
 #if ENABLE(JIT)
-PassRefPtr<NativeExecutable> JSGlobalData::getHostFunction(NativeFunction function)
+NativeExecutable* JSGlobalData::getHostFunction(NativeFunction function)
 {
     return jitStubs->hostFunctionStub(this, function);
 }
-PassRefPtr<NativeExecutable> JSGlobalData::getHostFunction(NativeFunction function, ThunkGenerator generator)
+NativeExecutable* JSGlobalData::getHostFunction(NativeFunction function, ThunkGenerator generator)
 {
     return jitStubs->hostFunctionStub(this, function, generator);
 }
+#else
+NativeExecutable* JSGlobalData::getHostFunction(NativeFunction function)
+{
+    return NativeExecutable::create(*this, function, callHostFunctionAsConstructor);
+}
 #endif
 
 JSGlobalData::ClientData::~ClientData()
@@ -313,22 +396,6 @@ void JSGlobalData::dumpSampleData(ExecState* exec)
     interpreter->dumpSampleData(exec);
 }
 
-class Recompiler {
-public:
-    void operator()(JSCell*);
-};
-
-inline void Recompiler::operator()(JSCell* cell)
-{
-    if (!cell->inherits(&JSFunction::info))
-        return;
-    JSFunction* function = asFunction(cell);
-    if (function->executable()->isHostFunction())
-        return;
-    function->jsExecutable()->discardCode();
-}
-
-
 void JSGlobalData::recompileAllJSFunctions()
 {
     // If JavaScript is running, it's not safe to recompile, since we'll end
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.h b/Source/JavaScriptCore/runtime/JSGlobalData.h
index 7b69055..f1085af 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.h
@@ -33,13 +33,13 @@
 #include "Heap.h"
 #include "DateInstanceCache.h"
 #include "ExecutableAllocator.h"
+#include "Strong.h"
 #include "JITStubs.h"
 #include "JSValue.h"
 #include "NumericStrings.h"
 #include "SmallStrings.h"
 #include "Terminator.h"
 #include "TimeoutChecker.h"
-#include "WeakGCMap.h"
 #include "WeakRandom.h"
 #include <wtf/BumpPointerAllocator.h>
 #include <wtf/Forward.h>
@@ -58,11 +58,13 @@ namespace JSC {
 
     class CodeBlock;
     class CommonIdentifiers;
+    class HandleStack;
     class IdentifierTable;
     class Interpreter;
     class JSGlobalObject;
     class JSObject;
     class Lexer;
+    class NativeExecutable;
     class Parser;
     class RegExpCache;
     class Stringifier;
@@ -75,8 +77,6 @@ namespace JSC {
     struct HashTable;
     struct Instruction;
 
-    typedef WeakGCMap<JSGlobalObject*, JSGlobalObject> GlobalObjectMap; // FIXME: Would be nice to use a WeakGCSet here.
-
     struct DSTOffsetCache {
         DSTOffsetCache()
         {
@@ -130,7 +130,7 @@ namespace JSC {
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
         // Will start tracking threads that use the heap, which is resource-heavy.
-        void makeUsableFromMultipleThreads() { heap.machineStackMarker().makeUsableFromMultipleThreads(); }
+        void makeUsableFromMultipleThreads() { heap.machineThreads().makeUsableFromMultipleThreads(); }
 #endif
 
         GlobalDataType globalDataType;
@@ -141,21 +141,34 @@ namespace JSC {
         const HashTable* jsonTable;
         const HashTable* mathTable;
         const HashTable* numberTable;
+        const HashTable* objectConstructorTable;
         const HashTable* regExpTable;
         const HashTable* regExpConstructorTable;
         const HashTable* stringTable;
         
-        RefPtr<Structure> activationStructure;
-        RefPtr<Structure> interruptedExecutionErrorStructure;
-        RefPtr<Structure> terminatedExecutionErrorStructure;
-        RefPtr<Structure> staticScopeStructure;
-        RefPtr<Structure> strictEvalActivationStructure;
-        RefPtr<Structure> stringStructure;
-        RefPtr<Structure> notAnObjectStructure;
-        RefPtr<Structure> propertyNameIteratorStructure;
-        RefPtr<Structure> getterSetterStructure;
-        RefPtr<Structure> apiWrapperStructure;
-        RefPtr<Structure> dummyMarkableCellStructure;
+        Strong<Structure> structureStructure;
+        Strong<Structure> activationStructure;
+        Strong<Structure> interruptedExecutionErrorStructure;
+        Strong<Structure> terminatedExecutionErrorStructure;
+        Strong<Structure> staticScopeStructure;
+        Strong<Structure> strictEvalActivationStructure;
+        Strong<Structure> stringStructure;
+        Strong<Structure> notAnObjectStructure;
+        Strong<Structure> propertyNameIteratorStructure;
+        Strong<Structure> getterSetterStructure;
+        Strong<Structure> apiWrapperStructure;
+        Strong<Structure> scopeChainNodeStructure;
+        Strong<Structure> executableStructure;
+        Strong<Structure> nativeExecutableStructure;
+        Strong<Structure> evalExecutableStructure;
+        Strong<Structure> programExecutableStructure;
+        Strong<Structure> functionExecutableStructure;
+        Strong<Structure> dummyMarkableCellStructure;
+        Strong<Structure> structureChainStructure;
+
+#if ENABLE(JSC_ZOMBIES)
+        Strong<Structure> zombieStructure;
+#endif
 
         static void storeVPtrs();
         static JS_EXPORTDATA void* jsArrayVPtr;
@@ -199,27 +212,26 @@ namespace JSC {
         {
             return jitStubs->ctiStub(this, generator);
         }
-        PassRefPtr<NativeExecutable> getHostFunction(NativeFunction function);
-        PassRefPtr<NativeExecutable> getHostFunction(NativeFunction function, ThunkGenerator generator);
+        NativeExecutable* getHostFunction(NativeFunction, ThunkGenerator);
 #endif
+        NativeExecutable* getHostFunction(NativeFunction);
+
         TimeoutChecker timeoutChecker;
         Terminator terminator;
         Heap heap;
 
-        DeprecatedPtr<Unknown> exception;
+        JSValue exception;
 #if ENABLE(JIT)
         ReturnAddressPtr exceptionLocation;
 #endif
 
         HashMap<OpaqueJSClass*, OpaqueJSClassContextData*> opaqueJSClassData;
 
-        GlobalObjectMap globalObjects;
+        unsigned globalObjectCount;
         JSGlobalObject* dynamicGlobalObject;
 
         HashSet<JSObject*> stringRecursionCheckVisitedObjects;
 
-        Stringifier* firstStringifierToMark;
-
         double cachedUTCOffset;
         DSTOffsetCache dstOffsetCache;
         
@@ -253,6 +265,10 @@ namespace JSC {
         void addRegExpToTrace(PassRefPtr<RegExp> regExp);
 #endif
         void dumpRegExpTrace();
+        HandleSlot allocateGlobalHandle() { return heap.allocateGlobalHandle(); }
+        HandleSlot allocateLocalHandle() { return heap.allocateLocalHandle(); }
+        void clearBuiltinStructures();
+
     private:
         JSGlobalData(GlobalDataType, ThreadStackType);
         static JSGlobalData*& sharedInstanceInternal();
@@ -263,6 +279,11 @@ namespace JSC {
         StackBounds m_stack;
     };
 
+    inline HandleSlot allocateGlobalHandle(JSGlobalData& globalData)
+    {
+        return globalData.allocateGlobalHandle();
+    }
+
 } // namespace JSC
 
 #endif // JSGlobalData_h
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index f303196..b82949a 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -46,7 +46,6 @@
 #include "ErrorPrototype.h"
 #include "FunctionConstructor.h"
 #include "FunctionPrototype.h"
-#include "GlobalEvalFunction.h"
 #include "JSFunction.h"
 #include "JSGlobalObjectFunctions.h"
 #include "JSLock.h"
@@ -60,7 +59,6 @@
 #include "ObjectConstructor.h"
 #include "ObjectPrototype.h"
 #include "Profiler.h"
-#include "PrototypeFunction.h"
 #include "RegExpConstructor.h"
 #include "RegExpMatchesArray.h"
 #include "RegExpObject.h"
@@ -86,30 +84,17 @@ template <typename T> static inline void markIfNeeded(MarkStack& markStack, Writ
         markStack.append(v);
 }
 
-static inline void markIfNeeded(MarkStack& markStack, const RefPtr<Structure>& s)
-{
-    if (s && s->storedPrototype())
-        markStack.append(s->storedPrototypeSlot());
-}
-
 JSGlobalObject::~JSGlobalObject()
 {
     ASSERT(JSLock::currentThreadIsHoldingLock());
 
-    if (d()->debugger)
-        d()->debugger->detach(this);
+    if (m_debugger)
+        m_debugger->detach(this);
 
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (UNLIKELY(*profiler != 0)) {
-        (*profiler)->stopProfiling(globalExec(), UString());
+        (*profiler)->stopProfiling(this);
     }
-
-    d()->globalData->globalObjects.take(this);
-
-    RegisterFile& registerFile = globalData().interpreter->registerFile();
-    if (registerFile.clearGlobalObject(this))
-        registerFile.setNumGlobals(0);
-    d()->destructor(d());
 }
 
 void JSGlobalObject::init(JSObject* thisValue)
@@ -118,15 +103,14 @@ void JSGlobalObject::init(JSObject* thisValue)
     
     structure()->disableSpecificFunctionTracking();
 
-    d()->globalData = Heap::heap(this)->globalData();
-    d()->globalData->globalObjects.set(this, this);
-    d()->globalScopeChain = ScopeChain(this, d()->globalData.get(), this, thisValue);
+    m_globalData = Heap::heap(this)->globalData();
+    m_globalScopeChain.set(*m_globalData, this, new (m_globalData.get()) ScopeChainNode(0, this, m_globalData.get(), this, thisValue));
 
-    JSGlobalObject::globalExec()->init(0, 0, d()->globalScopeChain.node(), CallFrame::noCaller(), 0, 0);
+    JSGlobalObject::globalExec()->init(0, 0, m_globalScopeChain.get(), CallFrame::noCaller(), 0, 0);
 
-    d()->debugger = 0;
+    m_debugger = 0;
 
-    d()->profileGroup = 0;
+    m_profileGroup = 0;
 
     reset(prototype());
 }
@@ -135,7 +119,7 @@ void JSGlobalObject::put(ExecState* exec, const Identifier& propertyName, JSValu
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
-    if (symbolTablePut(propertyName, value))
+    if (symbolTablePut(exec->globalData(), propertyName, value))
         return;
     JSVariableObject::put(exec, propertyName, value, slot);
 }
@@ -144,14 +128,14 @@ void JSGlobalObject::putWithAttributes(ExecState* exec, const Identifier& proper
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
-    if (symbolTablePutWithAttributes(propertyName, value, attributes))
+    if (symbolTablePutWithAttributes(exec->globalData(), propertyName, value, attributes))
         return;
 
-    JSValue valueBefore = getDirect(propertyName);
+    JSValue valueBefore = getDirect(exec->globalData(), propertyName);
     PutPropertySlot slot;
     JSVariableObject::put(exec, propertyName, value, slot);
     if (!valueBefore) {
-        JSValue valueAfter = getDirect(propertyName);
+        JSValue valueAfter = getDirect(exec->globalData(), propertyName);
         if (valueAfter)
             JSObject::putWithAttributes(exec, propertyName, valueAfter, attributes);
     }
@@ -185,81 +169,80 @@ void JSGlobalObject::reset(JSValue prototype)
 
     // Prototypes
 
-    d()->functionPrototype.set(exec->globalData(), this, new (exec) FunctionPrototype(exec, this, FunctionPrototype::createStructure(jsNull()))); // The real prototype will be set once ObjectPrototype is created.
-    d()->prototypeFunctionStructure = PrototypeFunction::createStructure(d()->functionPrototype.get());
-    d()->internalFunctionStructure = InternalFunction::createStructure(d()->functionPrototype.get());
-    NativeFunctionWrapper* callFunction = 0;
-    NativeFunctionWrapper* applyFunction = 0;
-    d()->functionPrototype->addFunctionProperties(exec, this, d()->prototypeFunctionStructure.get(), &callFunction, &applyFunction);
-    d()->callFunction.set(exec->globalData(), this, callFunction);
-    d()->applyFunction.set(exec->globalData(), this, applyFunction);
-    d()->objectPrototype.set(exec->globalData(), this, new (exec) ObjectPrototype(exec, this, ObjectPrototype::createStructure(jsNull()), d()->prototypeFunctionStructure.get()));
-    d()->functionPrototype->structure()->setPrototypeWithoutTransition(d()->objectPrototype.get());
+    m_functionPrototype.set(exec->globalData(), this, new (exec) FunctionPrototype(exec, this, FunctionPrototype::createStructure(exec->globalData(), jsNull()))); // The real prototype will be set once ObjectPrototype is created.
+    m_functionStructure.set(exec->globalData(), this, JSFunction::createStructure(exec->globalData(), m_functionPrototype.get()));
+    m_internalFunctionStructure.set(exec->globalData(), this, InternalFunction::createStructure(exec->globalData(), m_functionPrototype.get()));
+    JSFunction* callFunction = 0;
+    JSFunction* applyFunction = 0;
+    m_functionPrototype->addFunctionProperties(exec, this, m_functionStructure.get(), &callFunction, &applyFunction);
+    m_callFunction.set(exec->globalData(), this, callFunction);
+    m_applyFunction.set(exec->globalData(), this, applyFunction);
+    m_objectPrototype.set(exec->globalData(), this, new (exec) ObjectPrototype(exec, this, ObjectPrototype::createStructure(exec->globalData(), jsNull()), m_functionStructure.get()));
+    m_functionPrototype->structure()->setPrototypeWithoutTransition(exec->globalData(), m_objectPrototype.get());
 
-    d()->emptyObjectStructure = d()->objectPrototype->inheritorID();
+    m_emptyObjectStructure.set(exec->globalData(), this, m_objectPrototype->inheritorID(exec->globalData()));
 
-    d()->functionStructure = JSFunction::createStructure(d()->functionPrototype.get());
-    d()->callbackFunctionStructure = JSCallbackFunction::createStructure(d()->functionPrototype.get());
-    d()->argumentsStructure = Arguments::createStructure(d()->objectPrototype.get());
-    d()->callbackConstructorStructure = JSCallbackConstructor::createStructure(d()->objectPrototype.get());
-    d()->callbackObjectStructure = JSCallbackObject<JSObjectWithGlobalObject>::createStructure(d()->objectPrototype.get());
+    m_callbackFunctionStructure.set(exec->globalData(), this, JSCallbackFunction::createStructure(exec->globalData(), m_functionPrototype.get()));
+    m_argumentsStructure.set(exec->globalData(), this, Arguments::createStructure(exec->globalData(), m_objectPrototype.get()));
+    m_callbackConstructorStructure.set(exec->globalData(), this, JSCallbackConstructor::createStructure(exec->globalData(), m_objectPrototype.get()));
+    m_callbackObjectStructure.set(exec->globalData(), this, JSCallbackObject<JSObjectWithGlobalObject>::createStructure(exec->globalData(), m_objectPrototype.get()));
 
-    d()->arrayPrototype.set(exec->globalData(), this, new (exec) ArrayPrototype(this, ArrayPrototype::createStructure(d()->objectPrototype.get())));
-    d()->arrayStructure = JSArray::createStructure(d()->arrayPrototype.get());
-    d()->regExpMatchesArrayStructure = RegExpMatchesArray::createStructure(d()->arrayPrototype.get());
+    m_arrayPrototype.set(exec->globalData(), this, new (exec) ArrayPrototype(this, ArrayPrototype::createStructure(exec->globalData(), m_objectPrototype.get())));
+    m_arrayStructure.set(exec->globalData(), this, JSArray::createStructure(exec->globalData(), m_arrayPrototype.get()));
+    m_regExpMatchesArrayStructure.set(exec->globalData(), this, RegExpMatchesArray::createStructure(exec->globalData(), m_arrayPrototype.get()));
 
-    d()->stringPrototype.set(exec->globalData(), this, new (exec) StringPrototype(exec, this, StringPrototype::createStructure(d()->objectPrototype.get())));
-    d()->stringObjectStructure = StringObject::createStructure(d()->stringPrototype.get());
+    m_stringPrototype.set(exec->globalData(), this, new (exec) StringPrototype(exec, this, StringPrototype::createStructure(exec->globalData(), m_objectPrototype.get())));
+    m_stringObjectStructure.set(exec->globalData(), this, StringObject::createStructure(exec->globalData(), m_stringPrototype.get()));
 
-    d()->booleanPrototype.set(exec->globalData(), this, new (exec) BooleanPrototype(exec, this, BooleanPrototype::createStructure(d()->objectPrototype.get()), d()->prototypeFunctionStructure.get()));
-    d()->booleanObjectStructure = BooleanObject::createStructure(d()->booleanPrototype.get());
+    m_booleanPrototype.set(exec->globalData(), this, new (exec) BooleanPrototype(exec, this, BooleanPrototype::createStructure(exec->globalData(), m_objectPrototype.get()), m_functionStructure.get()));
+    m_booleanObjectStructure.set(exec->globalData(), this, BooleanObject::createStructure(exec->globalData(), m_booleanPrototype.get()));
 
-    d()->numberPrototype.set(exec->globalData(), this, new (exec) NumberPrototype(exec, this, NumberPrototype::createStructure(d()->objectPrototype.get()), d()->prototypeFunctionStructure.get()));
-    d()->numberObjectStructure = NumberObject::createStructure(d()->numberPrototype.get());
+    m_numberPrototype.set(exec->globalData(), this, new (exec) NumberPrototype(exec, this, NumberPrototype::createStructure(exec->globalData(), m_objectPrototype.get()), m_functionStructure.get()));
+    m_numberObjectStructure.set(exec->globalData(), this, NumberObject::createStructure(exec->globalData(), m_numberPrototype.get()));
 
-    d()->datePrototype.set(exec->globalData(), this, new (exec) DatePrototype(exec, this, DatePrototype::createStructure(d()->objectPrototype.get())));
-    d()->dateStructure = DateInstance::createStructure(d()->datePrototype.get());
+    m_datePrototype.set(exec->globalData(), this, new (exec) DatePrototype(exec, this, DatePrototype::createStructure(exec->globalData(), m_objectPrototype.get())));
+    m_dateStructure.set(exec->globalData(), this, DateInstance::createStructure(exec->globalData(), m_datePrototype.get()));
 
-    d()->regExpPrototype.set(exec->globalData(), this, new (exec) RegExpPrototype(exec, this, RegExpPrototype::createStructure(d()->objectPrototype.get()), d()->prototypeFunctionStructure.get()));
-    d()->regExpStructure = RegExpObject::createStructure(d()->regExpPrototype.get());
+    m_regExpPrototype.set(exec->globalData(), this, new (exec) RegExpPrototype(exec, this, RegExpPrototype::createStructure(exec->globalData(), m_objectPrototype.get()), m_functionStructure.get()));
+    m_regExpStructure.set(exec->globalData(), this, RegExpObject::createStructure(exec->globalData(), m_regExpPrototype.get()));
 
-    d()->methodCallDummy.set(exec->globalData(), this, constructEmptyObject(exec));
+    m_methodCallDummy.set(exec->globalData(), this, constructEmptyObject(exec));
 
-    ErrorPrototype* errorPrototype = new (exec) ErrorPrototype(exec, this, ErrorPrototype::createStructure(d()->objectPrototype.get()), d()->prototypeFunctionStructure.get());
-    d()->errorStructure = ErrorInstance::createStructure(errorPrototype);
+    ErrorPrototype* errorPrototype = new (exec) ErrorPrototype(exec, this, ErrorPrototype::createStructure(exec->globalData(), m_objectPrototype.get()), m_functionStructure.get());
+    m_errorStructure.set(exec->globalData(), this, ErrorInstance::createStructure(exec->globalData(), errorPrototype));
 
     // Constructors
 
-    JSCell* objectConstructor = new (exec) ObjectConstructor(exec, this, ObjectConstructor::createStructure(d()->functionPrototype.get()), d()->objectPrototype.get(), d()->prototypeFunctionStructure.get());
-    JSCell* functionConstructor = new (exec) FunctionConstructor(exec, this, FunctionConstructor::createStructure(d()->functionPrototype.get()), d()->functionPrototype.get());
-    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, this, ArrayConstructor::createStructure(d()->functionPrototype.get()), d()->arrayPrototype.get(), d()->prototypeFunctionStructure.get());
-    JSCell* stringConstructor = new (exec) StringConstructor(exec, this, StringConstructor::createStructure(d()->functionPrototype.get()), d()->prototypeFunctionStructure.get(), d()->stringPrototype.get());
-    JSCell* booleanConstructor = new (exec) BooleanConstructor(exec, this, BooleanConstructor::createStructure(d()->functionPrototype.get()), d()->booleanPrototype.get());
-    JSCell* numberConstructor = new (exec) NumberConstructor(exec, this, NumberConstructor::createStructure(d()->functionPrototype.get()), d()->numberPrototype.get());
-    JSCell* dateConstructor = new (exec) DateConstructor(exec, this, DateConstructor::createStructure(d()->functionPrototype.get()), d()->prototypeFunctionStructure.get(), d()->datePrototype.get());
-
-    d()->regExpConstructor.set(exec->globalData(), this, new (exec) RegExpConstructor(exec, this, RegExpConstructor::createStructure(d()->functionPrototype.get()), d()->regExpPrototype.get()));
-
-    d()->errorConstructor.set(exec->globalData(), this, new (exec) ErrorConstructor(exec, this, ErrorConstructor::createStructure(d()->functionPrototype.get()), errorPrototype));
-
-    RefPtr<Structure> nativeErrorPrototypeStructure = NativeErrorPrototype::createStructure(errorPrototype);
-    RefPtr<Structure> nativeErrorStructure = NativeErrorConstructor::createStructure(d()->functionPrototype.get());
-    d()->evalErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "EvalError"));
-    d()->rangeErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "RangeError"));
-    d()->referenceErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "ReferenceError"));
-    d()->syntaxErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "SyntaxError"));
-    d()->typeErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "TypeError"));
-    d()->URIErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "URIError"));
-
-    d()->objectPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, objectConstructor, DontEnum);
-    d()->functionPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, functionConstructor, DontEnum);
-    d()->arrayPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, arrayConstructor, DontEnum);
-    d()->booleanPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, booleanConstructor, DontEnum);
-    d()->stringPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, stringConstructor, DontEnum);
-    d()->numberPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, numberConstructor, DontEnum);
-    d()->datePrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, dateConstructor, DontEnum);
-    d()->regExpPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, d()->regExpConstructor.get(), DontEnum);
-    errorPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, d()->errorConstructor.get(), DontEnum);
+    JSCell* objectConstructor = new (exec) ObjectConstructor(exec, this, ObjectConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_objectPrototype.get());
+    JSCell* functionConstructor = new (exec) FunctionConstructor(exec, this, FunctionConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_functionPrototype.get());
+    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, this, ArrayConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_arrayPrototype.get(), m_functionStructure.get());
+    JSCell* stringConstructor = new (exec) StringConstructor(exec, this, StringConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_functionStructure.get(), m_stringPrototype.get());
+    JSCell* booleanConstructor = new (exec) BooleanConstructor(exec, this, BooleanConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_booleanPrototype.get());
+    JSCell* numberConstructor = new (exec) NumberConstructor(exec, this, NumberConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_numberPrototype.get());
+    JSCell* dateConstructor = new (exec) DateConstructor(exec, this, DateConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_functionStructure.get(), m_datePrototype.get());
+
+    m_regExpConstructor.set(exec->globalData(), this, new (exec) RegExpConstructor(exec, this, RegExpConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), m_regExpPrototype.get()));
+
+    m_errorConstructor.set(exec->globalData(), this, new (exec) ErrorConstructor(exec, this, ErrorConstructor::createStructure(exec->globalData(), m_functionPrototype.get()), errorPrototype));
+
+    Structure* nativeErrorPrototypeStructure = NativeErrorPrototype::createStructure(exec->globalData(), errorPrototype);
+    Structure* nativeErrorStructure = NativeErrorConstructor::createStructure(exec->globalData(), m_functionPrototype.get());
+    m_evalErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "EvalError"));
+    m_rangeErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "RangeError"));
+    m_referenceErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "ReferenceError"));
+    m_syntaxErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "SyntaxError"));
+    m_typeErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "TypeError"));
+    m_URIErrorConstructor.set(exec->globalData(), this, new (exec) NativeErrorConstructor(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "URIError"));
+
+    m_objectPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, objectConstructor, DontEnum);
+    m_functionPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, functionConstructor, DontEnum);
+    m_arrayPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, arrayConstructor, DontEnum);
+    m_booleanPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, booleanConstructor, DontEnum);
+    m_stringPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, stringConstructor, DontEnum);
+    m_numberPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, numberConstructor, DontEnum);
+    m_datePrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, dateConstructor, DontEnum);
+    m_regExpPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, m_regExpConstructor.get(), DontEnum);
+    errorPrototype->putDirectFunctionWithoutTransition(exec->globalData(), exec->propertyNames().constructor, m_errorConstructor.get(), DontEnum);
 
     // Set global constructors
 
@@ -272,121 +255,118 @@ void JSGlobalObject::reset(JSValue prototype)
     putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "String"), stringConstructor, DontEnum);
     putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Number"), numberConstructor, DontEnum);
     putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Date"), dateConstructor, DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "RegExp"), d()->regExpConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Error"), d()->errorConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "EvalError"), d()->evalErrorConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "RangeError"), d()->rangeErrorConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "ReferenceError"), d()->referenceErrorConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "SyntaxError"), d()->syntaxErrorConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "TypeError"), d()->typeErrorConstructor.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "URIError"), d()->URIErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "RegExp"), m_regExpConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "Error"), m_errorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "EvalError"), m_evalErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "RangeError"), m_rangeErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "ReferenceError"), m_referenceErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "SyntaxError"), m_syntaxErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "TypeError"), m_typeErrorConstructor.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec->globalData(), Identifier(exec, "URIError"), m_URIErrorConstructor.get(), DontEnum);
 
     // Set global values.
     GlobalPropertyInfo staticGlobals[] = {
-        GlobalPropertyInfo(Identifier(exec, "Math"), new (exec) MathObject(exec, this, MathObject::createStructure(d()->objectPrototype.get())), DontEnum | DontDelete),
+        GlobalPropertyInfo(Identifier(exec, "Math"), new (exec) MathObject(exec, this, MathObject::createStructure(exec->globalData(), m_objectPrototype.get())), DontEnum | DontDelete),
         GlobalPropertyInfo(Identifier(exec, "NaN"), jsNaN(), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(exec, "Infinity"), jsNumber(Inf), DontEnum | DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(exec, "undefined"), jsUndefined(), DontEnum | DontDelete | ReadOnly),
-        GlobalPropertyInfo(Identifier(exec, "JSON"), new (exec) JSONObject(this, JSONObject::createStructure(d()->objectPrototype.get())), DontEnum | DontDelete)
+        GlobalPropertyInfo(Identifier(exec, "JSON"), new (exec) JSONObject(this, JSONObject::createStructure(exec->globalData(), m_objectPrototype.get())), DontEnum | DontDelete)
     };
 
     addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
 
     // Set global functions.
 
-    d()->evalFunction.set(exec->globalData(), this, new (exec) GlobalEvalFunction(exec, this, GlobalEvalFunction::createStructure(d()->functionPrototype.get()), 1, exec->propertyNames().eval, globalFuncEval, this));
-    putDirectFunctionWithoutTransition(exec, d()->evalFunction.get(), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 2, Identifier(exec, "parseInt"), globalFuncParseInt), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "parseFloat"), globalFuncParseFloat), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isNaN"), globalFuncIsNaN), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isFinite"), globalFuncIsFinite), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "escape"), globalFuncEscape), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "unescape"), globalFuncUnescape), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURI"), globalFuncDecodeURI), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURIComponent"), globalFuncDecodeURIComponent), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURI"), globalFuncEncodeURI), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURIComponent"), globalFuncEncodeURIComponent), DontEnum);
+    m_evalFunction.set(exec->globalData(), this, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, exec->propertyNames().eval, globalFuncEval));
+    putDirectFunctionWithoutTransition(exec, m_evalFunction.get(), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 2, Identifier(exec, "parseInt"), globalFuncParseInt), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "parseFloat"), globalFuncParseFloat), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "isNaN"), globalFuncIsNaN), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "isFinite"), globalFuncIsFinite), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "escape"), globalFuncEscape), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "unescape"), globalFuncUnescape), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "decodeURI"), globalFuncDecodeURI), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "decodeURIComponent"), globalFuncDecodeURIComponent), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "encodeURI"), globalFuncEncodeURI), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "encodeURIComponent"), globalFuncEncodeURIComponent), DontEnum);
 #ifndef NDEBUG
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, this, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "jscprint"), globalFuncJSCPrint), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, this, m_functionStructure.get(), 1, Identifier(exec, "jscprint"), globalFuncJSCPrint), DontEnum);
 #endif
 
-    resetPrototype(prototype);
+    resetPrototype(exec->globalData(), prototype);
 }
 
 // Set prototype, and also insert the object prototype at the end of the chain.
-void JSGlobalObject::resetPrototype(JSValue prototype)
+void JSGlobalObject::resetPrototype(JSGlobalData& globalData, JSValue prototype)
 {
-    setPrototype(prototype);
+    setPrototype(globalData, prototype);
 
     JSObject* oldLastInPrototypeChain = lastInPrototypeChain(this);
-    JSObject* objectPrototype = d()->objectPrototype.get();
+    JSObject* objectPrototype = m_objectPrototype.get();
     if (oldLastInPrototypeChain != objectPrototype)
-        oldLastInPrototypeChain->setPrototype(objectPrototype);
+        oldLastInPrototypeChain->setPrototype(globalData, objectPrototype);
 }
 
 void JSGlobalObject::markChildren(MarkStack& markStack)
 {
     JSVariableObject::markChildren(markStack);
-    
-    markIfNeeded(markStack, &d()->regExpConstructor);
-    markIfNeeded(markStack, &d()->errorConstructor);
-    markIfNeeded(markStack, &d()->evalErrorConstructor);
-    markIfNeeded(markStack, &d()->rangeErrorConstructor);
-    markIfNeeded(markStack, &d()->referenceErrorConstructor);
-    markIfNeeded(markStack, &d()->syntaxErrorConstructor);
-    markIfNeeded(markStack, &d()->typeErrorConstructor);
-    markIfNeeded(markStack, &d()->URIErrorConstructor);
-
-    markIfNeeded(markStack, &d()->evalFunction);
-    markIfNeeded(markStack, &d()->callFunction);
-    markIfNeeded(markStack, &d()->applyFunction);
-
-    markIfNeeded(markStack, &d()->objectPrototype);
-    markIfNeeded(markStack, &d()->functionPrototype);
-    markIfNeeded(markStack, &d()->arrayPrototype);
-    markIfNeeded(markStack, &d()->booleanPrototype);
-    markIfNeeded(markStack, &d()->stringPrototype);
-    markIfNeeded(markStack, &d()->numberPrototype);
-    markIfNeeded(markStack, &d()->datePrototype);
-    markIfNeeded(markStack, &d()->regExpPrototype);
-
-    markIfNeeded(markStack, &d()->methodCallDummy);
-
-    markIfNeeded(markStack, d()->errorStructure);
-    markIfNeeded(markStack, d()->argumentsStructure);
-    markIfNeeded(markStack, d()->arrayStructure);
-    markIfNeeded(markStack, d()->booleanObjectStructure);
-    markIfNeeded(markStack, d()->callbackConstructorStructure);
-    markIfNeeded(markStack, d()->callbackFunctionStructure);
-    markIfNeeded(markStack, d()->callbackObjectStructure);
-    markIfNeeded(markStack, d()->dateStructure);
-    markIfNeeded(markStack, d()->emptyObjectStructure);
-    markIfNeeded(markStack, d()->errorStructure);
-    markIfNeeded(markStack, d()->functionStructure);
-    markIfNeeded(markStack, d()->numberObjectStructure);
-    markIfNeeded(markStack, d()->prototypeFunctionStructure);
-    markIfNeeded(markStack, d()->regExpMatchesArrayStructure);
-    markIfNeeded(markStack, d()->regExpStructure);
-    markIfNeeded(markStack, d()->stringObjectStructure);
-
-    // No need to mark the other structures, because their prototypes are all
-    // guaranteed to be referenced elsewhere.
-
-    if (d()->registerArray) {
+
+    markIfNeeded(markStack, &m_globalScopeChain);
+    markIfNeeded(markStack, &m_methodCallDummy);
+
+    markIfNeeded(markStack, &m_regExpConstructor);
+    markIfNeeded(markStack, &m_errorConstructor);
+    markIfNeeded(markStack, &m_evalErrorConstructor);
+    markIfNeeded(markStack, &m_rangeErrorConstructor);
+    markIfNeeded(markStack, &m_referenceErrorConstructor);
+    markIfNeeded(markStack, &m_syntaxErrorConstructor);
+    markIfNeeded(markStack, &m_typeErrorConstructor);
+    markIfNeeded(markStack, &m_URIErrorConstructor);
+
+    markIfNeeded(markStack, &m_evalFunction);
+    markIfNeeded(markStack, &m_callFunction);
+    markIfNeeded(markStack, &m_applyFunction);
+
+    markIfNeeded(markStack, &m_objectPrototype);
+    markIfNeeded(markStack, &m_functionPrototype);
+    markIfNeeded(markStack, &m_arrayPrototype);
+    markIfNeeded(markStack, &m_booleanPrototype);
+    markIfNeeded(markStack, &m_stringPrototype);
+    markIfNeeded(markStack, &m_numberPrototype);
+    markIfNeeded(markStack, &m_datePrototype);
+    markIfNeeded(markStack, &m_regExpPrototype);
+
+    markIfNeeded(markStack, &m_argumentsStructure);
+    markIfNeeded(markStack, &m_arrayStructure);
+    markIfNeeded(markStack, &m_booleanObjectStructure);
+    markIfNeeded(markStack, &m_callbackConstructorStructure);
+    markIfNeeded(markStack, &m_callbackFunctionStructure);
+    markIfNeeded(markStack, &m_callbackObjectStructure);
+    markIfNeeded(markStack, &m_dateStructure);
+    markIfNeeded(markStack, &m_emptyObjectStructure);
+    markIfNeeded(markStack, &m_errorStructure);
+    markIfNeeded(markStack, &m_functionStructure);
+    markIfNeeded(markStack, &m_numberObjectStructure);
+    markIfNeeded(markStack, &m_regExpMatchesArrayStructure);
+    markIfNeeded(markStack, &m_regExpStructure);
+    markIfNeeded(markStack, &m_stringObjectStructure);
+    markIfNeeded(markStack, &m_internalFunctionStructure);
+
+    if (m_registerArray) {
         // Outside the execution of global code, when our variables are torn off,
         // we can mark the torn-off array.
-        markStack.deprecatedAppendValues(d()->registerArray.get(), d()->registerArraySize);
-    } else if (d()->registers) {
+        markStack.appendValues(m_registerArray.get(), m_registerArraySize);
+    } else if (m_registers) {
         // During execution of global code, when our variables are in the register file,
         // the symbol table tells us how many variables there are, and registers
         // points to where they end, and the registers used for execution begin.
-        markStack.deprecatedAppendValues(d()->registers - symbolTable().size(), symbolTable().size());
+        markStack.appendValues(m_registers - symbolTable().size(), symbolTable().size());
     }
 }
 
 ExecState* JSGlobalObject::globalExec()
 {
-    return CallFrame::create(d()->globalCallFrame + RegisterFile::CallFrameHeaderSize);
+    return CallFrame::create(m_globalCallFrame + RegisterFile::CallFrameHeaderSize);
 }
 
 bool JSGlobalObject::isDynamicScope(bool&) const
@@ -396,17 +376,17 @@ bool JSGlobalObject::isDynamicScope(bool&) const
 
 void JSGlobalObject::copyGlobalsFrom(RegisterFile& registerFile)
 {
-    ASSERT(!d()->registerArray);
-    ASSERT(!d()->registerArraySize);
+    ASSERT(!m_registerArray);
+    ASSERT(!m_registerArraySize);
 
     int numGlobals = registerFile.numGlobals();
     if (!numGlobals) {
-        d()->registers = 0;
+        m_registers = 0;
         return;
     }
 
-    OwnArrayPtr<Register> registerArray = copyRegisterArray(registerFile.lastGlobal(), numGlobals);
-    Register* registers = registerArray.get() + numGlobals;
+    OwnArrayPtr<WriteBarrier<Unknown> > registerArray = copyRegisterArray(globalData(), reinterpret_cast<WriteBarrier<Unknown>*>(registerFile.lastGlobal()), numGlobals, numGlobals);
+    WriteBarrier<Unknown>* registers = registerArray.get() + numGlobals;
     setRegisters(registers, registerArray.release(), numGlobals);
 }
 
@@ -419,37 +399,55 @@ void JSGlobalObject::copyGlobalsTo(RegisterFile& registerFile)
     registerFile.setGlobalObject(this);
     registerFile.setNumGlobals(symbolTable().size());
 
-    if (d()->registerArray) {
-        memcpy(registerFile.start() - d()->registerArraySize, d()->registerArray.get(), d()->registerArraySize * sizeof(Register));
-        setRegisters(registerFile.start(), 0, 0);
+    if (m_registerArray) {
+        // The register file is always a gc root so no barrier is needed here
+        memcpy(registerFile.start() - m_registerArraySize, m_registerArray.get(), m_registerArraySize * sizeof(WriteBarrier<Unknown>));
+        setRegisters(reinterpret_cast<WriteBarrier<Unknown>*>(registerFile.start()), nullptr, 0);
     }
 }
 
-void* JSGlobalObject::operator new(size_t size, JSGlobalData* globalData)
+void JSGlobalObject::resizeRegisters(int oldSize, int newSize)
 {
-    return globalData->heap.allocate(size);
+    ASSERT(oldSize <= newSize);
+    if (newSize == oldSize)
+        return;
+    ASSERT(newSize && newSize > oldSize);
+    if (m_registerArray || !m_registers) {
+        ASSERT(static_cast<size_t>(oldSize) == m_registerArraySize);
+        OwnArrayPtr<WriteBarrier<Unknown> > registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[newSize]);
+        for (int i = 0; i < oldSize; i++)
+            registerArray[newSize - oldSize + i].set(globalData(), this, m_registerArray[i].get());
+        WriteBarrier<Unknown>* registers = registerArray.get() + newSize;
+        setRegisters(registers, registerArray.release(), newSize);
+    } else {
+        ASSERT(static_cast<size_t>(newSize) < globalData().interpreter->registerFile().maxGlobals());
+        globalData().interpreter->registerFile().setNumGlobals(newSize);
+    }
+
+    for (int i = -newSize; i < -oldSize; ++i)
+        m_registers[i].setUndefined();
 }
 
-void JSGlobalObject::destroyJSGlobalObjectData(void* jsGlobalObjectData)
+void* JSGlobalObject::operator new(size_t size, JSGlobalData* globalData)
 {
-    delete static_cast<JSGlobalObjectData*>(jsGlobalObjectData);
+    return globalData->heap.allocate(size);
 }
 
-DynamicGlobalObjectScope::DynamicGlobalObjectScope(CallFrame* callFrame, JSGlobalObject* dynamicGlobalObject)
-    : m_dynamicGlobalObjectSlot(callFrame->globalData().dynamicGlobalObject)
+DynamicGlobalObjectScope::DynamicGlobalObjectScope(JSGlobalData& globalData, JSGlobalObject* dynamicGlobalObject)
+    : m_dynamicGlobalObjectSlot(globalData.dynamicGlobalObject)
     , m_savedDynamicGlobalObject(m_dynamicGlobalObjectSlot)
 {
     if (!m_dynamicGlobalObjectSlot) {
 #if ENABLE(ASSEMBLER)
         if (ExecutableAllocator::underMemoryPressure())
-            callFrame->globalData().recompileAllJSFunctions();
+            globalData.recompileAllJSFunctions();
 #endif
 
         m_dynamicGlobalObjectSlot = dynamicGlobalObject;
 
         // Reset the date cache between JS invocations to force the VM
         // to observe time zone changes.
-        callFrame->globalData().resetDateCache();
+        globalData.resetDateCache();
     }
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index d13d2da..0e36920 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -26,9 +26,9 @@
 #include "JSGlobalData.h"
 #include "JSVariableObject.h"
 #include "JSWeakObjectMapRefInternal.h"
-#include "NativeFunctionWrapper.h"
 #include "NumberPrototype.h"
 #include "StringPrototype.h"
+#include "StructureChain.h"
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RandomNumber.h>
@@ -42,10 +42,8 @@ namespace JSC {
     class ErrorConstructor;
     class FunctionPrototype;
     class GlobalCodeBlock;
-    class GlobalEvalFunction;
     class NativeErrorConstructor;
     class ProgramCodeBlock;
-    class PrototypeFunction;
     class RegExpConstructor;
     class RegExpPrototype;
     class RegisterFile;
@@ -57,101 +55,81 @@ namespace JSC {
     
     class JSGlobalObject : public JSVariableObject {
     protected:
-        using JSVariableObject::JSVariableObjectData;
         typedef HashSet<RefPtr<OpaqueJSWeakObjectMap> > WeakMapSet;
 
-        struct JSGlobalObjectData : public JSVariableObjectData {
-            // We use an explicit destructor function pointer instead of a
-            // virtual destructor because we want to avoid adding a vtable
-            // pointer to this struct. Adding a vtable pointer would force the
-            // compiler to emit costly pointer fixup code when casting from
-            // JSVariableObjectData* to JSGlobalObjectData*.
-            typedef void (*Destructor)(void*);
-
-            JSGlobalObjectData(Destructor destructor)
-                : JSVariableObjectData(&symbolTable, 0)
-                , destructor(destructor)
-                , registerArraySize(0)
-                , globalScopeChain(NoScopeChain())
-                , weakRandom(static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
-            {
-            }
-            
-            Destructor destructor;
-            
-            size_t registerArraySize;
-
-            JSGlobalObject* next;
-            JSGlobalObject* prev;
-
-            Debugger* debugger;
-            
-            ScopeChain globalScopeChain;
-            Register globalCallFrame[RegisterFile::CallFrameHeaderSize];
-
-            WriteBarrier<RegExpConstructor> regExpConstructor;
-            WriteBarrier<ErrorConstructor> errorConstructor;
-            WriteBarrier<NativeErrorConstructor> evalErrorConstructor;
-            WriteBarrier<NativeErrorConstructor> rangeErrorConstructor;
-            WriteBarrier<NativeErrorConstructor> referenceErrorConstructor;
-            WriteBarrier<NativeErrorConstructor> syntaxErrorConstructor;
-            WriteBarrier<NativeErrorConstructor> typeErrorConstructor;
-            WriteBarrier<NativeErrorConstructor> URIErrorConstructor;
-
-            WriteBarrier<GlobalEvalFunction> evalFunction;
-            WriteBarrier<NativeFunctionWrapper> callFunction;
-            WriteBarrier<NativeFunctionWrapper> applyFunction;
-
-            WriteBarrier<ObjectPrototype> objectPrototype;
-            WriteBarrier<FunctionPrototype> functionPrototype;
-            WriteBarrier<ArrayPrototype> arrayPrototype;
-            WriteBarrier<BooleanPrototype> booleanPrototype;
-            WriteBarrier<StringPrototype> stringPrototype;
-            WriteBarrier<NumberPrototype> numberPrototype;
-            WriteBarrier<DatePrototype> datePrototype;
-            WriteBarrier<RegExpPrototype> regExpPrototype;
-
-            WriteBarrier<JSObject> methodCallDummy;
-
-            RefPtr<Structure> argumentsStructure;
-            RefPtr<Structure> arrayStructure;
-            RefPtr<Structure> booleanObjectStructure;
-            RefPtr<Structure> callbackConstructorStructure;
-            RefPtr<Structure> callbackFunctionStructure;
-            RefPtr<Structure> callbackObjectStructure;
-            RefPtr<Structure> dateStructure;
-            RefPtr<Structure> emptyObjectStructure;
-            RefPtr<Structure> errorStructure;
-            RefPtr<Structure> functionStructure;
-            RefPtr<Structure> numberObjectStructure;
-            RefPtr<Structure> prototypeFunctionStructure;
-            RefPtr<Structure> regExpMatchesArrayStructure;
-            RefPtr<Structure> regExpStructure;
-            RefPtr<Structure> stringObjectStructure;
-            RefPtr<Structure> internalFunctionStructure;
-
-            SymbolTable symbolTable;
-            unsigned profileGroup;
-
-            RefPtr<JSGlobalData> globalData;
-
-            WeakMapSet weakMaps;
-            WeakRandom weakRandom;
-        };
+        RefPtr<JSGlobalData> m_globalData;
+
+        size_t m_registerArraySize;
+        Register m_globalCallFrame[RegisterFile::CallFrameHeaderSize];
+
+        WriteBarrier<ScopeChainNode> m_globalScopeChain;
+        WriteBarrier<JSObject> m_methodCallDummy;
+
+        WriteBarrier<RegExpConstructor> m_regExpConstructor;
+        WriteBarrier<ErrorConstructor> m_errorConstructor;
+        WriteBarrier<NativeErrorConstructor> m_evalErrorConstructor;
+        WriteBarrier<NativeErrorConstructor> m_rangeErrorConstructor;
+        WriteBarrier<NativeErrorConstructor> m_referenceErrorConstructor;
+        WriteBarrier<NativeErrorConstructor> m_syntaxErrorConstructor;
+        WriteBarrier<NativeErrorConstructor> m_typeErrorConstructor;
+        WriteBarrier<NativeErrorConstructor> m_URIErrorConstructor;
+
+        WriteBarrier<JSFunction> m_evalFunction;
+        WriteBarrier<JSFunction> m_callFunction;
+        WriteBarrier<JSFunction> m_applyFunction;
+
+        WriteBarrier<ObjectPrototype> m_objectPrototype;
+        WriteBarrier<FunctionPrototype> m_functionPrototype;
+        WriteBarrier<ArrayPrototype> m_arrayPrototype;
+        WriteBarrier<BooleanPrototype> m_booleanPrototype;
+        WriteBarrier<StringPrototype> m_stringPrototype;
+        WriteBarrier<NumberPrototype> m_numberPrototype;
+        WriteBarrier<DatePrototype> m_datePrototype;
+        WriteBarrier<RegExpPrototype> m_regExpPrototype;
+
+        WriteBarrier<Structure> m_argumentsStructure;
+        WriteBarrier<Structure> m_arrayStructure;
+        WriteBarrier<Structure> m_booleanObjectStructure;
+        WriteBarrier<Structure> m_callbackConstructorStructure;
+        WriteBarrier<Structure> m_callbackFunctionStructure;
+        WriteBarrier<Structure> m_callbackObjectStructure;
+        WriteBarrier<Structure> m_dateStructure;
+        WriteBarrier<Structure> m_emptyObjectStructure;
+        WriteBarrier<Structure> m_errorStructure;
+        WriteBarrier<Structure> m_functionStructure;
+        WriteBarrier<Structure> m_numberObjectStructure;
+        WriteBarrier<Structure> m_regExpMatchesArrayStructure;
+        WriteBarrier<Structure> m_regExpStructure;
+        WriteBarrier<Structure> m_stringObjectStructure;
+        WriteBarrier<Structure> m_internalFunctionStructure;
+
+        unsigned m_profileGroup;
+        Debugger* m_debugger;
+
+        WeakMapSet m_weakMaps;
+        WeakRandom m_weakRandom;
+
+        SymbolTable m_symbolTable;
 
     public:
         void* operator new(size_t, JSGlobalData*);
         
-        explicit JSGlobalObject()
-            : JSVariableObject(JSGlobalObject::createStructure(jsNull()), new JSGlobalObjectData(destroyJSGlobalObjectData))
+        explicit JSGlobalObject(JSGlobalData& globalData)
+            : JSVariableObject(globalData, JSGlobalObject::createStructure(globalData, jsNull()), &m_symbolTable, 0)
+            , m_registerArraySize(0)
+            , m_globalScopeChain()
+            , m_weakRandom(static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
         {
             COMPILE_ASSERT(JSGlobalObject::AnonymousSlotCount == 1, JSGlobalObject_has_only_a_single_slot);
             putThisToAnonymousValue(0);
             init(this);
         }
         
-        explicit JSGlobalObject(NonNullPassRefPtr<Structure> structure)
-            : JSVariableObject(structure, new JSGlobalObjectData(destroyJSGlobalObjectData))
+        explicit JSGlobalObject(JSGlobalData& globalData, Structure* structure)
+            : JSVariableObject(globalData, structure, &m_symbolTable, 0)
+            , m_registerArraySize(0)
+            , m_globalScopeChain()
+            , m_weakRandom(static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
         {
             COMPILE_ASSERT(JSGlobalObject::AnonymousSlotCount == 1, JSGlobalObject_has_only_a_single_slot);
             putThisToAnonymousValue(0);
@@ -159,8 +137,11 @@ namespace JSC {
         }
 
     protected:
-        JSGlobalObject(NonNullPassRefPtr<Structure> structure, JSGlobalObjectData* data, JSObject* thisValue)
-            : JSVariableObject(structure, data)
+        JSGlobalObject(JSGlobalData& globalData, Structure* structure, JSObject* thisValue)
+            : JSVariableObject(globalData, structure, &m_symbolTable, 0)
+            , m_registerArraySize(0)
+            , m_globalScopeChain()
+            , m_weakRandom(static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
         {
             COMPILE_ASSERT(JSGlobalObject::AnonymousSlotCount == 1, JSGlobalObject_has_only_a_single_slot);
             putThisToAnonymousValue(0);
@@ -181,59 +162,64 @@ namespace JSC {
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunc, unsigned attributes);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunc, unsigned attributes);
 
+        // We use this in the code generator as we perform symbol table
+        // lookups prior to initializing the properties
+        bool symbolTableHasProperty(const Identifier& propertyName);
+
         // The following accessors return pristine values, even if a script 
         // replaces the global object's associated property.
 
-        RegExpConstructor* regExpConstructor() const { return d()->regExpConstructor.get(); }
-
-        ErrorConstructor* errorConstructor() const { return d()->errorConstructor.get(); }
-        NativeErrorConstructor* evalErrorConstructor() const { return d()->evalErrorConstructor.get(); }
-        NativeErrorConstructor* rangeErrorConstructor() const { return d()->rangeErrorConstructor.get(); }
-        NativeErrorConstructor* referenceErrorConstructor() const { return d()->referenceErrorConstructor.get(); }
-        NativeErrorConstructor* syntaxErrorConstructor() const { return d()->syntaxErrorConstructor.get(); }
-        NativeErrorConstructor* typeErrorConstructor() const { return d()->typeErrorConstructor.get(); }
-        NativeErrorConstructor* URIErrorConstructor() const { return d()->URIErrorConstructor.get(); }
-
-        GlobalEvalFunction* evalFunction() const { return d()->evalFunction.get(); }
-
-        ObjectPrototype* objectPrototype() const { return d()->objectPrototype.get(); }
-        FunctionPrototype* functionPrototype() const { return d()->functionPrototype.get(); }
-        ArrayPrototype* arrayPrototype() const { return d()->arrayPrototype.get(); }
-        BooleanPrototype* booleanPrototype() const { return d()->booleanPrototype.get(); }
-        StringPrototype* stringPrototype() const { return d()->stringPrototype.get(); }
-        NumberPrototype* numberPrototype() const { return d()->numberPrototype.get(); }
-        DatePrototype* datePrototype() const { return d()->datePrototype.get(); }
-        RegExpPrototype* regExpPrototype() const { return d()->regExpPrototype.get(); }
-
-        JSObject* methodCallDummy() const { return d()->methodCallDummy.get(); }
-
-        Structure* argumentsStructure() const { return d()->argumentsStructure.get(); }
-        Structure* arrayStructure() const { return d()->arrayStructure.get(); }
-        Structure* booleanObjectStructure() const { return d()->booleanObjectStructure.get(); }
-        Structure* callbackConstructorStructure() const { return d()->callbackConstructorStructure.get(); }
-        Structure* callbackFunctionStructure() const { return d()->callbackFunctionStructure.get(); }
-        Structure* callbackObjectStructure() const { return d()->callbackObjectStructure.get(); }
-        Structure* dateStructure() const { return d()->dateStructure.get(); }
-        Structure* emptyObjectStructure() const { return d()->emptyObjectStructure.get(); }
-        Structure* errorStructure() const { return d()->errorStructure.get(); }
-        Structure* functionStructure() const { return d()->functionStructure.get(); }
-        Structure* numberObjectStructure() const { return d()->numberObjectStructure.get(); }
-        Structure* prototypeFunctionStructure() const { return d()->prototypeFunctionStructure.get(); }
-        Structure* internalFunctionStructure() const { return d()->internalFunctionStructure.get(); }
-        Structure* regExpMatchesArrayStructure() const { return d()->regExpMatchesArrayStructure.get(); }
-        Structure* regExpStructure() const { return d()->regExpStructure.get(); }
-        Structure* stringObjectStructure() const { return d()->stringObjectStructure.get(); }
-
-        void setProfileGroup(unsigned value) { d()->profileGroup = value; }
-        unsigned profileGroup() const { return d()->profileGroup; }
-
-        Debugger* debugger() const { return d()->debugger; }
-        void setDebugger(Debugger* debugger) { d()->debugger = debugger; }
+        RegExpConstructor* regExpConstructor() const { return m_regExpConstructor.get(); }
+
+        ErrorConstructor* errorConstructor() const { return m_errorConstructor.get(); }
+        NativeErrorConstructor* evalErrorConstructor() const { return m_evalErrorConstructor.get(); }
+        NativeErrorConstructor* rangeErrorConstructor() const { return m_rangeErrorConstructor.get(); }
+        NativeErrorConstructor* referenceErrorConstructor() const { return m_referenceErrorConstructor.get(); }
+        NativeErrorConstructor* syntaxErrorConstructor() const { return m_syntaxErrorConstructor.get(); }
+        NativeErrorConstructor* typeErrorConstructor() const { return m_typeErrorConstructor.get(); }
+        NativeErrorConstructor* URIErrorConstructor() const { return m_URIErrorConstructor.get(); }
+
+        JSFunction* evalFunction() const { return m_evalFunction.get(); }
+        JSFunction* callFunction() const { return m_callFunction.get(); }
+        JSFunction* applyFunction() const { return m_applyFunction.get(); }
+
+        ObjectPrototype* objectPrototype() const { return m_objectPrototype.get(); }
+        FunctionPrototype* functionPrototype() const { return m_functionPrototype.get(); }
+        ArrayPrototype* arrayPrototype() const { return m_arrayPrototype.get(); }
+        BooleanPrototype* booleanPrototype() const { return m_booleanPrototype.get(); }
+        StringPrototype* stringPrototype() const { return m_stringPrototype.get(); }
+        NumberPrototype* numberPrototype() const { return m_numberPrototype.get(); }
+        DatePrototype* datePrototype() const { return m_datePrototype.get(); }
+        RegExpPrototype* regExpPrototype() const { return m_regExpPrototype.get(); }
+
+        JSObject* methodCallDummy() const { return m_methodCallDummy.get(); }
+
+        Structure* argumentsStructure() const { return m_argumentsStructure.get(); }
+        Structure* arrayStructure() const { return m_arrayStructure.get(); }
+        Structure* booleanObjectStructure() const { return m_booleanObjectStructure.get(); }
+        Structure* callbackConstructorStructure() const { return m_callbackConstructorStructure.get(); }
+        Structure* callbackFunctionStructure() const { return m_callbackFunctionStructure.get(); }
+        Structure* callbackObjectStructure() const { return m_callbackObjectStructure.get(); }
+        Structure* dateStructure() const { return m_dateStructure.get(); }
+        Structure* emptyObjectStructure() const { return m_emptyObjectStructure.get(); }
+        Structure* errorStructure() const { return m_errorStructure.get(); }
+        Structure* functionStructure() const { return m_functionStructure.get(); }
+        Structure* numberObjectStructure() const { return m_numberObjectStructure.get(); }
+        Structure* internalFunctionStructure() const { return m_internalFunctionStructure.get(); }
+        Structure* regExpMatchesArrayStructure() const { return m_regExpMatchesArrayStructure.get(); }
+        Structure* regExpStructure() const { return m_regExpStructure.get(); }
+        Structure* stringObjectStructure() const { return m_stringObjectStructure.get(); }
+
+        void setProfileGroup(unsigned value) { m_profileGroup = value; }
+        unsigned profileGroup() const { return m_profileGroup; }
+
+        Debugger* debugger() const { return m_debugger; }
+        void setDebugger(Debugger* debugger) { m_debugger = debugger; }
 
         virtual bool supportsProfiling() const { return false; }
         virtual bool supportsRichSourceInfo() const { return true; }
 
-        ScopeChain& globalScopeChain() { return d()->globalScopeChain; }
+        ScopeChainNode* globalScopeChain() { return m_globalScopeChain.get(); }
 
         virtual bool isGlobalObject() const { return true; }
 
@@ -247,28 +233,28 @@ namespace JSC {
 
         void copyGlobalsFrom(RegisterFile&);
         void copyGlobalsTo(RegisterFile&);
-        
-        void resetPrototype(JSValue prototype);
+        void resizeRegisters(int oldSize, int newSize);
 
-        JSGlobalData& globalData() const { return *d()->globalData.get(); }
-        JSGlobalObjectData* d() const { return static_cast<JSGlobalObjectData*>(JSVariableObject::d); }
+        void resetPrototype(JSGlobalData&, JSValue prototype);
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        JSGlobalData& globalData() const { return *m_globalData.get(); }
+
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         void registerWeakMap(OpaqueJSWeakObjectMap* map)
         {
-            d()->weakMaps.add(map);
+            m_weakMaps.add(map);
         }
 
         void deregisterWeakMap(OpaqueJSWeakObjectMap* map)
         {
-            d()->weakMaps.remove(map);
+            m_weakMaps.remove(map);
         }
 
-        double weakRandomNumber() { return d()->weakRandom.get(); }
+        double weakRandomNumber() { return m_weakRandom.get(); }
     protected:
 
         static const unsigned AnonymousSlotCount = JSVariableObject::AnonymousSlotCount + 1;
@@ -289,13 +275,11 @@ namespace JSC {
         void addStaticGlobals(GlobalPropertyInfo*, int count);
 
     private:
-        static void destroyJSGlobalObjectData(void*);
-
         // FIXME: Fold reset into init.
         void init(JSObject* thisValue);
         void reset(JSValue prototype);
 
-        void setRegisters(Register* registers, PassOwnArrayPtr<Register> registerArray, size_t count);
+        void setRegisters(WriteBarrier<Unknown>* registers, PassOwnArrayPtr<WriteBarrier<Unknown> > registerArray, size_t count);
 
         void* operator new(size_t); // can only be allocated with JSGlobalData
     };
@@ -308,27 +292,31 @@ namespace JSC {
         return static_cast<JSGlobalObject*>(asObject(value));
     }
 
-    inline void JSGlobalObject::setRegisters(Register* registers, PassOwnArrayPtr<Register> registerArray, size_t count)
+    inline void JSGlobalObject::setRegisters(WriteBarrier<Unknown>* registers, PassOwnArrayPtr<WriteBarrier<Unknown> > registerArray, size_t count)
     {
         JSVariableObject::setRegisters(registers, registerArray);
-        d()->registerArraySize = count;
+        m_registerArraySize = count;
     }
 
     inline void JSGlobalObject::addStaticGlobals(GlobalPropertyInfo* globals, int count)
     {
-        size_t oldSize = d()->registerArraySize;
+        size_t oldSize = m_registerArraySize;
         size_t newSize = oldSize + count;
-        Register* registerArray = new Register[newSize];
-        if (d()->registerArray)
-            memcpy(registerArray + count, d()->registerArray.get(), oldSize * sizeof(Register));
-        setRegisters(registerArray + newSize, registerArray, newSize);
+        OwnArrayPtr<WriteBarrier<Unknown> > registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[newSize]);
+        if (m_registerArray) {
+            // memcpy is safe here as we're copying barriers we already own from the existing array
+            memcpy(registerArray.get() + count, m_registerArray.get(), oldSize * sizeof(Register));
+        }
+
+        WriteBarrier<Unknown>* registers = registerArray.get() + newSize;
+        setRegisters(registers, registerArray.release(), newSize);
 
         for (int i = 0, index = -static_cast<int>(oldSize) - 1; i < count; ++i, --index) {
             GlobalPropertyInfo& global = globals[i];
             ASSERT(global.attributes & DontDelete);
             SymbolTableEntry newEntry(index, global.attributes);
             symbolTable().add(global.identifier.impl(), newEntry);
-            registerAt(index) = global.value;
+            registerAt(index).set(globalData(), this, global.value);
         }
     }
 
@@ -355,6 +343,12 @@ namespace JSC {
         return symbolTableGet(propertyName, slot, slotIsWriteable);
     }
 
+    inline bool JSGlobalObject::symbolTableHasProperty(const Identifier& propertyName)
+    {
+        SymbolTableEntry entry = symbolTable().inlineGet(propertyName.impl());
+        return !entry.isNull();
+    }
+
     inline JSValue Structure::prototypeForLookup(ExecState* exec) const
     {
         if (typeInfo().type() == ObjectType)
@@ -369,7 +363,7 @@ namespace JSC {
         // We cache our prototype chain so our clients can share it.
         if (!isValid(exec, m_cachedPrototypeChain.get())) {
             JSValue prototype = prototypeForLookup(exec);
-            m_cachedPrototypeChain = StructureChain::create(prototype.isNull() ? 0 : asObject(prototype)->structure());
+            m_cachedPrototypeChain.set(exec->globalData(), this, StructureChain::create(exec->globalData(), prototype.isNull() ? 0 : asObject(prototype)->structure()));
         }
         return m_cachedPrototypeChain.get();
     }
@@ -380,9 +374,9 @@ namespace JSC {
             return false;
 
         JSValue prototype = prototypeForLookup(exec);
-        RefPtr<Structure>* cachedStructure = cachedPrototypeChain->head();
+        WriteBarrier<Structure>* cachedStructure = cachedPrototypeChain->head();
         while(*cachedStructure && !prototype.isNull()) {
-            if (asObject(prototype)->structure() != *cachedStructure)
+            if (asObject(prototype)->structure() != cachedStructure->get())
                 return false;
             ++cachedStructure;
             prototype = asObject(prototype)->prototype();
@@ -401,29 +395,29 @@ namespace JSC {
         return globalData().dynamicGlobalObject;
     }
 
-    inline JSObject* constructEmptyObject(ExecState* exec)
-    {
-        return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
-    }
-    
     inline JSObject* constructEmptyObject(ExecState* exec, JSGlobalObject* globalObject)
     {
-        return new (exec) JSObject(globalObject->emptyObjectStructure());
+        return constructEmptyObject(exec, globalObject->emptyObjectStructure());
     }
 
+    inline JSObject* constructEmptyObject(ExecState* exec)
+    {
+        return constructEmptyObject(exec, exec->lexicalGlobalObject());
+    }
+    
     inline JSArray* constructEmptyArray(ExecState* exec)
     {
-        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure());
+        return new (exec) JSArray(exec->globalData(), exec->lexicalGlobalObject()->arrayStructure());
     }
     
     inline JSArray* constructEmptyArray(ExecState* exec, JSGlobalObject* globalObject)
     {
-        return new (exec) JSArray(globalObject->arrayStructure());
+        return new (exec) JSArray(exec->globalData(), globalObject->arrayStructure());
     }
 
     inline JSArray* constructEmptyArray(ExecState* exec, unsigned initialLength)
     {
-        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), initialLength, CreateInitialized);
+        return new (exec) JSArray(exec->globalData(), exec->lexicalGlobalObject()->arrayStructure(), initialLength, CreateInitialized);
     }
 
     inline JSArray* constructArray(ExecState* exec, JSValue singleItemValue)
@@ -441,7 +435,7 @@ namespace JSC {
     class DynamicGlobalObjectScope {
         WTF_MAKE_NONCOPYABLE(DynamicGlobalObjectScope);
     public:
-        DynamicGlobalObjectScope(CallFrame* callFrame, JSGlobalObject* dynamicGlobalObject);
+        DynamicGlobalObjectScope(JSGlobalData&, JSGlobalObject*);
 
         ~DynamicGlobalObjectScope()
         {
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index 284806e..f0da773 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -26,7 +26,6 @@
 #include "JSGlobalObjectFunctions.h"
 
 #include "CallFrame.h"
-#include "GlobalEvalFunction.h"
 #include "Interpreter.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
@@ -450,12 +449,12 @@ EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState* exec)
     if (JSValue parsedObject = preparser.tryLiteralParse())
         return JSValue::encode(parsedObject);
 
-    RefPtr<EvalExecutable> eval = EvalExecutable::create(exec, makeSource(s), false);
-    JSObject* error = eval->compile(exec, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node());
+    EvalExecutable* eval = EvalExecutable::create(exec, makeSource(s), false);
+    JSObject* error = eval->compile(exec, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain());
     if (error)
         return throwVMError(exec, error);
 
-    return JSValue::encode(exec->interpreter()->execute(eval.get(), exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node()));
+    return JSValue::encode(exec->interpreter()->execute(eval, exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain()));
 }
 
 EncodedJSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/JSImmediate.cpp b/Source/JavaScriptCore/runtime/JSImmediate.cpp
deleted file mode 100644
index 846238d..0000000
--- a/Source/JavaScriptCore/runtime/JSImmediate.cpp
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- *  Copyright (C) 2003-2006, 2008 Apple Inc. All rights reserved.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "JSImmediate.h"
-
-namespace JSC {
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSImmediate.h b/Source/JavaScriptCore/runtime/JSImmediate.h
deleted file mode 100644
index 68ba75c..0000000
--- a/Source/JavaScriptCore/runtime/JSImmediate.h
+++ /dev/null
@@ -1,568 +0,0 @@
-/*
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef JSImmediate_h
-#define JSImmediate_h
-
-#if USE(JSVALUE64)
-
-#include <wtf/Assertions.h>
-#include <wtf/AlwaysInline.h>
-#include <wtf/MathExtras.h>
-#include <wtf/StdLibExtras.h>
-#include "JSValue.h"
-#include <limits>
-#include <limits.h>
-#include <stdarg.h>
-#include <stdint.h>
-#include <stdlib.h>
-
-namespace JSC {
-
-    class ExecState;
-    class JSCell;
-    class JSGlobalData;
-    class JSObject;
-    class UString;
-
-    inline intptr_t reinterpretDoubleToIntptr(double value)
-    {
-        return WTF::bitwise_cast<intptr_t>(value);
-    }
-
-    inline double reinterpretIntptrToDouble(intptr_t value)
-    {
-        return WTF::bitwise_cast<double>(value);
-    }
-
-    /*
-     * A JSValue* is either a pointer to a cell (a heap-allocated object) or an immediate (a type-tagged 
-     * value masquerading as a pointer). The low two bits in a JSValue* are available for type tagging
-     * because allocator alignment guarantees they will be 00 in cell pointers.
-     *
-     * For example, on a 32 bit system:
-     *
-     * JSCell*:             XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX                     00
-     *                      [ high 30 bits: pointer address ]  [ low 2 bits -- always 0 ]
-     * JSImmediate:         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX                     TT
-     *                      [ high 30 bits: 'payload' ]             [ low 2 bits -- tag ]
-     *
-     * Where the bottom two bits are non-zero they either indicate that the immediate is a 31 bit signed
-     * integer, or they mark the value as being an immediate of a type other than integer, with a secondary
-     * tag used to indicate the exact type.
-     *
-     * Where the lowest bit is set (TT is equal to 01 or 11) the high 31 bits form a 31 bit signed int value.
-     * Where TT is equal to 10 this indicates this is a type of immediate other than an integer, and the next
-     * two bits will form an extended tag.
-     *
-     * 31 bit signed int:   XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX                     X1
-     *                      [ high 30 bits of the value ]      [ high bit part of value ]
-     * Other:               YYYYYYYYYYYYYYYYYYYYYYYYYYYY      ZZ               10
-     *                      [ extended 'payload' ]  [  extended tag  ]  [  tag 'other'  ]
-     *
-     * Where the first bit of the extended tag is set this flags the value as being a boolean, and the following
-     * bit would flag the value as undefined.  If neither bits are set, the value is null.
-     *
-     * Other:               YYYYYYYYYYYYYYYYYYYYYYYYYYYY      UB               10
-     *                      [ extended 'payload' ]  [ undefined | bool ]  [ tag 'other' ]
-     *
-     * For boolean value the lowest bit in the payload holds the value of the bool, all remaining bits are zero.
-     * For undefined or null immediates the payload is zero.
-     *
-     * Boolean:             000000000000000000000000000V      01               10
-     *                      [ boolean value ]              [ bool ]       [ tag 'other' ]
-     * Undefined:           0000000000000000000000000000      10               10
-     *                      [ zero ]                    [ undefined ]     [ tag 'other' ]
-     * Null:                0000000000000000000000000000      00               10
-     *                      [ zero ]                       [ zero ]       [ tag 'other' ]
-     */
-
-    /*
-     * On 64-bit platforms, we support an alternative encoding form for immediates, if
-     * USE(JSVALUE64) is defined.  When this format is used, double precision
-     * floating point values may also be encoded as JSImmediates.
-     *
-     * The encoding makes use of unused NaN space in the IEEE754 representation.  Any value
-     * with the top 13 bits set represents a QNaN (with the sign bit set).  QNaN values
-     * can encode a 51-bit payload.  Hardware produced and C-library payloads typically
-     * have a payload of zero.  We assume that non-zero payloads are available to encode
-     * pointer and integer values.  Since any 64-bit bit pattern where the top 15 bits are
-     * all set represents a NaN with a non-zero payload, we can use this space in the NaN
-     * ranges to encode other values (however there are also other ranges of NaN space that
-     * could have been selected).  This range of NaN space is represented by 64-bit numbers
-     * begining with the 16-bit hex patterns 0xFFFE and 0xFFFF - we rely on the fact that no
-     * valid double-precision numbers will begin fall in these ranges.
-     *
-     * The scheme we have implemented encodes double precision values by adding 2^48 to the
-     * 64-bit integer representation of the number.  After this manipulation, no encoded
-     * double-precision value will begin with the pattern 0x0000 or 0xFFFF.
-     *
-     * The top 16-bits denote the type of the encoded JSImmediate:
-     *
-     * Pointer: 0000:PPPP:PPPP:PPPP
-     *          0001:****:****:****
-     * Double:{         ...
-     *          FFFE:****:****:****
-     * Integer: FFFF:0000:IIII:IIII
-     *
-     * 32-bit signed integers are marked with the 16-bit tag 0xFFFF.  The tag 0x0000
-     * denotes a pointer, or another form of tagged immediate.  Boolean, null and undefined
-     * values are encoded in the same manner as the default format.
-     */
-
-    class JSImmediate {
-    private:
-        friend class JIT;
-        friend class JSValue;
-        friend class JSInterfaceJIT;
-        friend class SpecializedThunkJIT;
-        friend JSValue jsNumber(ExecState* exec, double d);
-        friend JSValue jsNumber(ExecState*, char i);
-        friend JSValue jsNumber(ExecState*, unsigned char i);
-        friend JSValue jsNumber(ExecState*, short i);
-        friend JSValue jsNumber(ExecState*, unsigned short i);
-        friend JSValue jsNumber(ExecState* exec, int i);
-        friend JSValue jsNumber(ExecState* exec, unsigned i);
-        friend JSValue jsNumber(ExecState* exec, long i);
-        friend JSValue jsNumber(ExecState* exec, unsigned long i);
-        friend JSValue jsNumber(ExecState* exec, long long i);
-        friend JSValue jsNumber(ExecState* exec, unsigned long long i);
-        friend JSValue jsNumber(JSGlobalData* globalData, double d);
-        friend JSValue jsNumber(JSGlobalData* globalData, short i);
-        friend JSValue jsNumber(JSGlobalData* globalData, unsigned short i);
-        friend JSValue jsNumber(JSGlobalData* globalData, int i);
-        friend JSValue jsNumber(JSGlobalData* globalData, unsigned i);
-        friend JSValue jsNumber(JSGlobalData* globalData, long i);
-        friend JSValue jsNumber(JSGlobalData* globalData, unsigned long i);
-        friend JSValue jsNumber(JSGlobalData* globalData, long long i);
-        friend JSValue jsNumber(JSGlobalData* globalData, unsigned long long i);
-
-        // If all bits in the mask are set, this indicates an integer number,
-        // if any but not all are set this value is a double precision number.
-        static const intptr_t TagTypeNumber = 0xffff000000000000ll;
-        // This value is 2^48, used to encode doubles such that the encoded value will begin
-        // with a 16-bit pattern within the range 0x0001..0xFFFE.
-        static const intptr_t DoubleEncodeOffset = 0x1000000000000ll;
-        static const intptr_t TagBitTypeOther   = 0x2; // second bit set indicates immediate other than an integer
-        static const intptr_t TagMask           = TagTypeNumber | TagBitTypeOther;
-
-        static const intptr_t ExtendedTagMask         = 0xC; // extended tag holds a further two bits
-        static const intptr_t ExtendedTagBitBool      = 0x4;
-        static const intptr_t ExtendedTagBitUndefined = 0x8;
-
-        static const intptr_t FullTagTypeMask      = TagMask | ExtendedTagMask;
-        static const intptr_t FullTagTypeBool      = TagBitTypeOther | ExtendedTagBitBool;
-        static const intptr_t FullTagTypeUndefined = TagBitTypeOther | ExtendedTagBitUndefined;
-        static const intptr_t FullTagTypeNull      = TagBitTypeOther;
-
-        static const int32_t IntegerPayloadShift  = 0;
-        static const int32_t ExtendedPayloadShift = 4;
-
-        static const intptr_t ExtendedPayloadBitBoolValue = 1 << ExtendedPayloadShift;
-
-        static const int32_t signBit = 0x80000000;
- 
-        static ALWAYS_INLINE bool isImmediate(JSValue v)
-        {
-            return rawValue(v) & TagMask;
-        }
-        
-        static ALWAYS_INLINE bool isNumber(JSValue v)
-        {
-            return rawValue(v) & TagTypeNumber;
-        }
-
-        static ALWAYS_INLINE bool isIntegerNumber(JSValue v)
-        {
-            return (rawValue(v) & TagTypeNumber) == TagTypeNumber;
-        }
-
-        static ALWAYS_INLINE bool isDouble(JSValue v)
-        {
-            return isNumber(v) && !isIntegerNumber(v);
-        }
-
-        static ALWAYS_INLINE bool isPositiveIntegerNumber(JSValue v)
-        {
-            // A single mask to check for the sign bit and the number tag all at once.
-            return (rawValue(v) & (signBit | TagTypeNumber)) == TagTypeNumber;
-        }
-        
-        static ALWAYS_INLINE bool isBoolean(JSValue v)
-        {
-            return (rawValue(v) & FullTagTypeMask) == FullTagTypeBool;
-        }
-        
-        static ALWAYS_INLINE bool isUndefinedOrNull(JSValue v)
-        {
-            // Undefined and null share the same value, bar the 'undefined' bit in the extended tag.
-            return (rawValue(v) & ~ExtendedTagBitUndefined) == FullTagTypeNull;
-        }
-
-        static JSValue from(char);
-        static JSValue from(signed char);
-        static JSValue from(unsigned char);
-        static JSValue from(short);
-        static JSValue from(unsigned short);
-        static JSValue from(int);
-        static JSValue from(unsigned);
-        static JSValue from(long);
-        static JSValue from(unsigned long);
-        static JSValue from(long long);
-        static JSValue from(unsigned long long);
-        static JSValue from(double);
-
-        static ALWAYS_INLINE bool isEitherImmediate(JSValue v1, JSValue v2)
-        {
-            return (rawValue(v1) | rawValue(v2)) & TagMask;
-        }
-
-        static ALWAYS_INLINE bool areBothImmediate(JSValue v1, JSValue v2)
-        {
-            return isImmediate(v1) & isImmediate(v2);
-        }
-
-        static ALWAYS_INLINE bool areBothImmediateIntegerNumbers(JSValue v1, JSValue v2)
-        {
-            return (rawValue(v1) & rawValue(v2) & TagTypeNumber) == TagTypeNumber;
-        }
-
-        static double toDouble(JSValue);
-        static bool toBoolean(JSValue);
-
-        static bool getUInt32(JSValue, uint32_t&);
-        static bool getTruncatedInt32(JSValue, int32_t&);
-        static bool getTruncatedUInt32(JSValue, uint32_t&);
-
-        static int32_t getTruncatedInt32(JSValue);
-        static uint32_t getTruncatedUInt32(JSValue);
-
-        static JSValue trueImmediate();
-        static JSValue falseImmediate();
-        static JSValue undefinedImmediate();
-        static JSValue nullImmediate();
-        static JSValue zeroImmediate();
-        static JSValue oneImmediate();
-
-    private:
-        static const int minImmediateInt = ((-INT_MAX) - 1);
-        static const int maxImmediateInt = INT_MAX;
-        static const unsigned maxImmediateUInt = maxImmediateInt;
-
-        static ALWAYS_INLINE JSValue makeValue(intptr_t integer)
-        {
-            return JSValue::makeImmediate(integer);
-        }
-
-        // With USE(JSVALUE64) we want the argument to be zero extended, so the
-        // integer doesn't interfere with the tag bits in the upper word.  In the default encoding,
-        // if intptr_t id larger then int32_t we sign extend the value through the upper word.
-        static ALWAYS_INLINE JSValue makeInt(uint32_t value)
-        {
-            return makeValue((static_cast<intptr_t>(value) << IntegerPayloadShift) | TagTypeNumber);
-        }
-        
-        static ALWAYS_INLINE JSValue makeDouble(double value)
-        {
-            return makeValue(reinterpretDoubleToIntptr(value) + DoubleEncodeOffset);
-        }
-        
-        static ALWAYS_INLINE JSValue makeBool(bool b)
-        {
-            return makeValue((static_cast<intptr_t>(b) << ExtendedPayloadShift) | FullTagTypeBool);
-        }
-        
-        static ALWAYS_INLINE JSValue makeUndefined()
-        {
-            return makeValue(FullTagTypeUndefined);
-        }
-        
-        static ALWAYS_INLINE JSValue makeNull()
-        {
-            return makeValue(FullTagTypeNull);
-        }
-
-        template<typename T>
-        static JSValue fromNumberOutsideIntegerRange(T);
-
-        static ALWAYS_INLINE double doubleValue(JSValue v)
-        {
-            return reinterpretIntptrToDouble(rawValue(v) - DoubleEncodeOffset);
-        }
-
-        static ALWAYS_INLINE int32_t intValue(JSValue v)
-        {
-            return static_cast<int32_t>(rawValue(v) >> IntegerPayloadShift);
-        }
-        
-        static ALWAYS_INLINE uint32_t uintValue(JSValue v)
-        {
-            return static_cast<uint32_t>(rawValue(v) >> IntegerPayloadShift);
-        }
-        
-        static ALWAYS_INLINE bool boolValue(JSValue v)
-        {
-            return rawValue(v) & ExtendedPayloadBitBoolValue;
-        }
-        
-        static ALWAYS_INLINE intptr_t rawValue(JSValue v)
-        {
-            return v.immediateValue();
-        }
-    };
-
-    ALWAYS_INLINE JSValue JSImmediate::trueImmediate() { return makeBool(true); }
-    ALWAYS_INLINE JSValue JSImmediate::falseImmediate() { return makeBool(false); }
-    ALWAYS_INLINE JSValue JSImmediate::undefinedImmediate() { return makeUndefined(); }
-    ALWAYS_INLINE JSValue JSImmediate::nullImmediate() { return makeNull(); }
-    ALWAYS_INLINE JSValue JSImmediate::zeroImmediate() { return makeInt(0); }
-    ALWAYS_INLINE JSValue JSImmediate::oneImmediate() { return makeInt(1); }
-
-    inline bool doubleToBoolean(double value)
-    {
-        return value < 0.0 || value > 0.0;
-    }
-
-    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValue v)
-    {
-        ASSERT(isImmediate(v));
-        return isNumber(v) ? isIntegerNumber(v) ? v != zeroImmediate()
-            : doubleToBoolean(doubleValue(v)) : v == trueImmediate();
-    }
-
-    ALWAYS_INLINE uint32_t JSImmediate::getTruncatedUInt32(JSValue v)
-    {
-        // FIXME: should probably be asserting isPositiveIntegerNumber here.
-        ASSERT(isIntegerNumber(v));
-        return intValue(v);
-    }
-
-    template<typename T>
-    inline JSValue JSImmediate::fromNumberOutsideIntegerRange(T value)
-    {
-        return makeDouble(static_cast<double>(value));
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(char i)
-    {
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(signed char i)
-    {
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(unsigned char i)
-    {
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(short i)
-    {
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(unsigned short i)
-    {
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(int i)
-    {
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(unsigned i)
-    {
-        if (i > maxImmediateUInt)
-            return fromNumberOutsideIntegerRange(i);
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(long i)
-    {
-        if ((i < minImmediateInt) | (i > maxImmediateInt))
-            return fromNumberOutsideIntegerRange(i);
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(unsigned long i)
-    {
-        if (i > maxImmediateUInt)
-            return fromNumberOutsideIntegerRange(i);
-        return makeInt(i);
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(long long i)
-    {
-        if ((i < minImmediateInt) | (i > maxImmediateInt))
-            return JSValue();
-        return makeInt(static_cast<intptr_t>(i));
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(unsigned long long i)
-    {
-        if (i > maxImmediateUInt)
-            return fromNumberOutsideIntegerRange(i);
-        return makeInt(static_cast<intptr_t>(i));
-    }
-
-    ALWAYS_INLINE JSValue JSImmediate::from(double d)
-    {
-        const int intVal = static_cast<int>(d);
-
-        // Check for data loss from conversion to int.
-        if (intVal != d || (!intVal && signbit(d)))
-            return fromNumberOutsideIntegerRange(d);
-
-        return from(intVal);
-    }
-
-    ALWAYS_INLINE int32_t JSImmediate::getTruncatedInt32(JSValue v)
-    {
-        ASSERT(isIntegerNumber(v));
-        return intValue(v);
-    }
-
-    ALWAYS_INLINE double JSImmediate::toDouble(JSValue v)
-    {
-        ASSERT(isImmediate(v));
-
-        if (isIntegerNumber(v))
-            return intValue(v);
-
-        if (isNumber(v)) {
-            ASSERT(isDouble(v));
-            return doubleValue(v);
-        }
-
-        if (rawValue(v) == FullTagTypeUndefined)
-            return nonInlineNaN();
-
-        ASSERT(JSImmediate::isBoolean(v) || (v == JSImmediate::nullImmediate()));
-        return rawValue(v) >> ExtendedPayloadShift;
-    }
-
-    ALWAYS_INLINE bool JSImmediate::getUInt32(JSValue v, uint32_t& i)
-    {
-        i = uintValue(v);
-        return isPositiveIntegerNumber(v);
-    }
-
-    ALWAYS_INLINE bool JSImmediate::getTruncatedInt32(JSValue v, int32_t& i)
-    {
-        i = intValue(v);
-        return isIntegerNumber(v);
-    }
-
-    ALWAYS_INLINE bool JSImmediate::getTruncatedUInt32(JSValue v, uint32_t& i)
-    {
-        return getUInt32(v, i);
-    }
-
-    inline JSValue::JSValue(JSNullTag)
-    {
-        *this = JSImmediate::nullImmediate();
-    }
-    
-    inline JSValue::JSValue(JSUndefinedTag)
-    {
-        *this = JSImmediate::undefinedImmediate();
-    }
-
-    inline JSValue::JSValue(JSTrueTag)
-    {
-        *this = JSImmediate::trueImmediate();
-    }
-
-    inline JSValue::JSValue(JSFalseTag)
-    {
-        *this = JSImmediate::falseImmediate();
-    }
-
-    inline bool JSValue::isUndefinedOrNull() const
-    {
-        return JSImmediate::isUndefinedOrNull(asValue());
-    }
-
-    inline bool JSValue::isBoolean() const
-    {
-        return JSImmediate::isBoolean(asValue());
-    }
-
-    inline bool JSValue::isTrue() const
-    {
-        return asValue() == JSImmediate::trueImmediate();
-    }
-
-    inline bool JSValue::isFalse() const
-    {
-        return asValue() == JSImmediate::falseImmediate();
-    }
-
-    inline bool JSValue::getBoolean(bool& v) const
-    {
-        if (JSImmediate::isBoolean(asValue())) {
-            v = JSImmediate::toBoolean(asValue());
-            return true;
-        }
-        
-        return false;
-    }
-
-    inline bool JSValue::getBoolean() const
-    {
-        return asValue() == jsBoolean(true);
-    }
-
-    inline bool JSValue::isCell() const
-    {
-        return !JSImmediate::isImmediate(asValue());
-    }
-
-    inline bool JSValue::isInt32() const
-    {
-        return JSImmediate::isIntegerNumber(asValue());
-    }
-
-    inline int32_t JSValue::asInt32() const
-    {
-        ASSERT(isInt32());
-        return JSImmediate::getTruncatedInt32(asValue());
-    }
-
-    inline bool JSValue::isUInt32() const
-    {
-        return JSImmediate::isPositiveIntegerNumber(asValue());
-    }
-
-    inline uint32_t JSValue::asUInt32() const
-    {
-        ASSERT(isUInt32());
-        return JSImmediate::getTruncatedUInt32(asValue());
-    }
-
-} // namespace JSC
-
-#endif // USE(JSVALUE64)
-
-#endif // JSImmediate_h
diff --git a/Source/JavaScriptCore/runtime/JSLock.cpp b/Source/JavaScriptCore/runtime/JSLock.cpp
index 918141f..fc543f0 100644
--- a/Source/JavaScriptCore/runtime/JSLock.cpp
+++ b/Source/JavaScriptCore/runtime/JSLock.cpp
@@ -23,14 +23,19 @@
 
 #include "Heap.h"
 #include "CallFrame.h"
+#include "JSObject.h"
+#include "ScopeChain.h"
 
-#if ENABLE(JSC_MULTIPLE_THREADS)
+#if USE(PTHREADS)
 #include <pthread.h>
 #endif
 
 namespace JSC {
 
-#if ENABLE(JSC_MULTIPLE_THREADS)
+// JSLock is only needed to support an obsolete execution model where JavaScriptCore
+// automatically protected against concurrent access from multiple threads.
+// So it's safe to disable it on non-mac platforms where we don't have native pthreads.
+#if ENABLE(JSC_MULTIPLE_THREADS) && (OS(DARWIN) || USE(PTHREADS))
 
 // Acquire this mutex before accessing lock-related data.
 static pthread_mutex_t JSMutex = PTHREAD_MUTEX_INITIALIZER;
@@ -208,7 +213,7 @@ JSLock::DropAllLocks::~DropAllLocks()
     --lockDropDepth;
 }
 
-#else
+#else // ENABLE(JSC_MULTIPLE_THREADS) && (OS(DARWIN) || USE(PTHREADS))
 
 JSLock::JSLock(ExecState*)
     : m_lockBehavior(SilenceAssertionsOnly)
@@ -255,6 +260,6 @@ JSLock::DropAllLocks::~DropAllLocks()
 {
 }
 
-#endif // USE(MULTIPLE_THREADS)
+#endif // ENABLE(JSC_MULTIPLE_THREADS) && (OS(DARWIN) || USE(PTHREADS))
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSNotAnObject.cpp b/Source/JavaScriptCore/runtime/JSNotAnObject.cpp
index e01b401..1115dc0 100644
--- a/Source/JavaScriptCore/runtime/JSNotAnObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSNotAnObject.cpp
@@ -67,7 +67,7 @@ UString JSNotAnObject::toString(ExecState* exec) const
     return "";
 }
 
-JSObject* JSNotAnObject::toObject(ExecState* exec) const
+JSObject* JSNotAnObject::toObject(ExecState* exec, JSGlobalObject*) const
 {
     ASSERT_UNUSED(exec, exec->hadException());
     return const_cast<JSNotAnObject*>(this);
diff --git a/Source/JavaScriptCore/runtime/JSNotAnObject.h b/Source/JavaScriptCore/runtime/JSNotAnObject.h
index 9f527cf..4c6806a 100644
--- a/Source/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/Source/JavaScriptCore/runtime/JSNotAnObject.h
@@ -36,16 +36,16 @@ namespace JSC {
     // This unholy class is used to allow us to avoid multiple exception checks
     // in certain SquirrelFish bytecodes -- effectively it just silently consumes
     // any operations performed on the result of a failed toObject call.
-    class JSNotAnObject : public JSObject {
+    class JSNotAnObject : public JSNonFinalObject {
     public:
         JSNotAnObject(ExecState* exec)
-            : JSObject(exec->globalData().notAnObjectStructure)
+            : JSNonFinalObject(exec->globalData(), exec->globalData().notAnObjectStructure.get())
         {
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
      private:
@@ -58,7 +58,7 @@ namespace JSC {
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
+        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
 
         // JSObject methods
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
diff --git a/Source/JavaScriptCore/runtime/JSNumberCell.h b/Source/JavaScriptCore/runtime/JSNumberCell.h
deleted file mode 100644
index 1ccdf50..0000000
--- a/Source/JavaScriptCore/runtime/JSNumberCell.h
+++ /dev/null
@@ -1,171 +0,0 @@
-/*
- *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2007, 2008 Apple Inc. All rights reserved.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef JSNumberCell_h
-#define JSNumberCell_h
-
-#include "CallFrame.h"
-#include "JSCell.h"
-#include "JSImmediate.h"
-#include "Heap.h"
-#include "UString.h"
-#include <stddef.h> // for size_t
-
-namespace JSC {
-
-    extern const double NaN;
-    extern const double Inf;
-
-#if USE(JSVALUE64)
-    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, double d)
-    {
-        *this = JSImmediate::fromNumberOutsideIntegerRange(d);
-    }
-
-    inline JSValue::JSValue(double d)
-    {
-        JSValue v = JSImmediate::from(d);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(int i)
-    {
-        JSValue v = JSImmediate::from(i);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(unsigned i)
-    {
-        JSValue v = JSImmediate::from(i);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(unsigned long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(long long i)
-    {
-        JSValue v = JSImmediate::from(static_cast<double>(i));
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline JSValue::JSValue(unsigned long long i)
-    {
-        JSValue v = JSImmediate::from(static_cast<double>(i));
-        ASSERT(v);
-        *this = v;
-    }
-
-    inline bool JSValue::isDouble() const
-    {
-        return JSImmediate::isDouble(asValue());
-    }
-
-    inline double JSValue::asDouble() const
-    {
-        return JSImmediate::doubleValue(asValue());
-    }
-
-    inline bool JSValue::isNumber() const
-    {
-        return JSImmediate::isNumber(asValue());
-    }
-
-    inline double JSValue::uncheckedGetNumber() const
-    {
-        ASSERT(isNumber());
-        return JSImmediate::toDouble(asValue());
-    }
-
-#endif // USE(JSVALUE64)
-
-#if USE(JSVALUE64)
-
-    inline JSValue::JSValue(char i)
-    {
-        ASSERT(JSImmediate::from(i));
-        *this = JSImmediate::from(i);
-    }
-
-    inline JSValue::JSValue(unsigned char i)
-    {
-        ASSERT(JSImmediate::from(i));
-        *this = JSImmediate::from(i);
-    }
-
-    inline JSValue::JSValue(short i)
-    {
-        ASSERT(JSImmediate::from(i));
-        *this = JSImmediate::from(i);
-    }
-
-    inline JSValue::JSValue(unsigned short i)
-    {
-        ASSERT(JSImmediate::from(i));
-        *this = JSImmediate::from(i);
-    }
-
-    inline JSValue jsNaN()
-    {
-        return jsNumber(NaN);
-    }
-
-    // --- JSValue inlines ----------------------------
-
-    ALWAYS_INLINE JSValue JSValue::toJSNumber(ExecState* exec) const
-    {
-        return isNumber() ? asValue() : jsNumber(this->toNumber(exec));
-    }
-
-    inline bool JSValue::getNumber(double &result) const
-    {
-        if (isInt32())
-            result = asInt32();
-        else if (LIKELY(isDouble()))
-            result = asDouble();
-        else {
-            ASSERT(!isNumber());
-            return false;
-        }
-        return true;
-    }
-
-#endif // USE(JSVALUE64)
-
-} // namespace JSC
-
-#endif // JSNumberCell_h
diff --git a/Source/JavaScriptCore/runtime/JSONObject.cpp b/Source/JavaScriptCore/runtime/JSONObject.cpp
index 0f7a576..27fc569 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSONObject.cpp
@@ -32,6 +32,8 @@
 #include "JSArray.h"
 #include "JSGlobalObject.h"
 #include "LiteralParser.h"
+#include "Local.h"
+#include "LocalScope.h"
 #include "Lookup.h"
 #include "PropertyNameArray.h"
 #include "UStringBuilder.h"
@@ -51,9 +53,10 @@ static EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState*);
 
 namespace JSC {
 
-JSONObject::JSONObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
+JSONObject::JSONObject(JSGlobalObject* globalObject, Structure* structure)
     : JSObjectWithGlobalObject(globalObject, structure)
 {
+    ASSERT(inherits(&s_info));
 }
 
 // PropertyNameForFunctionCall objects must be on the stack, since the JSValue that they create is not marked.
@@ -73,24 +76,22 @@ private:
 class Stringifier {
     WTF_MAKE_NONCOPYABLE(Stringifier);
 public:
-    Stringifier(ExecState*, JSValue replacer, JSValue space);
-    ~Stringifier();
-    JSValue stringify(JSValue);
+    Stringifier(ExecState*, const Local<Unknown>& replacer, const Local<Unknown>& space);
+    Local<Unknown> stringify(Handle<Unknown>);
 
     void markAggregate(MarkStack&);
 
 private:
     class Holder {
     public:
-        Holder(JSObject*);
+        Holder(JSGlobalData&, JSObject*);
 
         JSObject* object() const { return m_object.get(); }
-        DeprecatedPtr<JSObject>* objectSlot() { return &m_object; }
 
         bool appendNextProperty(Stringifier&, UStringBuilder&);
 
     private:
-        DeprecatedPtr<JSObject> m_object;
+        Local<JSObject> m_object;
         const bool m_isArray;
         bool m_isJSArray;
         unsigned m_index;
@@ -112,16 +113,14 @@ private:
     void unindent();
     void startNewLine(UStringBuilder&) const;
 
-    Stringifier* const m_nextStringifierToMark;
     ExecState* const m_exec;
-    const JSValue m_replacer;
+    const Local<Unknown> m_replacer;
     bool m_usingArrayReplacer;
     PropertyNameArray m_arrayReplacerPropertyNames;
     CallType m_replacerCallType;
     CallData m_replacerCallData;
     const UString m_gap;
 
-    HashSet<JSObject*> m_holderCycleDetector;
     Vector<Holder, 16> m_holderStack;
     UString m_repeatedGap;
     UString m_indent;
@@ -134,11 +133,11 @@ static inline JSValue unwrapBoxedPrimitive(ExecState* exec, JSValue value)
     if (!value.isObject())
         return value;
     JSObject* object = asObject(value);
-    if (object->inherits(&NumberObject::info))
+    if (object->inherits(&NumberObject::s_info))
         return jsNumber(object->toNumber(exec));
-    if (object->inherits(&StringObject::info))
+    if (object->inherits(&StringObject::s_info))
         return jsString(exec, object->toString(exec));
-    if (object->inherits(&BooleanObject::info))
+    if (object->inherits(&BooleanObject::s_info))
         return object->toPrimitive(exec);
     return value;
 }
@@ -198,23 +197,20 @@ JSValue PropertyNameForFunctionCall::value(ExecState* exec) const
 
 // ------------------------------ Stringifier --------------------------------
 
-Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
-    : m_nextStringifierToMark(exec->globalData().firstStringifierToMark)
-    , m_exec(exec)
+Stringifier::Stringifier(ExecState* exec, const Local<Unknown>& replacer, const Local<Unknown>& space)
+    : m_exec(exec)
     , m_replacer(replacer)
     , m_usingArrayReplacer(false)
     , m_arrayReplacerPropertyNames(exec)
     , m_replacerCallType(CallTypeNone)
-    , m_gap(gap(exec, space))
+    , m_gap(gap(exec, space.get()))
 {
-    exec->globalData().firstStringifierToMark = this;
-
     if (!m_replacer.isObject())
         return;
 
-    if (asObject(m_replacer)->inherits(&JSArray::info)) {
+    if (m_replacer.asObject()->inherits(&JSArray::s_info)) {
         m_usingArrayReplacer = true;
-        JSObject* array = asObject(m_replacer);
+        Handle<JSObject> array = m_replacer.asObject();
         unsigned length = array->get(exec, exec->globalData().propertyNames->length).toUInt32(exec);
         for (unsigned i = 0; i < length; ++i) {
             JSValue name = array->get(exec, i);
@@ -234,7 +230,7 @@ Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
             }
 
             if (name.isObject()) {
-                if (!asObject(name)->inherits(&NumberObject::info) && !asObject(name)->inherits(&StringObject::info))
+                if (!asObject(name)->inherits(&NumberObject::s_info) && !asObject(name)->inherits(&StringObject::s_info))
                     continue;
                 propertyName = name.toString(exec);
                 if (exec->hadException())
@@ -245,40 +241,25 @@ Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
         return;
     }
 
-    m_replacerCallType = asObject(m_replacer)->getCallData(m_replacerCallData);
-}
-
-Stringifier::~Stringifier()
-{
-    ASSERT(m_exec->globalData().firstStringifierToMark == this);
-    m_exec->globalData().firstStringifierToMark = m_nextStringifierToMark;
-}
-
-void Stringifier::markAggregate(MarkStack& markStack)
-{
-    for (Stringifier* stringifier = this; stringifier; stringifier = stringifier->m_nextStringifierToMark) {
-        size_t size = m_holderStack.size();
-        for (size_t i = 0; i < size; ++i)
-            markStack.append(m_holderStack[i].objectSlot());
-    }
+    m_replacerCallType = m_replacer.asObject()->getCallData(m_replacerCallData);
 }
 
-JSValue Stringifier::stringify(JSValue value)
+Local<Unknown> Stringifier::stringify(Handle<Unknown> value)
 {
     JSObject* object = constructEmptyObject(m_exec);
     if (m_exec->hadException())
-        return jsNull();
+        return Local<Unknown>(m_exec->globalData(), jsNull());
 
     PropertyNameForFunctionCall emptyPropertyName(m_exec->globalData().propertyNames->emptyIdentifier);
-    object->putDirect(m_exec->globalData(), m_exec->globalData().propertyNames->emptyIdentifier, value);
+    object->putDirect(m_exec->globalData(), m_exec->globalData().propertyNames->emptyIdentifier, value.get());
 
     UStringBuilder result;
-    if (appendStringifiedValue(result, value, object, emptyPropertyName) != StringifySucceeded)
-        return jsUndefined();
+    if (appendStringifiedValue(result, value.get(), object, emptyPropertyName) != StringifySucceeded)
+        return Local<Unknown>(m_exec->globalData(), jsUndefined());
     if (m_exec->hadException())
-        return jsNull();
+        return Local<Unknown>(m_exec->globalData(), jsNull());
 
-    return jsString(m_exec, result.toUString());
+    return Local<Unknown>(m_exec->globalData(), jsString(m_exec, result.toUString()));
 }
 
 void Stringifier::appendQuotedString(UStringBuilder& builder, const UString& value)
@@ -371,12 +352,12 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
     if (m_replacerCallType != CallTypeNone) {
         JSValue list[] = { propertyName.value(m_exec), value };
         ArgList args(list, WTF_ARRAY_LENGTH(list));
-        value = call(m_exec, m_replacer, m_replacerCallType, m_replacerCallData, holder, args);
+        value = call(m_exec, m_replacer.get(), m_replacerCallType, m_replacerCallData, holder, args);
         if (m_exec->hadException())
             return StringifyFailed;
     }
 
-    if (value.isUndefined() && !holder->inherits(&JSArray::info))
+    if (value.isUndefined() && !holder->inherits(&JSArray::s_info))
         return StringifyFailedDueToUndefinedValue;
 
     if (value.isNull()) {
@@ -416,7 +397,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
 
     CallData callData;
     if (object->getCallData(callData) != CallTypeNone) {
-        if (holder->inherits(&JSArray::info)) {
+        if (holder->inherits(&JSArray::s_info)) {
             builder.append("null");
             return StringifySucceeded;
         }
@@ -424,12 +405,14 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
     }
 
     // Handle cycle detection, and put the holder on the stack.
-    if (!m_holderCycleDetector.add(object).second) {
-        throwError(m_exec, createTypeError(m_exec, "JSON.stringify cannot serialize cyclic structures."));
-        return StringifyFailed;
+    for (unsigned i = 0; i < m_holderStack.size(); i++) {
+        if (m_holderStack[i].object() == object) {
+            throwError(m_exec, createTypeError(m_exec, "JSON.stringify cannot serialize cyclic structures."));
+            return StringifyFailed;
+        }
     }
     bool holderStackWasEmpty = m_holderStack.isEmpty();
-    m_holderStack.append(object);
+    m_holderStack.append(Holder(m_exec->globalData(), object));
     if (!holderStackWasEmpty)
         return StringifySucceeded;
 
@@ -449,7 +432,6 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
                 tickCount = localTimeoutChecker.ticksUntilNextCheck();
             }
         }
-        m_holderCycleDetector.remove(m_holderStack.last().object());
         m_holderStack.removeLast();
     } while (!m_holderStack.isEmpty());
     return StringifySucceeded;
@@ -484,9 +466,9 @@ inline void Stringifier::startNewLine(UStringBuilder& builder) const
     builder.append(m_indent);
 }
 
-inline Stringifier::Holder::Holder(JSObject* object)
-    : m_object(object)
-    , m_isArray(object->inherits(&JSArray::info))
+inline Stringifier::Holder::Holder(JSGlobalData& globalData, JSObject* object)
+    : m_object(globalData, object)
+    , m_isArray(object->inherits(&JSArray::s_info))
     , m_index(0)
 {
 }
@@ -601,7 +583,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, UStringBu
 
 // ------------------------------ JSONObject --------------------------------
 
-const ClassInfo JSONObject::info = { "JSON", 0, 0, ExecState::jsonTable };
+const ClassInfo JSONObject::s_info = { "JSON", &JSObjectWithGlobalObject::s_info, 0, ExecState::jsonTable };
 
 /* Source for JSONObject.lut.h
 @begin jsonTable
@@ -622,16 +604,11 @@ bool JSONObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& pro
     return getStaticFunctionDescriptor<JSObject>(exec, ExecState::jsonTable(exec), this, propertyName, descriptor);
 }
 
-void JSONObject::markStringifiers(MarkStack& markStack, Stringifier* stringifier)
-{
-    stringifier->markAggregate(markStack);
-}
-
 class Walker {
 public:
-    Walker(ExecState* exec, JSObject* function, CallType callType, CallData callData)
+    Walker(ExecState* exec, Handle<JSObject> function, CallType callType, CallData callData)
         : m_exec(exec)
-        , m_function(function)
+        , m_function(exec->globalData(), function)
         , m_callType(callType)
         , m_callData(callData)
     {
@@ -648,7 +625,7 @@ private:
     friend class Holder;
 
     ExecState* m_exec;
-    DeprecatedPtr<JSObject> m_function;
+    Local<JSObject> m_function;
     CallType m_callType;
     CallData m_callData;
 };
@@ -662,8 +639,8 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
 {
     Vector<PropertyNameArray, 16> propertyStack;
     Vector<uint32_t, 16> indexStack;
-    Vector<JSObject*, 16> objectStack;
-    Vector<JSArray*, 16> arrayStack;
+    LocalStack<JSObject, 16> objectStack(m_exec->globalData());
+    LocalStack<JSArray, 16> arrayStack(m_exec->globalData());
     
     Vector<WalkerState, 16> stateStack;
     WalkerState state = StateUnknown;
@@ -678,12 +655,12 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
             arrayStartState:
             case ArrayStartState: {
                 ASSERT(inValue.isObject());
-                ASSERT(isJSArray(&m_exec->globalData(), asObject(inValue)) || asObject(inValue)->inherits(&JSArray::info));
+                ASSERT(isJSArray(&m_exec->globalData(), asObject(inValue)) || asObject(inValue)->inherits(&JSArray::s_info));
                 if (objectStack.size() + arrayStack.size() > maximumFilterRecursion)
                     return throwError(m_exec, createStackOverflowError(m_exec));
 
                 JSArray* array = asArray(inValue);
-                arrayStack.append(array);
+                arrayStack.push(array);
                 indexStack.append(0);
                 // fallthrough
             }
@@ -695,11 +672,11 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     tickCount = localTimeoutChecker.ticksUntilNextCheck();
                 }
 
-                JSArray* array = arrayStack.last();
+                JSArray* array = arrayStack.peek();
                 uint32_t index = indexStack.last();
                 if (index == array->length()) {
                     outValue = array;
-                    arrayStack.removeLast();
+                    arrayStack.pop();
                     indexStack.removeLast();
                     break;
                 }
@@ -721,7 +698,7 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 // fallthrough
             }
             case ArrayEndVisitMember: {
-                JSArray* array = arrayStack.last();
+                JSArray* array = arrayStack.peek();
                 JSValue filteredValue = callReviver(array, jsString(m_exec, UString::number(indexStack.last())), outValue);
                 if (filteredValue.isUndefined())
                     array->deleteProperty(m_exec, indexStack.last());
@@ -739,12 +716,12 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
             objectStartState:
             case ObjectStartState: {
                 ASSERT(inValue.isObject());
-                ASSERT(!isJSArray(&m_exec->globalData(), asObject(inValue)) && !asObject(inValue)->inherits(&JSArray::info));
+                ASSERT(!isJSArray(&m_exec->globalData(), asObject(inValue)) && !asObject(inValue)->inherits(&JSArray::s_info));
                 if (objectStack.size() + arrayStack.size() > maximumFilterRecursion)
                     return throwError(m_exec, createStackOverflowError(m_exec));
 
                 JSObject* object = asObject(inValue);
-                objectStack.append(object);
+                objectStack.push(object);
                 indexStack.append(0);
                 propertyStack.append(PropertyNameArray(m_exec));
                 object->getOwnPropertyNames(m_exec, propertyStack.last());
@@ -758,12 +735,12 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     tickCount = localTimeoutChecker.ticksUntilNextCheck();
                 }
 
-                JSObject* object = objectStack.last();
+                JSObject* object = objectStack.peek();
                 uint32_t index = indexStack.last();
                 PropertyNameArray& properties = propertyStack.last();
                 if (index == properties.size()) {
                     outValue = object;
-                    objectStack.removeLast();
+                    objectStack.pop();
                     indexStack.removeLast();
                     propertyStack.removeLast();
                     break;
@@ -786,7 +763,7 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 // fallthrough
             }
             case ObjectEndVisitMember: {
-                JSObject* object = objectStack.last();
+                JSObject* object = objectStack.peek();
                 Identifier prop = propertyStack.last()[indexStack.last()];
                 PutPropertySlot slot;
                 JSValue filteredValue = callReviver(object, jsString(m_exec, prop.ustring()), outValue);
@@ -806,7 +783,7 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     break;
                 }
                 JSObject* object = asObject(inValue);
-                if (isJSArray(&m_exec->globalData(), object) || object->inherits(&JSArray::info))
+                if (isJSArray(&m_exec->globalData(), object) || object->inherits(&JSArray::s_info))
                     goto arrayStartState;
                 goto objectStartState;
         }
@@ -837,7 +814,8 @@ EncodedJSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState* exec)
     UString source = value.toString(exec);
     if (exec->hadException())
         return JSValue::encode(jsNull());
-    
+
+    LocalScope scope(exec->globalData());
     LiteralParser jsonParser(exec, source, LiteralParser::StrictJSON);
     JSValue unfiltered = jsonParser.tryLiteralParse();
     if (!unfiltered)
@@ -851,7 +829,7 @@ EncodedJSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState* exec)
     CallType callType = getCallData(function, callData);
     if (callType == CallTypeNone)
         return JSValue::encode(unfiltered);
-    return JSValue::encode(Walker(exec, asObject(function), callType, callData).walk(unfiltered));
+    return JSValue::encode(Walker(exec, Local<JSObject>(exec->globalData(), asObject(function)), callType, callData).walk(unfiltered));
 }
 
 // ECMA-262 v5 15.12.3
@@ -859,15 +837,17 @@ EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec)
 {
     if (!exec->argumentCount())
         return throwVMError(exec, createError(exec, "No input to stringify"));
-    JSValue value = exec->argument(0);
-    JSValue replacer = exec->argument(1);
-    JSValue space = exec->argument(2);
-    return JSValue::encode(Stringifier(exec, replacer, space).stringify(value));
+    LocalScope scope(exec->globalData());
+    Local<Unknown> value(exec->globalData(), exec->argument(0));
+    Local<Unknown> replacer(exec->globalData(), exec->argument(1));
+    Local<Unknown> space(exec->globalData(), exec->argument(2));
+    return JSValue::encode(Stringifier(exec, replacer, space).stringify(value).get());
 }
 
 UString JSONStringify(ExecState* exec, JSValue value, unsigned indent)
 {
-    JSValue result = Stringifier(exec, jsNull(), jsNumber(indent)).stringify(value);
+    LocalScope scope(exec->globalData());
+    Local<Unknown> result = Stringifier(exec, Local<Unknown>(exec->globalData(), jsNull()), Local<Unknown>(exec->globalData(), jsNumber(indent))).stringify(Local<Unknown>(exec->globalData(), value));
     if (result.isUndefinedOrNull())
         return UString();
     return result.getString(exec);
diff --git a/Source/JavaScriptCore/runtime/JSONObject.h b/Source/JavaScriptCore/runtime/JSONObject.h
index f64be12..c87c641 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.h
+++ b/Source/JavaScriptCore/runtime/JSONObject.h
@@ -34,15 +34,13 @@ namespace JSC {
 
     class JSONObject : public JSObjectWithGlobalObject {
     public:
-        JSONObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure);
+        JSONObject(JSGlobalObject*, Structure*);
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
-        static void markStringifiers(MarkStack&, Stringifier*);
-
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
 
@@ -50,8 +48,7 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-        static const ClassInfo info;
+        static const ClassInfo s_info;
     };
 
     UString JSONStringify(ExecState* exec, JSValue value, unsigned indent);
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index 277ffff..9677f23 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -42,9 +42,13 @@
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSObject);
+ASSERT_CLASS_FITS_IN_CELL(JSNonFinalObject);
+ASSERT_CLASS_FITS_IN_CELL(JSFinalObject);
 
 const char* StrictModeReadonlyPropertyWriteError = "Attempted to assign to readonly property.";
 
+const ClassInfo JSObject::s_info = { "Object", 0, 0, 0 };
+
 static inline void getClassPropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Add properties from the static hashtables of properties
@@ -81,9 +85,8 @@ void JSObject::markChildren(MarkStack& markStack)
 UString JSObject::className() const
 {
     const ClassInfo* info = classInfo();
-    if (info)
-        return info->className;
-    return "Object";
+    ASSERT(info);
+    return info->className;
 }
 
 bool JSObject::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
@@ -106,7 +109,7 @@ void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValue valu
         // Setting __proto__ to a non-object, non-null value is silently ignored to match Mozilla.
         if (!value.isObject() && !value.isNull())
             return;
-        if (!setPrototypeWithCycleCheck(value))
+        if (!setPrototypeWithCycleCheck(exec->globalData(), value))
             throwError(exec, createError(exec, "cyclic __proto__ value"));
         return;
     }
@@ -124,14 +127,14 @@ void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValue valu
     
     unsigned attributes;
     JSCell* specificValue;
-    if ((m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) && attributes & ReadOnly) {
+    if ((m_structure->get(exec->globalData(), propertyName, attributes, specificValue) != WTF::notFound) && attributes & ReadOnly) {
         if (slot.isStrictMode())
             throwError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
         return;
     }
 
     for (JSObject* obj = this; ; obj = asObject(prototype)) {
-        if (JSValue gs = obj->getDirect(propertyName)) {
+        if (JSValue gs = obj->getDirect(exec->globalData(), propertyName)) {
             if (gs.isGetterSetter()) {
                 JSObject* setterFunc = asGetterSetter(gs)->setter();        
                 if (!setterFunc) {
@@ -215,10 +218,10 @@ bool JSObject::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     unsigned attributes;
     JSCell* specificValue;
-    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) {
+    if (m_structure->get(exec->globalData(), propertyName, attributes, specificValue) != WTF::notFound) {
         if ((attributes & DontDelete))
             return false;
-        removeDirect(propertyName);
+        removeDirect(exec->globalData(), propertyName);
         return true;
     }
 
@@ -309,34 +312,33 @@ const HashEntry* JSObject::findPropertyHashEntry(ExecState* exec, const Identifi
 
 void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
-    JSValue object = getDirect(propertyName);
+    JSValue object = getDirect(exec->globalData(), propertyName);
     if (object && object.isGetterSetter()) {
         ASSERT(m_structure->hasGetterSetterProperties());
         asGetterSetter(object)->setGetter(exec->globalData(), getterFunction);
         return;
     }
 
+    JSGlobalData& globalData = exec->globalData();
     PutPropertySlot slot;
     GetterSetter* getterSetter = new (exec) GetterSetter(exec);
-    putDirectInternal(exec->globalData(), propertyName, getterSetter, attributes | Getter, true, slot);
+    putDirectInternal(globalData, propertyName, getterSetter, attributes | Getter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
     // if we override an existing non-getter or non-setter.
     if (slot.type() != PutPropertySlot::NewProperty) {
-        if (!m_structure->isDictionary()) {
-            RefPtr<Structure> structure = Structure::getterSetterTransition(m_structure);
-            setStructure(structure.release());
-        }
+        if (!m_structure->isDictionary())
+            setStructure(exec->globalData(), Structure::getterSetterTransition(globalData, m_structure.get()));
     }
 
     m_structure->setHasGetterSetterProperties(true);
-    getterSetter->setGetter(exec->globalData(), getterFunction);
+    getterSetter->setGetter(globalData, getterFunction);
 }
 
 void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
-    JSValue object = getDirect(propertyName);
+    JSValue object = getDirect(exec->globalData(), propertyName);
     if (object && object.isGetterSetter()) {
         ASSERT(m_structure->hasGetterSetterProperties());
         asGetterSetter(object)->setSetter(exec->globalData(), setterFunction);
@@ -351,21 +353,19 @@ void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSO
     // getters and setters, though, we also need to change our Structure
     // if we override an existing non-getter or non-setter.
     if (slot.type() != PutPropertySlot::NewProperty) {
-        if (!m_structure->isDictionary()) {
-            RefPtr<Structure> structure = Structure::getterSetterTransition(m_structure);
-            setStructure(structure.release());
-        }
+        if (!m_structure->isDictionary())
+            setStructure(exec->globalData(), Structure::getterSetterTransition(exec->globalData(), m_structure.get()));
     }
 
     m_structure->setHasGetterSetterProperties(true);
     getterSetter->setSetter(exec->globalData(), setterFunction);
 }
 
-JSValue JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
+JSValue JSObject::lookupGetter(ExecState* exec, const Identifier& propertyName)
 {
     JSObject* object = this;
     while (true) {
-        if (JSValue value = object->getDirect(propertyName)) {
+        if (JSValue value = object->getDirect(exec->globalData(), propertyName)) {
             if (!value.isGetterSetter())
                 return jsUndefined();
             JSObject* functionObject = asGetterSetter(value)->getter();
@@ -380,11 +380,11 @@ JSValue JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
     }
 }
 
-JSValue JSObject::lookupSetter(ExecState*, const Identifier& propertyName)
+JSValue JSObject::lookupSetter(ExecState* exec, const Identifier& propertyName)
 {
     JSObject* object = this;
     while (true) {
-        if (JSValue value = object->getDirect(propertyName)) {
+        if (JSValue value = object->getDirect(exec->globalData(), propertyName)) {
             if (!value.isGetterSetter())
                 return jsUndefined();
             JSObject* functionObject = asGetterSetter(value)->setter();
@@ -425,10 +425,10 @@ bool JSObject::propertyIsEnumerable(ExecState* exec, const Identifier& propertyN
     return descriptor.enumerable();
 }
 
-bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyName, JSCell*& specificValue) const
+bool JSObject::getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificValue) const
 {
     unsigned attributes;
-    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound)
+    if (m_structure->get(exec->globalData(), propertyName, attributes, specificValue) != WTF::notFound)
         return true;
 
     // This could be a function within the static table? - should probably
@@ -461,7 +461,7 @@ void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyName
 
 void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    m_structure->getPropertyNames(propertyNames, mode);
+    m_structure->getPropertyNames(exec->globalData(), propertyNames, mode);
     getClassPropertyNames(exec, classInfo(), propertyNames, mode);
 }
 
@@ -486,7 +486,7 @@ UString JSObject::toString(ExecState* exec) const
     return primitive.toString(exec);
 }
 
-JSObject* JSObject::toObject(ExecState*) const
+JSObject* JSObject::toObject(ExecState*, JSGlobalObject*) const
 {
     return const_cast<JSObject*>(this);
 }
@@ -506,18 +506,33 @@ JSObject* JSObject::unwrappedObject()
     return this;
 }
 
-void JSObject::removeDirect(const Identifier& propertyName)
+void JSObject::seal(JSGlobalData& globalData)
+{
+    setStructure(globalData, Structure::sealTransition(globalData, m_structure.get()));
+}
+
+void JSObject::freeze(JSGlobalData& globalData)
+{
+    setStructure(globalData, Structure::freezeTransition(globalData, m_structure.get()));
+}
+
+void JSObject::preventExtensions(JSGlobalData& globalData)
+{
+    if (isExtensible())
+        setStructure(globalData, Structure::preventExtensionsTransition(globalData, m_structure.get()));
+}
+
+void JSObject::removeDirect(JSGlobalData& globalData, const Identifier& propertyName)
 {
     size_t offset;
     if (m_structure->isUncacheableDictionary()) {
-        offset = m_structure->removePropertyWithoutTransition(propertyName);
+        offset = m_structure->removePropertyWithoutTransition(globalData, propertyName);
         if (offset != WTF::notFound)
             putUndefinedAtDirectOffset(offset);
         return;
     }
 
-    RefPtr<Structure> structure = Structure::removePropertyTransition(m_structure, propertyName, offset);
-    setStructure(structure.release());
+    setStructure(globalData, Structure::removePropertyTransition(globalData, m_structure.get(), propertyName, offset));
     if (offset != WTF::notFound)
         putUndefinedAtDirectOffset(offset);
 }
@@ -553,22 +568,38 @@ NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, WriteBarr
         slot.setUndefined();
 }
 
-Structure* JSObject::createInheritorID()
+Structure* JSObject::createInheritorID(JSGlobalData& globalData)
 {
-    m_inheritorID = JSObject::createStructure(this);
+    m_inheritorID.set(globalData, this, createEmptyObjectStructure(globalData, this));
+    ASSERT(m_inheritorID->isEmpty());
     return m_inheritorID.get();
 }
 
 void JSObject::allocatePropertyStorage(size_t oldSize, size_t newSize)
 {
-    allocatePropertyStorageInline(oldSize, newSize);
+    ASSERT(newSize > oldSize);
+
+    // It's important that this function not rely on m_structure, since
+    // we might be in the middle of a transition.
+    bool wasInline = (oldSize < JSObject::baseExternalStorageCapacity);
+
+    PropertyStorage oldPropertyStorage = m_propertyStorage;
+    PropertyStorage newPropertyStorage = new WriteBarrierBase<Unknown>[newSize];
+
+    for (unsigned i = 0; i < oldSize; ++i)
+       newPropertyStorage[i] = oldPropertyStorage[i];
+
+    if (!wasInline)
+        delete [] oldPropertyStorage;
+
+    m_propertyStorage = newPropertyStorage;
 }
 
-bool JSObject::getOwnPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor& descriptor)
+bool JSObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     unsigned attributes = 0;
     JSCell* cell = 0;
-    size_t offset = m_structure->get(propertyName, attributes, cell);
+    size_t offset = m_structure->get(exec->globalData(), propertyName, attributes, cell);
     if (offset == WTF::notFound)
         return false;
     descriptor.setDescriptor(getDirectOffset(offset), attributes);
@@ -627,6 +658,12 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     // If we have a new property we can just put it on normally
     PropertyDescriptor current;
     if (!getOwnPropertyDescriptor(exec, propertyName, current)) {
+        // unless extensions are prevented!
+        if (!isExtensible()) {
+            if (throwException)
+                throwError(exec, createTypeError(exec, "Attempting to define property on object that is not extensible."));
+            return false;
+        }
         PropertyDescriptor oldDescriptor;
         oldDescriptor.setValue(jsUndefined());
         return putDescriptor(exec, this, propertyName, descriptor, descriptor.attributes(), oldDescriptor);
@@ -703,18 +740,18 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     // Changing the accessor functions of an existing accessor property
     ASSERT(descriptor.isAccessorDescriptor());
     if (!current.configurable()) {
-        if (descriptor.setterPresent() && !(current.setter() && JSValue::strictEqual(exec, current.setter(), descriptor.setter()))) {
+        if (descriptor.setterPresent() && !(current.setterPresent() && JSValue::strictEqual(exec, current.setter(), descriptor.setter()))) {
             if (throwException)
                 throwError(exec, createTypeError(exec, "Attempting to change the setter of an unconfigurable property."));
             return false;
         }
-        if (descriptor.getterPresent() && !(current.getter() && JSValue::strictEqual(exec, current.getter(), descriptor.getter()))) {
+        if (descriptor.getterPresent() && !(current.getterPresent() && JSValue::strictEqual(exec, current.getter(), descriptor.getter()))) {
             if (throwException)
                 throwError(exec, createTypeError(exec, "Attempting to change the getter of an unconfigurable property."));
             return false;
         }
     }
-    JSValue accessor = getDirect(propertyName);
+    JSValue accessor = getDirect(exec->globalData(), propertyName);
     if (!accessor)
         return false;
     GetterSetter* getterSetter = asGetterSetter(accessor);
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index b79249c..80735f8 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -29,7 +29,6 @@
 #include "Completion.h"
 #include "CallFrame.h"
 #include "JSCell.h"
-#include "JSNumberCell.h"
 #include "MarkStack.h"
 #include "PropertySlot.h"
 #include "PutPropertySlot.h"
@@ -80,8 +79,6 @@ namespace JSC {
         friend void setUpStaticFunctionSlot(ExecState* exec, const HashEntry* entry, JSObject* thisObj, const Identifier& propertyName, PropertySlot& slot);
 
     public:
-        explicit JSObject(NonNullPassRefPtr<Structure>);
-
         virtual void markChildren(MarkStack&);
         ALWAYS_INLINE void markChildrenDirect(MarkStack& markStack);
 
@@ -90,11 +87,11 @@ namespace JSC {
         virtual ~JSObject();
 
         JSValue prototype() const;
-        void setPrototype(JSValue prototype);
-        bool setPrototypeWithCycleCheck(JSValue prototype);
+        void setPrototype(JSGlobalData&, JSValue prototype);
+        bool setPrototypeWithCycleCheck(JSGlobalData&, JSValue prototype);
         
-        void setStructure(NonNullPassRefPtr<Structure>);
-        Structure* inheritorID();
+        void setStructure(JSGlobalData&, Structure*);
+        Structure* inheritorID(JSGlobalData&);
 
         virtual UString className() const;
 
@@ -140,7 +137,7 @@ namespace JSC {
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
+        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
 
         virtual JSObject* toThisObject(ExecState*) const;
         virtual JSValue toStrictThisObject(ExecState*) const;
@@ -149,22 +146,22 @@ namespace JSC {
         bool getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificFunction) const;
 
         // This get function only looks at the property map.
-        JSValue getDirect(const Identifier& propertyName) const
+        JSValue getDirect(JSGlobalData& globalData, const Identifier& propertyName) const
         {
-            size_t offset = m_structure->get(propertyName);
+            size_t offset = m_structure->get(globalData, propertyName);
             return offset != WTF::notFound ? getDirectOffset(offset) : JSValue();
         }
 
-        WriteBarrierBase<Unknown>* getDirectLocation(const Identifier& propertyName)
+        WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, const Identifier& propertyName)
         {
-            size_t offset = m_structure->get(propertyName);
+            size_t offset = m_structure->get(globalData, propertyName);
             return offset != WTF::notFound ? locationForOffset(offset) : 0;
         }
 
-        WriteBarrierBase<Unknown>* getDirectLocation(const Identifier& propertyName, unsigned& attributes)
+        WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, const Identifier& propertyName, unsigned& attributes)
         {
             JSCell* specificFunction;
-            size_t offset = m_structure->get(propertyName, attributes, specificFunction);
+            size_t offset = m_structure->get(globalData, propertyName, attributes, specificFunction);
             return offset != WTF::notFound ? locationForOffset(offset) : 0;
         }
 
@@ -173,9 +170,9 @@ namespace JSC {
             return location - propertyStorage();
         }
 
-        void transitionTo(Structure*);
+        void transitionTo(JSGlobalData&, Structure*);
 
-        void removeDirect(const Identifier& propertyName);
+        void removeDirect(JSGlobalData&, const Identifier& propertyName);
         bool hasCustomProperties() { return !m_structure->isEmpty(); }
         bool hasGetterSetterProperties() { return m_structure->hasGetterSetterProperties(); }
 
@@ -212,19 +209,19 @@ namespace JSC {
         virtual bool isStrictModeFunction() const { return false; }
         virtual bool isErrorInstance() const { return false; }
 
+        void seal(JSGlobalData&);
+        void freeze(JSGlobalData&);
+        void preventExtensions(JSGlobalData&);
+        bool isSealed(JSGlobalData& globalData) { return m_structure->isSealed(globalData); }
+        bool isFrozen(JSGlobalData& globalData) { return m_structure->isFrozen(globalData); }
+        bool isExtensible() { return m_structure->isExtensible(); }
+
         virtual ComplType exceptionType() const { return Throw; }
 
         void allocatePropertyStorage(size_t oldSize, size_t newSize);
-        void allocatePropertyStorageInline(size_t oldSize, size_t newSize);
-        bool isUsingInlineStorage() const { return m_structure->isUsingInlineStorage(); }
-
-        static const unsigned inlineStorageCapacity = sizeof(EncodedJSValue) == 2 * sizeof(void*) ? 4 : 3;
-        static const unsigned nonInlineBaseStorageCapacity = 16;
+        bool isUsingInlineStorage() const { return static_cast<const void*>(m_propertyStorage) == static_cast<const void*>(this + 1); }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
-        {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
-        }
+        static const unsigned baseExternalStorageCapacity = 16;
 
         void flattenDictionaryObject(JSGlobalData& globalData)
         {
@@ -246,15 +243,33 @@ namespace JSC {
             ASSERT(index < m_structure->anonymousSlotCount());
             return locationForOffset(index)->get();
         }
+
+        static size_t offsetOfInlineStorage();
         
+        static JS_EXPORTDATA const ClassInfo s_info;
+
     protected:
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
+        {
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        }
+
         static const unsigned StructureFlags = 0;
-        
+
         void putThisToAnonymousValue(unsigned index)
         {
             locationForOffset(index)->setWithoutWriteBarrier(this);
         }
-        
+
+        // To instantiate objects you likely want JSFinalObject, below.
+        // To create derived types you likely want JSNonFinalObject, below.
+        JSObject(JSGlobalData&, Structure*, PropertyStorage inlineStorage);
+        JSObject(VPtrStealingHackType, PropertyStorage inlineStorage)
+            : JSCell(VPtrStealingHack)
+            , m_propertyStorage(inlineStorage)
+        {
+        }
+
     private:
         // Nobody should ever ask any of these questions on something already known to be a JSObject.
         using JSCell::isAPIValueWrapper;
@@ -265,8 +280,8 @@ namespace JSC {
         void isObject();
         void isString();
         
-        ConstPropertyStorage propertyStorage() const { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
-        PropertyStorage propertyStorage() { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
+        ConstPropertyStorage propertyStorage() const { return m_propertyStorage; }
+        PropertyStorage propertyStorage() { return m_propertyStorage; }
 
         const WriteBarrierBase<Unknown>* locationForOffset(size_t offset) const
         {
@@ -285,16 +300,97 @@ namespace JSC {
         bool inlineGetOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 
         const HashEntry* findPropertyHashEntry(ExecState*, const Identifier& propertyName) const;
-        Structure* createInheritorID();
-
-        union {
-            PropertyStorage m_externalStorage;
-            WriteBarrierBase<Unknown> m_inlineStorage[inlineStorageCapacity];
-        };
+        Structure* createInheritorID(JSGlobalData&);
 
-        RefPtr<Structure> m_inheritorID;
+        PropertyStorage m_propertyStorage;
+        WriteBarrier<Structure> m_inheritorID;
     };
+
+
+#if USE(JSVALUE32_64)
+#define JSNonFinalObject_inlineStorageCapacity 4
+#define JSFinalObject_inlineStorageCapacity 6
+#else
+#define JSNonFinalObject_inlineStorageCapacity 2
+#define JSFinalObject_inlineStorageCapacity 4
+#endif
+
+COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineStorageCapacity), final_storage_is_at_least_as_large_as_non_final);
+
+    // JSNonFinalObject is a type of JSObject that has some internal storage,
+    // but also preserves some space in the collector cell for additional
+    // data members in derived types.
+    class JSNonFinalObject : public JSObject {
+        friend class JSObject;
+
+    public:
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
+        {
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        }
+
+    protected:
+        explicit JSNonFinalObject(VPtrStealingHackType)
+            : JSObject(VPtrStealingHack, m_inlineStorage)
+        {
+        }
     
+        explicit JSNonFinalObject(JSGlobalData& globalData, Structure* structure)
+            : JSObject(globalData, structure, m_inlineStorage)
+        {
+            ASSERT(!(OBJECT_OFFSETOF(JSNonFinalObject, m_inlineStorage) % sizeof(double)));
+            ASSERT(this->structure()->propertyStorageCapacity() == JSNonFinalObject_inlineStorageCapacity);
+        }
+
+    private:
+        WriteBarrierBase<Unknown> m_inlineStorage[JSNonFinalObject_inlineStorageCapacity];
+    };
+
+    // JSFinalObject is a type of JSObject that contains sufficent internal
+    // storage to fully make use of the colloctor cell containing it.
+    class JSFinalObject : public JSObject {
+        friend class JSObject;
+
+    public:
+        static JSFinalObject* create(ExecState* exec, Structure* structure)
+        {
+            return new (exec) JSFinalObject(exec->globalData(), structure);
+        }
+
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
+        {
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        }
+
+    private:
+        explicit JSFinalObject(JSGlobalData& globalData, Structure* structure)
+            : JSObject(globalData, structure, m_inlineStorage)
+        {
+            ASSERT(OBJECT_OFFSETOF(JSFinalObject, m_inlineStorage) % sizeof(double) == 0);
+            ASSERT(this->structure()->propertyStorageCapacity() == JSFinalObject_inlineStorageCapacity);
+        }
+
+        static const unsigned StructureFlags = JSObject::StructureFlags | IsJSFinalObject;
+
+        WriteBarrierBase<Unknown> m_inlineStorage[JSFinalObject_inlineStorageCapacity];
+    };
+
+inline size_t JSObject::offsetOfInlineStorage()
+{
+    ASSERT(OBJECT_OFFSETOF(JSFinalObject, m_inlineStorage) == OBJECT_OFFSETOF(JSNonFinalObject, m_inlineStorage));
+    return OBJECT_OFFSETOF(JSFinalObject, m_inlineStorage);
+}
+
+inline JSObject* constructEmptyObject(ExecState* exec, Structure* structure)
+{
+    return JSFinalObject::create(exec, structure);
+}
+
+inline Structure* createEmptyObjectStructure(JSGlobalData& globalData, JSValue prototype)
+{
+    return JSFinalObject::createStructure(globalData, prototype);
+}
+
 inline JSObject* asObject(JSCell* cell)
 {
     ASSERT(cell->isObject());
@@ -306,21 +402,22 @@ inline JSObject* asObject(JSValue value)
     return asObject(value.asCell());
 }
 
-inline JSObject::JSObject(NonNullPassRefPtr<Structure> structure)
-    : JSCell(structure.releaseRef()) // ~JSObject balances this ref()
+inline JSObject::JSObject(JSGlobalData& globalData, Structure* structure, PropertyStorage inlineStorage)
+    : JSCell(globalData, structure)
+    , m_propertyStorage(inlineStorage)
 {
-    ASSERT(m_structure->propertyStorageCapacity() == inlineStorageCapacity);
+    ASSERT(inherits(&s_info));
+    ASSERT(m_structure->propertyStorageCapacity() < baseExternalStorageCapacity);
     ASSERT(m_structure->isEmpty());
     ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
-    ASSERT(OBJECT_OFFSETOF(JSObject, m_inlineStorage) % sizeof(double) == 0);
+    ASSERT(static_cast<void*>(inlineStorage) == static_cast<void*>(this + 1));
+    ASSERT(m_structure->typeInfo().type() == ObjectType);
 }
 
 inline JSObject::~JSObject()
 {
-    ASSERT(m_structure);
     if (!isUsingInlineStorage())
-        delete [] m_externalStorage;
-    m_structure->deref();
+        delete [] m_propertyStorage;
 }
 
 inline JSValue JSObject::prototype() const
@@ -328,7 +425,7 @@ inline JSValue JSObject::prototype() const
     return m_structure->storedPrototype();
 }
 
-inline bool JSObject::setPrototypeWithCycleCheck(JSValue prototype)
+inline bool JSObject::setPrototypeWithCycleCheck(JSGlobalData& globalData, JSValue prototype)
 {
     JSValue nextPrototypeValue = prototype;
     while (nextPrototypeValue && nextPrototypeValue.isObject()) {
@@ -337,33 +434,33 @@ inline bool JSObject::setPrototypeWithCycleCheck(JSValue prototype)
             return false;
         nextPrototypeValue = nextPrototype->prototype();
     }
-    setPrototype(prototype);
+    setPrototype(globalData, prototype);
     return true;
 }
 
-inline void JSObject::setPrototype(JSValue prototype)
+inline void JSObject::setPrototype(JSGlobalData& globalData, JSValue prototype)
 {
     ASSERT(prototype);
-    RefPtr<Structure> newStructure = Structure::changePrototypeTransition(m_structure, prototype);
-    setStructure(newStructure.release());
+    setStructure(globalData, Structure::changePrototypeTransition(globalData, m_structure.get(), prototype));
 }
 
-inline void JSObject::setStructure(NonNullPassRefPtr<Structure> structure)
+inline void JSObject::setStructure(JSGlobalData& globalData, Structure* structure)
 {
-    m_structure->deref();
-    m_structure = structure.leakRef(); // ~JSObject balances this ref()
+    m_structure.set(globalData, this, structure);
 }
 
-inline Structure* JSObject::inheritorID()
+inline Structure* JSObject::inheritorID(JSGlobalData& globalData)
 {
-    if (m_inheritorID)
+    if (m_inheritorID) {
+        ASSERT(m_inheritorID->isEmpty());
         return m_inheritorID.get();
-    return createInheritorID();
+    }
+    return createInheritorID(globalData);
 }
 
 inline bool Structure::isUsingInlineStorage() const
 {
-    return (propertyStorageCapacity() == JSObject::inlineStorageCapacity);
+    return propertyStorageCapacity() < JSObject::baseExternalStorageCapacity;
 }
 
 inline bool JSCell::inherits(const ClassInfo* info) const
@@ -383,7 +480,7 @@ inline bool JSValue::inherits(const ClassInfo* classInfo) const
 
 ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (WriteBarrierBase<Unknown>* location = getDirectLocation(propertyName)) {
+    if (WriteBarrierBase<Unknown>* location = getDirectLocation(exec->globalData(), propertyName)) {
         if (m_structure->hasGetterSetterProperties() && location->isGetterSetter())
             fillGetterPropertySlot(slot, location);
         else
@@ -469,12 +566,12 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
     if (m_structure->isDictionary()) {
         unsigned currentAttributes;
         JSCell* currentSpecificFunction;
-        size_t offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
+        size_t offset = m_structure->get(globalData, propertyName, currentAttributes, currentSpecificFunction);
         if (offset != WTF::notFound) {
             // If there is currently a specific function, and there now either isn't,
             // or the new value is different, then despecify.
             if (currentSpecificFunction && (specificFunction != currentSpecificFunction))
-                m_structure->despecifyDictionaryFunction(propertyName);
+                m_structure->despecifyDictionaryFunction(globalData, propertyName);
             if (checkReadOnly && currentAttributes & ReadOnly)
                 return false;
 
@@ -490,8 +587,11 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
             return true;
         }
 
+        if (!isExtensible())
+            return false;
+
         size_t currentCapacity = m_structure->propertyStorageCapacity();
-        offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, specificFunction);
+        offset = m_structure->addPropertyWithoutTransition(globalData, propertyName, attributes, specificFunction);
         if (currentCapacity != m_structure->propertyStorageCapacity())
             allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
 
@@ -505,12 +605,12 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
 
     size_t offset;
     size_t currentCapacity = m_structure->propertyStorageCapacity();
-    if (RefPtr<Structure> structure = Structure::addPropertyTransitionToExistingStructure(m_structure, propertyName, attributes, specificFunction, offset)) {    
+    if (Structure* structure = Structure::addPropertyTransitionToExistingStructure(m_structure.get(), propertyName, attributes, specificFunction, offset)) {    
         if (currentCapacity != structure->propertyStorageCapacity())
             allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
 
         ASSERT(offset < structure->propertyStorageCapacity());
-        setStructure(structure.release());
+        setStructure(globalData, structure);
         putDirectOffset(globalData, offset, value);
         // This is a new property; transitions with specific values are not currently cachable,
         // so leave the slot in an uncachable state.
@@ -521,7 +621,7 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
 
     unsigned currentAttributes;
     JSCell* currentSpecificFunction;
-    offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
+    offset = m_structure->get(globalData, propertyName, currentAttributes, currentSpecificFunction);
     if (offset != WTF::notFound) {
         if (checkReadOnly && currentAttributes & ReadOnly)
             return false;
@@ -542,7 +642,7 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
                 return true;
             }
             // case (2) Despecify, fall through to (3).
-            setStructure(Structure::despecifyFunctionTransition(m_structure, propertyName));
+            setStructure(globalData, Structure::despecifyFunctionTransition(globalData, m_structure.get(), propertyName));
         }
 
         // case (3) set the slot, do the put, return.
@@ -551,23 +651,16 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
         return true;
     }
 
-    // If we have a specific function, we may have got to this point if there is
-    // already a transition with the correct property name and attributes, but
-    // specialized to a different function.  In this case we just want to give up
-    // and despecialize the transition.
-    // In this case we clear the value of specificFunction which will result
-    // in us adding a non-specific transition, and any subsequent lookup in
-    // Structure::addPropertyTransitionToExistingStructure will just use that.
-    if (specificFunction && m_structure->hasTransition(propertyName, attributes))
-        specificFunction = 0;
+    if (!isExtensible())
+        return false;
 
-    RefPtr<Structure> structure = Structure::addPropertyTransition(m_structure, propertyName, attributes, specificFunction, offset);
+    Structure* structure = Structure::addPropertyTransition(globalData, m_structure.get(), propertyName, attributes, specificFunction, offset);
 
     if (currentCapacity != structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
 
     ASSERT(offset < structure->propertyStorageCapacity());
-    setStructure(structure.release());
+    setStructure(globalData, structure);
     putDirectOffset(globalData, offset, value);
     // This is a new property; transitions with specific values are not currently cachable,
     // so leave the slot in an uncachable state.
@@ -623,7 +716,7 @@ inline void JSObject::putDirectFunction(JSGlobalData& globalData, const Identifi
 inline void JSObject::putDirectWithoutTransition(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     size_t currentCapacity = m_structure->propertyStorageCapacity();
-    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, 0);
+    size_t offset = m_structure->addPropertyWithoutTransition(globalData, propertyName, attributes, 0);
     if (currentCapacity != m_structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
     putDirectOffset(globalData, offset, value);
@@ -632,17 +725,17 @@ inline void JSObject::putDirectWithoutTransition(JSGlobalData& globalData, const
 inline void JSObject::putDirectFunctionWithoutTransition(JSGlobalData& globalData, const Identifier& propertyName, JSCell* value, unsigned attributes)
 {
     size_t currentCapacity = m_structure->propertyStorageCapacity();
-    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, value);
+    size_t offset = m_structure->addPropertyWithoutTransition(globalData, propertyName, attributes, value);
     if (currentCapacity != m_structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
     putDirectOffset(globalData, offset, value);
 }
 
-inline void JSObject::transitionTo(Structure* newStructure)
+inline void JSObject::transitionTo(JSGlobalData& globalData, Structure* newStructure)
 {
     if (m_structure->propertyStorageCapacity() != newStructure->propertyStorageCapacity())
         allocatePropertyStorage(m_structure->propertyStorageCapacity(), newStructure->propertyStorageCapacity());
-    setStructure(newStructure);
+    setStructure(globalData, newStructure);
 }
 
 inline JSValue JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
@@ -727,34 +820,15 @@ inline void JSValue::put(ExecState* exec, unsigned propertyName, JSValue value)
     asCell()->put(exec, propertyName, value);
 }
 
-ALWAYS_INLINE void JSObject::allocatePropertyStorageInline(size_t oldSize, size_t newSize)
-{
-    ASSERT(newSize > oldSize);
-
-    // It's important that this function not rely on m_structure, since
-    // we might be in the middle of a transition.
-    bool wasInline = (oldSize == JSObject::inlineStorageCapacity);
-
-    PropertyStorage oldPropertyStorage = (wasInline ? m_inlineStorage : m_externalStorage);
-    PropertyStorage newPropertyStorage = new WriteBarrierBase<Unknown>[newSize];
-
-    for (unsigned i = 0; i < oldSize; ++i)
-       newPropertyStorage[i] = oldPropertyStorage[i];
-
-    if (!wasInline)
-        delete [] oldPropertyStorage;
-
-    m_externalStorage = newPropertyStorage;
-}
-
 ALWAYS_INLINE void JSObject::markChildrenDirect(MarkStack& markStack)
 {
     JSCell::markChildren(markStack);
 
-    markStack.append(m_structure->storedPrototypeSlot());
     PropertyStorage storage = propertyStorage();
     size_t storageSize = m_structure->propertyStorageSize();
     markStack.appendValues(storage, storageSize);
+    if (m_inheritorID)
+        markStack.append(&m_inheritorID);
 }
 
 // --- JSValue inlines ----------------------------
@@ -776,6 +850,20 @@ inline JSValue JSValue::toStrictThisObject(ExecState* exec) const
     return asObject(asCell())->toStrictThisObject(exec);
 }
 
+ALWAYS_INLINE JSObject* Register::function() const
+{
+    if (!jsValue())
+        return 0;
+    return asObject(jsValue());
+}
+
+ALWAYS_INLINE Register Register::withCallee(JSObject* callee)
+{
+    Register r;
+    r = JSValue(callee);
+    return r;
+}
+
 } // namespace JSC
 
 #endif // JSObject_h
diff --git a/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp
index c16acb1..2b489a2 100644
--- a/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp
@@ -30,8 +30,8 @@
 
 namespace JSC {
 
-JSObjectWithGlobalObject::JSObjectWithGlobalObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
-    : JSObject(structure)
+JSObjectWithGlobalObject::JSObjectWithGlobalObject(JSGlobalObject* globalObject, Structure* structure)
+    : JSNonFinalObject(globalObject->globalData(), structure)
 {
     COMPILE_ASSERT(AnonymousSlotCount == 1, AnonymousSlotCount_must_be_one);
     ASSERT(!globalObject || globalObject->isGlobalObject());
@@ -41,9 +41,15 @@ JSObjectWithGlobalObject::JSObjectWithGlobalObject(JSGlobalObject* globalObject,
         putAnonymousValue(globalObject->globalData(), GlobalObjectSlot, globalObject);
 }
 
-JSGlobalObject* JSObjectWithGlobalObject::globalObject() const
+JSObjectWithGlobalObject::JSObjectWithGlobalObject(JSGlobalData& globalData, JSGlobalObject* globalObject, Structure* structure)
+    : JSNonFinalObject(globalData, structure)
 {
-    return asGlobalObject((getAnonymousValue(GlobalObjectSlot).asCell()));
+    COMPILE_ASSERT(AnonymousSlotCount == 1, AnonymousSlotCount_must_be_one);
+    ASSERT(!globalObject || globalObject->isGlobalObject());
+    if (!globalObject)
+        clearAnonymousValue(GlobalObjectSlot);
+    else
+        putAnonymousValue(globalData, GlobalObjectSlot, globalObject);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h b/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h
index 9416a62..844bcd8 100644
--- a/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSObjectWithGlobalObject.h
@@ -26,26 +26,30 @@
 #ifndef JSObjectWithGlobalObject_h
 #define JSObjectWithGlobalObject_h
 
-#include "JSObject.h"
+#include "JSGlobalObject.h"
 
 namespace JSC {
 
 class JSGlobalObject;
 
-class JSObjectWithGlobalObject : public JSObject {
+class JSObjectWithGlobalObject : public JSNonFinalObject {
 public:
-    static PassRefPtr<Structure> createStructure(JSValue proto)
+    static Structure* createStructure(JSGlobalData& globalData, JSValue proto)
     {
-        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+        return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
-    JSGlobalObject* globalObject() const;
+    JSGlobalObject* globalObject() const
+    {
+        return asGlobalObject((getAnonymousValue(GlobalObjectSlot).asCell()));
+    }
 
 protected:
-    JSObjectWithGlobalObject(JSGlobalObject*, NonNullPassRefPtr<Structure>);
+    JSObjectWithGlobalObject(JSGlobalObject*, Structure*);
+    JSObjectWithGlobalObject(JSGlobalData&, JSGlobalObject*, Structure*);
 
-    JSObjectWithGlobalObject(NonNullPassRefPtr<Structure> structure)
-        : JSObject(structure)
+    JSObjectWithGlobalObject(VPtrStealingHackType)
+        : JSNonFinalObject(VPtrStealingHack)
     {
         // Should only be used by JSFunction when we aquire the JSFunction vptr.
     }
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index 6fd28e3..d5af044 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -35,9 +35,10 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSPropertyNameIterator);
 
+const ClassInfo JSPropertyNameIterator::s_info = { "JSPropertyNameIterator", 0, 0, 0 };
+
 inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlots)
-    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
-    , m_cachedStructure(0)
+    : JSCell(exec->globalData(), exec->globalData().propertyNameIteratorStructure.get())
     , m_numCacheableSlots(numCacheableSlots)
     , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
     , m_jsStrings(adoptArrayPtr(new WriteBarrier<Unknown>[m_jsStringsSize]))
@@ -47,12 +48,6 @@ inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyN
         m_jsStrings[i].set(exec->globalData(), this, jsOwnedString(exec, propertyNameVector[i].ustring()));
 }
 
-JSPropertyNameIterator::~JSPropertyNameIterator()
-{
-    if (m_cachedStructure)
-        m_cachedStructure->clearEnumerationCache(this);
-}
-
 JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject* o)
 {
     ASSERT(!o->structure()->enumerationCache() ||
@@ -77,22 +72,22 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
     
     size_t count = normalizePrototypeChain(exec, o);
     StructureChain* structureChain = o->structure()->prototypeChain(exec);
-    RefPtr<Structure>* structure = structureChain->head();
+    WriteBarrier<Structure>* structure = structureChain->head();
     for (size_t i = 0; i < count; ++i) {
         if (structure[i]->typeInfo().overridesGetPropertyNames())
             return jsPropertyNameIterator;
     }
 
-    jsPropertyNameIterator->setCachedPrototypeChain(structureChain);
-    jsPropertyNameIterator->setCachedStructure(o->structure());
-    o->structure()->setEnumerationCache(jsPropertyNameIterator);
+    jsPropertyNameIterator->setCachedPrototypeChain(exec->globalData(), structureChain);
+    jsPropertyNameIterator->setCachedStructure(exec->globalData(), o->structure());
+    o->structure()->setEnumerationCache(exec->globalData(), jsPropertyNameIterator);
     return jsPropertyNameIterator;
 }
 
 JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
 {
     JSValue identifier = m_jsStrings[i].get();
-    if (m_cachedStructure == base->structure() && m_cachedPrototypeChain == base->structure()->prototypeChain(exec))
+    if (m_cachedStructure.get() == base->structure() && m_cachedPrototypeChain.get() == base->structure()->prototypeChain(exec))
         return identifier;
 
     if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value(exec))))
@@ -103,6 +98,8 @@ JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
 void JSPropertyNameIterator::markChildren(MarkStack& markStack)
 {
     markStack.appendValues(m_jsStrings.get(), m_jsStringsSize, MayContainNullValues);
+    if (m_cachedPrototypeChain)
+        markStack.append(&m_cachedPrototypeChain);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
index cd46243..b857dc0 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -45,12 +45,10 @@ namespace JSC {
     public:
         static JSPropertyNameIterator* create(ExecState*, JSObject*);
         
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesMarkChildren), AnonymousSlotCount, &s_info);
         }
-        
-        virtual ~JSPropertyNameIterator();
 
         virtual bool isPropertyNameIterator() const { return true; }
 
@@ -67,41 +65,42 @@ namespace JSC {
         JSValue get(ExecState*, JSObject*, size_t i);
         size_t size() { return m_jsStringsSize; }
 
-        void setCachedStructure(Structure* structure)
+        void setCachedStructure(JSGlobalData& globalData, Structure* structure)
         {
             ASSERT(!m_cachedStructure);
             ASSERT(structure);
-            m_cachedStructure = structure;
+            m_cachedStructure.set(globalData, this, structure);
         }
         Structure* cachedStructure() { return m_cachedStructure.get(); }
 
-        void setCachedPrototypeChain(NonNullPassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
+        void setCachedPrototypeChain(JSGlobalData& globalData, StructureChain* cachedPrototypeChain) { m_cachedPrototypeChain.set(globalData, this, cachedPrototypeChain); }
         StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
 
     private:
+        static const ClassInfo s_info;
         JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlot);
 
-        RefPtr<Structure> m_cachedStructure;
-        RefPtr<StructureChain> m_cachedPrototypeChain;
+        WriteBarrier<Structure> m_cachedStructure;
+        WriteBarrier<StructureChain> m_cachedPrototypeChain;
         uint32_t m_numCacheableSlots;
         uint32_t m_jsStringsSize;
         OwnArrayPtr<WriteBarrier<Unknown> > m_jsStrings;
     };
 
-    inline void Structure::setEnumerationCache(JSPropertyNameIterator* enumerationCache)
+    inline void Structure::setEnumerationCache(JSGlobalData& globalData, JSPropertyNameIterator* enumerationCache)
     {
         ASSERT(!isDictionary());
-        m_enumerationCache = enumerationCache;
+        m_enumerationCache.set(globalData, this, enumerationCache);
     }
 
-    inline void Structure::clearEnumerationCache(JSPropertyNameIterator* enumerationCache)
+    inline JSPropertyNameIterator* Structure::enumerationCache()
     {
-        m_enumerationCache.clear(enumerationCache);
+        return m_enumerationCache.get();
     }
 
-    inline JSPropertyNameIterator* Structure::enumerationCache()
+    ALWAYS_INLINE JSPropertyNameIterator* Register::propertyNameIterator() const
     {
-        return m_enumerationCache.get();
+        return static_cast<JSPropertyNameIterator*>(jsValue().asCell());
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp b/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
index 80b048e..3d4dc7c 100644
--- a/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
@@ -28,13 +28,12 @@
 #include "JSStaticScopeObject.h"
 
 namespace JSC {
-
 ASSERT_CLASS_FITS_IN_CELL(JSStaticScopeObject);
 
 void JSStaticScopeObject::markChildren(MarkStack& markStack)
 {
     JSVariableObject::markChildren(markStack);
-    markStack.deprecatedAppend(&d()->registerStore);
+    markStack.append(&m_registerStore);
 }
 
 JSObject* JSStaticScopeObject::toThisObject(ExecState* exec) const
@@ -47,17 +46,17 @@ JSValue JSStaticScopeObject::toStrictThisObject(ExecState*) const
     return jsNull();
 }
 
-void JSStaticScopeObject::put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot&)
+void JSStaticScopeObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
-    if (symbolTablePut(propertyName, value))
+    if (symbolTablePut(exec->globalData(), propertyName, value))
         return;
     
     ASSERT_NOT_REACHED();
 }
 
-void JSStaticScopeObject::putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes)
+void JSStaticScopeObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
-    if (symbolTablePutWithAttributes(propertyName, value, attributes))
+    if (symbolTablePutWithAttributes(exec->globalData(), propertyName, value, attributes))
         return;
     
     ASSERT_NOT_REACHED();
@@ -68,13 +67,7 @@ bool JSStaticScopeObject::isDynamicScope(bool&) const
     return false;
 }
 
-JSStaticScopeObject::~JSStaticScopeObject()
-{
-    ASSERT(d());
-    delete d();
-}
-
-inline bool JSStaticScopeObject::getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot& slot)
+bool JSStaticScopeObject::getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot& slot)
 {
     return symbolTableGet(propertyName, slot);
 }
diff --git a/Source/JavaScriptCore/runtime/JSStaticScopeObject.h b/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
index e69356a..8c3a249 100644
--- a/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -31,25 +31,14 @@
 namespace JSC{
     
     class JSStaticScopeObject : public JSVariableObject {
-    protected:
-        using JSVariableObject::JSVariableObjectData;
-        struct JSStaticScopeObjectData : public JSVariableObjectData {
-            JSStaticScopeObjectData()
-                : JSVariableObjectData(&symbolTable, &registerStore + 1)
-            {
-            }
-            SymbolTable symbolTable;
-            Register registerStore;
-        };
-        
     public:
         JSStaticScopeObject(ExecState* exec, const Identifier& ident, JSValue value, unsigned attributes)
-            : JSVariableObject(exec->globalData().staticScopeStructure, new JSStaticScopeObjectData())
+            : JSVariableObject(exec->globalData(), exec->globalData().staticScopeStructure.get(), &m_symbolTable, reinterpret_cast<Register*>(&m_registerStore + 1))
         {
-            d()->registerStore = value;
+            m_registerStore.set(exec->globalData(), this, value);
             symbolTable().add(ident.impl(), SymbolTableEntry(-1, attributes));
         }
-        virtual ~JSStaticScopeObject();
+
         virtual void markChildren(MarkStack&);
         bool isDynamicScope(bool& requiresDynamicChecks) const;
         virtual JSObject* toThisObject(ExecState*) const;
@@ -58,13 +47,14 @@ namespace JSC{
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); }
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); }
 
     protected:
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
 
     private:
-        JSStaticScopeObjectData* d() { return static_cast<JSStaticScopeObjectData*>(JSVariableObject::d); }
+        SymbolTable m_symbolTable;
+        WriteBarrier<Unknown> m_registerStore;
     };
 
 }
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index 848c431..d9c4d46 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -152,7 +152,7 @@ JSString* JSString::substringFromRope(ExecState* exec, unsigned substringStart,
     if (substringLength == 1) {
         ASSERT(substringFiberCount == 1);
         UChar c = substringFibers[0].characters()[0];
-        if (c <= 0xFF)
+        if (c <= maxSingleCharacterString)
             return globalData->smallStrings.singleCharacterString(globalData, c);
     }
     if (substringFiberCount == 1)
@@ -253,19 +253,19 @@ UString JSString::toString(ExecState* exec) const
     return value(exec);
 }
 
-inline StringObject* StringObject::create(ExecState* exec, JSString* string)
+inline StringObject* StringObject::create(ExecState* exec, JSGlobalObject* globalObject, JSString* string)
 {
-    return new (exec) StringObject(exec->globalData(), exec->lexicalGlobalObject()->stringObjectStructure(), string);
+    return new (exec) StringObject(exec->globalData(), globalObject->stringObjectStructure(), string);
 }
 
-JSObject* JSString::toObject(ExecState* exec) const
+JSObject* JSString::toObject(ExecState* exec, JSGlobalObject* globalObject) const
 {
-    return StringObject::create(exec, const_cast<JSString*>(this));
+    return StringObject::create(exec, globalObject, const_cast<JSString*>(this));
 }
 
 JSObject* JSString::toThisObject(ExecState* exec) const
 {
-    return StringObject::create(exec, const_cast<JSString*>(this));
+    return StringObject::create(exec, exec->lexicalGlobalObject(), const_cast<JSString*>(this));
 }
 
 bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 6696404..3422dad 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -26,10 +26,10 @@
 #include "CallFrame.h"
 #include "CommonIdentifiers.h"
 #include "Identifier.h"
-#include "JSNumberCell.h"
 #include "PropertyDescriptor.h"
 #include "PropertySlot.h"
 #include "RopeImpl.h"
+#include "Structure.h"
 
 namespace JSC {
 
@@ -185,7 +185,7 @@ namespace JSC {
         };
 
         ALWAYS_INLINE JSString(JSGlobalData* globalData, const UString& value)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(value.length())
             , m_value(value)
             , m_fiberCount(0)
@@ -196,7 +196,7 @@ namespace JSC {
 
         enum HasOtherOwnerType { HasOtherOwner };
         JSString(JSGlobalData* globalData, const UString& value, HasOtherOwnerType)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(value.length())
             , m_value(value)
             , m_fiberCount(0)
@@ -204,7 +204,7 @@ namespace JSC {
             ASSERT(!m_value.isNull());
         }
         JSString(JSGlobalData* globalData, PassRefPtr<StringImpl> value, HasOtherOwnerType)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(value->length())
             , m_value(value)
             , m_fiberCount(0)
@@ -212,7 +212,7 @@ namespace JSC {
             ASSERT(!m_value.isNull());
         }
         JSString(JSGlobalData* globalData, PassRefPtr<RopeImpl> rope)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(rope->length())
             , m_fiberCount(1)
         {
@@ -221,7 +221,7 @@ namespace JSC {
         // This constructor constructs a new string by concatenating s1 & s2.
         // This should only be called with fiberCount <= 3.
         JSString(JSGlobalData* globalData, unsigned fiberCount, JSString* s1, JSString* s2)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(s1->length() + s2->length())
             , m_fiberCount(fiberCount)
         {
@@ -234,7 +234,7 @@ namespace JSC {
         // This constructor constructs a new string by concatenating s1 & s2.
         // This should only be called with fiberCount <= 3.
         JSString(JSGlobalData* globalData, unsigned fiberCount, JSString* s1, const UString& u2)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(s1->length() + u2.length())
             , m_fiberCount(fiberCount)
         {
@@ -247,7 +247,7 @@ namespace JSC {
         // This constructor constructs a new string by concatenating s1 & s2.
         // This should only be called with fiberCount <= 3.
         JSString(JSGlobalData* globalData, unsigned fiberCount, const UString& u1, JSString* s2)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(u1.length() + s2->length())
             , m_fiberCount(fiberCount)
         {
@@ -262,7 +262,7 @@ namespace JSC {
         // value must require a fiberCount of at least one implies that the length
         // for each value must be exactly 1!
         JSString(ExecState* exec, JSValue v1, JSValue v2, JSValue v3)
-            : JSCell(exec->globalData().stringStructure.get())
+            : JSCell(exec->globalData(), exec->globalData().stringStructure.get())
             , m_length(0)
             , m_fiberCount(s_maxInternalRopeLength)
         {
@@ -275,7 +275,7 @@ namespace JSC {
 
         // This constructor constructs a new string by concatenating u1 & u2.
         JSString(JSGlobalData* globalData, const UString& u1, const UString& u2)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(u1.length() + u2.length())
             , m_fiberCount(2)
         {
@@ -287,7 +287,7 @@ namespace JSC {
 
         // This constructor constructs a new string by concatenating u1, u2 & u3.
         JSString(JSGlobalData* globalData, const UString& u1, const UString& u2, const UString& u3)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(u1.length() + u2.length() + u3.length())
             , m_fiberCount(s_maxInternalRopeLength)
         {
@@ -299,7 +299,7 @@ namespace JSC {
         }
 
         JSString(JSGlobalData* globalData, const UString& value, JSStringFinalizerCallback finalizer, void* context)
-            : JSCell(globalData->stringStructure.get())
+            : JSCell(*globalData, globalData->stringStructure.get())
             , m_length(value.length())
             , m_value(value)
             , m_fiberCount(0)
@@ -349,12 +349,11 @@ namespace JSC {
 
         JSValue replaceCharacter(ExecState*, UChar, const UString& replacement);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount); }
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount, 0); }
 
     private:
-        enum VPtrStealingHackType { VPtrStealingHack };
         JSString(VPtrStealingHackType) 
-            : JSCell(0)
+            : JSCell(VPtrStealingHack)
             , m_fiberCount(0)
         {
         }
@@ -402,7 +401,7 @@ namespace JSC {
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
+        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
         virtual UString toString(ExecState*) const;
 
         virtual JSObject* toThisObject(ExecState*) const;
@@ -468,7 +467,7 @@ namespace JSC {
 
     inline JSString* jsSingleCharacterString(JSGlobalData* globalData, UChar c)
     {
-        if (c <= 0xFF)
+        if (c <= maxSingleCharacterString)
             return globalData->smallStrings.singleCharacterString(globalData, c);
         return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(&c, 1)));
     }
@@ -478,7 +477,7 @@ namespace JSC {
         JSGlobalData* globalData = &exec->globalData();
         ASSERT(offset < static_cast<unsigned>(s.length()));
         UChar c = s.characters()[offset];
-        if (c <= 0xFF)
+        if (c <= maxSingleCharacterString)
             return globalData->smallStrings.singleCharacterString(globalData, c);
         return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(StringImpl::create(s.impl(), offset, 1))));
     }
@@ -513,7 +512,7 @@ namespace JSC {
             return globalData->smallStrings.emptyString(globalData);
         if (size == 1) {
             UChar c = s.characters()[0];
-            if (c <= 0xFF)
+            if (c <= maxSingleCharacterString)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
         return fixupVPtr(globalData, new (globalData) JSString(globalData, s));
@@ -521,7 +520,7 @@ namespace JSC {
 
     inline JSString* jsStringWithFinalizer(ExecState* exec, const UString& s, JSStringFinalizerCallback callback, void* context)
     {
-        ASSERT(s.length() && (s.length() > 1 || s.characters()[0] > 0xFF));
+        ASSERT(s.length() && (s.length() > 1 || s.characters()[0] > maxSingleCharacterString));
         JSGlobalData* globalData = &exec->globalData();
         return fixupVPtr(globalData, new (globalData) JSString(globalData, s, callback, context));
     }
@@ -548,7 +547,7 @@ namespace JSC {
             return globalData->smallStrings.emptyString(globalData);
         if (length == 1) {
             UChar c = s.characters()[offset];
-            if (c <= 0xFF)
+            if (c <= maxSingleCharacterString)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
         return fixupVPtr(globalData, new (globalData) JSString(globalData, UString(StringImpl::create(s.impl(), offset, length)), JSString::HasOtherOwner));
@@ -561,7 +560,7 @@ namespace JSC {
             return globalData->smallStrings.emptyString(globalData);
         if (size == 1) {
             UChar c = s.characters()[0];
-            if (c <= 0xFF)
+            if (c <= maxSingleCharacterString)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
         return fixupVPtr(globalData, new (globalData) JSString(globalData, s, JSString::HasOtherOwner));
diff --git a/Source/JavaScriptCore/runtime/JSType.h b/Source/JavaScriptCore/runtime/JSType.h
index 882b218..dba03f6 100644
--- a/Source/JavaScriptCore/runtime/JSType.h
+++ b/Source/JavaScriptCore/runtime/JSType.h
@@ -33,10 +33,11 @@ namespace JSC {
         NumberType        = 3,
         NullType          = 4,
         StringType        = 5,
+        LeafType          = 6,
         // The CompoundType value must come before any JSType that may have children
-        CompoundType      = 6,
-        ObjectType        = 7,
-        GetterSetterType  = 8
+        CompoundType      = 7,
+        ObjectType        = 8,
+        GetterSetterType  = 9
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSTypeInfo.h b/Source/JavaScriptCore/runtime/JSTypeInfo.h
index e225bc7..acde81f 100644
--- a/Source/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/Source/JavaScriptCore/runtime/JSTypeInfo.h
@@ -43,20 +43,21 @@ namespace JSC {
     static const unsigned OverridesGetOwnPropertySlot = 1 << 5;
     static const unsigned OverridesMarkChildren = 1 << 6;
     static const unsigned OverridesGetPropertyNames = 1 << 7;
+    static const unsigned IsJSFinalObject = 1 << 8;
 
     class TypeInfo {
-        friend class JIT;
     public:
         TypeInfo(JSType type, unsigned flags = 0)
             : m_type(type)
+            , m_flags(flags & 0xFF)
+            , m_flags2(flags >> 8)
         {
-            ASSERT(flags <= 0xFF);
+            ASSERT(flags <= 0x1FF);
             ASSERT(type <= 0xFF);
+            ASSERT(type >= CompoundType || !(flags & OverridesMarkChildren));
             // ImplementsDefaultHasInstance means (ImplementsHasInstance & !OverridesHasInstance)
-            if ((flags & (ImplementsHasInstance | OverridesHasInstance)) == ImplementsHasInstance)
-                m_flags = flags | ImplementsDefaultHasInstance;
-            else
-                m_flags = flags;
+            if ((m_flags & (ImplementsHasInstance | OverridesHasInstance)) == ImplementsHasInstance)
+                m_flags |= ImplementsDefaultHasInstance;
         }
 
         JSType type() const { return (JSType)m_type; }
@@ -69,10 +70,22 @@ namespace JSC {
         bool overridesMarkChildren() const { return m_flags & OverridesMarkChildren; }
         bool overridesGetPropertyNames() const { return m_flags & OverridesGetPropertyNames; }
         unsigned flags() const { return m_flags; }
+        unsigned isFinal() const { return m_flags2 && (IsJSFinalObject >> 8); }
+
+        static ptrdiff_t flagsOffset()
+        {
+            return OBJECT_OFFSETOF(TypeInfo, m_flags);
+        }
+
+        static ptrdiff_t typeOffset()
+        {
+            return OBJECT_OFFSETOF(TypeInfo, m_type);
+        }
 
     private:
         unsigned char m_type;
         unsigned char m_flags;
+        unsigned char m_flags2;
     };
 
 }
diff --git a/Source/JavaScriptCore/runtime/JSValue.cpp b/Source/JavaScriptCore/runtime/JSValue.cpp
index f4662db..d3ee89e 100644
--- a/Source/JavaScriptCore/runtime/JSValue.cpp
+++ b/Source/JavaScriptCore/runtime/JSValue.cpp
@@ -54,14 +54,14 @@ double JSValue::toIntegerPreserveNaN(ExecState* exec) const
     return trunc(toNumber(exec));
 }
 
-JSObject* JSValue::toObjectSlowCase(ExecState* exec) const
+JSObject* JSValue::toObjectSlowCase(ExecState* exec, JSGlobalObject* globalObject) const
 {
     ASSERT(!isCell());
 
     if (isInt32() || isDouble())
-        return constructNumber(exec, asValue());
+        return constructNumber(exec, globalObject, asValue());
     if (isTrue() || isFalse())
-        return constructBooleanFromImmediateBoolean(exec, asValue());
+        return constructBooleanFromImmediateBoolean(exec, globalObject, asValue());
 
     ASSERT(isUndefinedOrNull());
     throwError(exec, createNotAnObjectError(exec, *this));
@@ -73,9 +73,9 @@ JSObject* JSValue::toThisObjectSlowCase(ExecState* exec) const
     ASSERT(!isCell());
 
     if (isInt32() || isDouble())
-        return constructNumber(exec, asValue());
+        return constructNumber(exec, exec->lexicalGlobalObject(), asValue());
     if (isTrue() || isFalse())
-        return constructBooleanFromImmediateBoolean(exec, asValue());
+        return constructBooleanFromImmediateBoolean(exec, exec->lexicalGlobalObject(), asValue());
     ASSERT(isUndefinedOrNull());
     return exec->globalThisValue();
 }
@@ -84,9 +84,9 @@ JSObject* JSValue::synthesizeObject(ExecState* exec) const
 {
     ASSERT(!isCell());
     if (isNumber())
-        return constructNumber(exec, asValue());
+        return constructNumber(exec, exec->lexicalGlobalObject(), asValue());
     if (isBoolean())
-        return constructBooleanFromImmediateBoolean(exec, asValue());
+        return constructBooleanFromImmediateBoolean(exec, exec->lexicalGlobalObject(), asValue());
 
     ASSERT(isUndefinedOrNull());
     throwError(exec, createNotAnObjectError(exec, *this));
diff --git a/Source/JavaScriptCore/runtime/JSValue.h b/Source/JavaScriptCore/runtime/JSValue.h
index b2e7a51..de50011 100644
--- a/Source/JavaScriptCore/runtime/JSValue.h
+++ b/Source/JavaScriptCore/runtime/JSValue.h
@@ -30,14 +30,18 @@
 #include <wtf/Assertions.h>
 #include <wtf/HashTraits.h>
 #include <wtf/MathExtras.h>
+#include <wtf/StdLibExtras.h>
 
 namespace JSC {
 
+    extern const double NaN;
+    extern const double Inf;
+
     class ExecState;
     class Identifier;
     class JSCell;
     class JSGlobalData;
-    class JSImmediate;
+    class JSGlobalObject;
     class JSObject;
     class JSString;
     class PropertySlot;
@@ -47,16 +51,37 @@ namespace JSC {
     struct ClassInfo;
     struct Instruction;
 
-    template <class T> class DeprecatedPtr;
     template <class T> class WriteBarrierBase;
 
     enum PreferredPrimitiveType { NoPreference, PreferNumber, PreferString };
 
+
 #if USE(JSVALUE32_64)
     typedef int64_t EncodedJSValue;
 #else
     typedef void* EncodedJSValue;
 #endif
+    
+    union EncodedValueDescriptor {
+        int64_t asInt64;
+#if USE(JSVALUE32_64)
+        double asDouble;
+#elif USE(JSVALUE64)
+        JSCell* ptr;
+#endif
+        
+#if CPU(BIG_ENDIAN)
+        struct {
+            int32_t tag;
+            int32_t payload;
+        } asBits;
+#else
+        struct {
+            int32_t payload;
+            int32_t tag;
+        } asBits;
+#endif
+    };
 
     double nonInlineNaN();
 
@@ -72,7 +97,6 @@ namespace JSC {
     }
 
     class JSValue {
-        friend class JSImmediate;
         friend struct EncodedJSValueHashTraits;
         friend class JIT;
         friend class JITStubs;
@@ -81,14 +105,9 @@ namespace JSC {
         friend class SpecializedThunkJIT;
 
     public:
-        static EncodedJSValue encode(JSValue value);
-        static JSValue decode(EncodedJSValue ptr);
-#if USE(JSVALUE64)
-    private:
-        static JSValue makeImmediate(intptr_t value);
-        intptr_t immediateValue();
-    public:
-#endif
+        static EncodedJSValue encode(JSValue);
+        static JSValue decode(EncodedJSValue);
+
         enum JSNullTag { JSNull };
         enum JSUndefinedTag { JSUndefined };
         enum JSTrueTag { JSTrue };
@@ -167,6 +186,7 @@ namespace JSC {
         UString toString(ExecState*) const;
         UString toPrimitiveString(ExecState*) const;
         JSObject* toObject(ExecState*) const;
+        JSObject* toObject(ExecState*, JSGlobalObject*) const;
 
         // Integer conversions.
         double toInteger(ExecState*) const;
@@ -215,52 +235,133 @@ namespace JSC {
 #endif
 
     private:
-        template <class T> JSValue(DeprecatedPtr<T>);
         template <class T> JSValue(WriteBarrierBase<T>);
 
         enum HashTableDeletedValueTag { HashTableDeletedValue };
         JSValue(HashTableDeletedValueTag);
 
         inline const JSValue asValue() const { return *this; }
-        JSObject* toObjectSlowCase(ExecState*) const;
+        JSObject* toObjectSlowCase(ExecState*, JSGlobalObject*) const;
         JSObject* toThisObjectSlowCase(ExecState*) const;
 
         JSObject* synthesizePrototype(ExecState*) const;
         JSObject* synthesizeObject(ExecState*) const;
 
 #if USE(JSVALUE32_64)
-        enum { NullTag =         0xffffffff };
-        enum { UndefinedTag =    0xfffffffe };
-        enum { Int32Tag =        0xfffffffd };
-        enum { CellTag =         0xfffffffc };
-        enum { TrueTag =         0xfffffffb };
-        enum { FalseTag =        0xfffffffa };
-        enum { EmptyValueTag =   0xfffffff9 };
-        enum { DeletedValueTag = 0xfffffff8 };
-        
+        /*
+         * On 32-bit platforms USE(JSVALUE32_64) should be defined, and we use a NaN-encoded
+         * form for immediates.
+         *
+         * The encoding makes use of unused NaN space in the IEEE754 representation.  Any value
+         * with the top 13 bits set represents a QNaN (with the sign bit set).  QNaN values
+         * can encode a 51-bit payload.  Hardware produced and C-library payloads typically
+         * have a payload of zero.  We assume that non-zero payloads are available to encode
+         * pointer and integer values.  Since any 64-bit bit pattern where the top 15 bits are
+         * all set represents a NaN with a non-zero payload, we can use this space in the NaN
+         * ranges to encode other values (however there are also other ranges of NaN space that
+         * could have been selected).
+         *
+         * For JSValues that do not contain a double value, the high 32 bits contain the tag
+         * values listed in the enums below, which all correspond to NaN-space. In the case of
+         * cell, integer and bool values the lower 32 bits (the 'payload') contain the pointer
+         * integer or boolean value; in the case of all other tags the payload is 0.
+         */
+        enum { Int32Tag =        0xffffffff };
+        enum { BooleanTag =      0xfffffffe };
+        enum { NullTag =         0xfffffffd };
+        enum { UndefinedTag =    0xfffffffc };
+        enum { CellTag =         0xfffffffb };
+        enum { EmptyValueTag =   0xfffffffa };
+        enum { DeletedValueTag = 0xfffffff9 };
+
         enum { LowestTag =  DeletedValueTag };
-        
+
         uint32_t tag() const;
         int32_t payload() const;
-
-        union {
-            EncodedJSValue asEncodedJSValue;
-            double asDouble;
-#if CPU(BIG_ENDIAN)
-            struct {
-                int32_t tag;
-                int32_t payload;
-            } asBits;
-#else
-            struct {
-                int32_t payload;
-                int32_t tag;
-            } asBits;
+#elif USE(JSVALUE64)
+        /*
+         * On 64-bit platforms USE(JSVALUE64) should be defined, and we use a NaN-encoded
+         * form for immediates.
+         *
+         * The encoding makes use of unused NaN space in the IEEE754 representation.  Any value
+         * with the top 13 bits set represents a QNaN (with the sign bit set).  QNaN values
+         * can encode a 51-bit payload.  Hardware produced and C-library payloads typically
+         * have a payload of zero.  We assume that non-zero payloads are available to encode
+         * pointer and integer values.  Since any 64-bit bit pattern where the top 15 bits are
+         * all set represents a NaN with a non-zero payload, we can use this space in the NaN
+         * ranges to encode other values (however there are also other ranges of NaN space that
+         * could have been selected).
+         *
+         * This range of NaN space is represented by 64-bit numbers begining with the 16-bit
+         * hex patterns 0xFFFE and 0xFFFF - we rely on the fact that no valid double-precision
+         * numbers will begin fall in these ranges.
+         *
+         * The top 16-bits denote the type of the encoded JSValue:
+         *
+         *     Pointer {  0000:PPPP:PPPP:PPPP
+         *              / 0001:****:****:****
+         *     Double  {         ...
+         *              \ FFFE:****:****:****
+         *     Integer {  FFFF:0000:IIII:IIII
+         *
+         * The scheme we have implemented encodes double precision values by performing a
+         * 64-bit integer addition of the value 2^48 to the number. After this manipulation
+         * no encoded double-precision value will begin with the pattern 0x0000 or 0xFFFF.
+         * Values must be decoded by reversing this operation before subsequent floating point
+         * operations my be peformed.
+         *
+         * 32-bit signed integers are marked with the 16-bit tag 0xFFFF.
+         *
+         * The tag 0x0000 denotes a pointer, or another form of tagged immediate. Boolean,
+         * null and undefined values are represented by specific, invalid pointer values:
+         *
+         *     False:     0x06
+         *     True:      0x07
+         *     Undefined: 0x0a
+         *     Null:      0x02
+         *
+         * These values have the following properties:
+         * - Bit 1 (TagBitTypeOther) is set for all four values, allowing real pointers to be
+         *   quickly distinguished from all immediate values, including these invalid pointers.
+         * - With bit 3 is masked out (TagBitUndefined) Undefined and Null share the
+         *   same value, allowing null & undefined to be quickly detected.
+         *
+         * No valid JSValue will have the bit pattern 0x0, this is used to represent array
+         * holes, and as a C++ 'no value' result (e.g. JSValue() has an internal value of 0).
+         */
+
+        // These values are #defines since using static const integers here is a ~1% regression!
+
+        // This value is 2^48, used to encode doubles such that the encoded value will begin
+        // with a 16-bit pattern within the range 0x0001..0xFFFE.
+        #define DoubleEncodeOffset 0x1000000000000ll
+        // If all bits in the mask are set, this indicates an integer number,
+        // if any but not all are set this value is a double precision number.
+        #define TagTypeNumber 0xffff000000000000ll
+
+        // All non-numeric (bool, null, undefined) immediates have bit 2 set.
+        #define TagBitTypeOther 0x2ll
+        #define TagBitBool      0x4ll
+        #define TagBitUndefined 0x8ll
+        // Combined integer value for non-numeric immediates.
+        #define ValueFalse     (TagBitTypeOther | TagBitBool | false)
+        #define ValueTrue      (TagBitTypeOther | TagBitBool | true)
+        #define ValueUndefined (TagBitTypeOther | TagBitUndefined)
+        #define ValueNull      (TagBitTypeOther)
+
+        // TagMask is used to check for all types of immediate values (either number or 'other').
+        #define TagMask (TagTypeNumber | TagBitTypeOther)
+
+        // These special values are never visible to JavaScript code; Empty is used to represent
+        // Array holes, and for uninitialized JSValues. Deleted is used in hash table code.
+        // These values would map to cell types in the JSValue encoding, but not valid GC cell
+        // pointer should have either of these values (Empty is null, deleted is at an invalid
+        // alignment for a GC cell, and in the zero page).
+        #define ValueEmpty   0x0ll
+        #define ValueDeleted 0x4ll
 #endif
-        } u;
-#else // USE(JSVALUE32_64)
-        JSCell* m_ptr;
-#endif // USE(JSVALUE32_64)
+
+        EncodedValueDescriptor u;
     };
 
 #if USE(JSVALUE32_64)
@@ -363,412 +464,7 @@ namespace JSC {
     inline bool operator!=(const JSValue a, const JSCell* b) { return a != JSValue(b); }
     inline bool operator!=(const JSCell* a, const JSValue b) { return JSValue(a) != b; }
 
-    ALWAYS_INLINE int32_t JSValue::toInt32(ExecState* exec) const
-    {
-        if (isInt32())
-            return asInt32();
-        return JSC::toInt32(toNumber(exec));
-    }
-
-    inline uint32_t JSValue::toUInt32(ExecState* exec) const
-    {
-        // See comment on JSC::toUInt32, above.
-        return toInt32(exec);
-    }
-
-#if USE(JSVALUE32_64)
-    inline JSValue jsNaN()
-    {
-        return JSValue(nonInlineNaN());
-    }
-
-    // JSValue member functions.
-    inline EncodedJSValue JSValue::encode(JSValue value)
-    {
-        return value.u.asEncodedJSValue;
-    }
-
-    inline JSValue JSValue::decode(EncodedJSValue encodedJSValue)
-    {
-        JSValue v;
-        v.u.asEncodedJSValue = encodedJSValue;
-#if ENABLE(JSC_ZOMBIES)
-        ASSERT(!v.isZombie());
-#endif
-        return v;
-    }
-
-    inline JSValue::JSValue()
-    {
-        u.asBits.tag = EmptyValueTag;
-        u.asBits.payload = 0;
-    }
-
-    inline JSValue::JSValue(JSNullTag)
-    {
-        u.asBits.tag = NullTag;
-        u.asBits.payload = 0;
-    }
-    
-    inline JSValue::JSValue(JSUndefinedTag)
-    {
-        u.asBits.tag = UndefinedTag;
-        u.asBits.payload = 0;
-    }
-    
-    inline JSValue::JSValue(JSTrueTag)
-    {
-        u.asBits.tag = TrueTag;
-        u.asBits.payload = 0;
-    }
-    
-    inline JSValue::JSValue(JSFalseTag)
-    {
-        u.asBits.tag = FalseTag;
-        u.asBits.payload = 0;
-    }
-
-    inline JSValue::JSValue(HashTableDeletedValueTag)
-    {
-        u.asBits.tag = DeletedValueTag;
-        u.asBits.payload = 0;
-    }
-
-    inline JSValue::JSValue(JSCell* ptr)
-    {
-        if (ptr)
-            u.asBits.tag = CellTag;
-        else
-            u.asBits.tag = EmptyValueTag;
-        u.asBits.payload = reinterpret_cast<int32_t>(ptr);
-#if ENABLE(JSC_ZOMBIES)
-        ASSERT(!isZombie());
-#endif
-    }
-
-    inline JSValue::JSValue(const JSCell* ptr)
-    {
-        if (ptr)
-            u.asBits.tag = CellTag;
-        else
-            u.asBits.tag = EmptyValueTag;
-        u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
-#if ENABLE(JSC_ZOMBIES)
-        ASSERT(!isZombie());
-#endif
-    }
-
-    inline JSValue::operator bool() const
-    {
-        ASSERT(tag() != DeletedValueTag);
-        return tag() != EmptyValueTag;
-    }
-
-    inline bool JSValue::operator==(const JSValue& other) const
-    {
-        return u.asEncodedJSValue == other.u.asEncodedJSValue;
-    }
-
-    inline bool JSValue::operator!=(const JSValue& other) const
-    {
-        return u.asEncodedJSValue != other.u.asEncodedJSValue;
-    }
-
-    inline bool JSValue::isUndefined() const
-    {
-        return tag() == UndefinedTag;
-    }
-
-    inline bool JSValue::isNull() const
-    {
-        return tag() == NullTag;
-    }
-
-    inline bool JSValue::isUndefinedOrNull() const
-    {
-        return isUndefined() || isNull();
-    }
-
-    inline bool JSValue::isCell() const
-    {
-        return tag() == CellTag;
-    }
-
-    inline bool JSValue::isInt32() const
-    {
-        return tag() == Int32Tag;
-    }
-
-    inline bool JSValue::isUInt32() const
-    {
-        return tag() == Int32Tag && asInt32() > -1;
-    }
-
-    inline bool JSValue::isDouble() const
-    {
-        return tag() < LowestTag;
-    }
-
-    inline bool JSValue::isTrue() const
-    {
-        return tag() == TrueTag;
-    }
-
-    inline bool JSValue::isFalse() const
-    {
-        return tag() == FalseTag;
-    }
-
-    inline uint32_t JSValue::tag() const
-    {
-        return u.asBits.tag;
-    }
-    
-    inline int32_t JSValue::payload() const
-    {
-        return u.asBits.payload;
-    }
-    
-    inline int32_t JSValue::asInt32() const
-    {
-        ASSERT(isInt32());
-        return u.asBits.payload;
-    }
-    
-    inline uint32_t JSValue::asUInt32() const
-    {
-        ASSERT(isUInt32());
-        return u.asBits.payload;
-    }
-    
-    inline double JSValue::asDouble() const
-    {
-        ASSERT(isDouble());
-        return u.asDouble;
-    }
-    
-    ALWAYS_INLINE JSCell* JSValue::asCell() const
-    {
-        ASSERT(isCell());
-        return reinterpret_cast<JSCell*>(u.asBits.payload);
-    }
-
-    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, double d)
-    {
-        u.asDouble = d;
-    }
-
-    inline JSValue::JSValue(double d)
-    {
-        const int32_t asInt32 = static_cast<int32_t>(d);
-        if (asInt32 != d || (!asInt32 && signbit(d))) { // true for -0.0
-            u.asDouble = d;
-            return;
-        }
-        *this = JSValue(static_cast<int32_t>(d));
-    }
-
-    inline JSValue::JSValue(char i)
-    {
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(unsigned char i)
-    {
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(short i)
-    {
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(unsigned short i)
-    {
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(int i)
-    {
-        u.asBits.tag = Int32Tag;
-        u.asBits.payload = i;
-    }
-
-    inline JSValue::JSValue(unsigned i)
-    {
-        if (static_cast<int32_t>(i) < 0) {
-            *this = JSValue(static_cast<double>(i));
-            return;
-        }
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(long i)
-    {
-        if (static_cast<int32_t>(i) != i) {
-            *this = JSValue(static_cast<double>(i));
-            return;
-        }
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(unsigned long i)
-    {
-        if (static_cast<uint32_t>(i) != i) {
-            *this = JSValue(static_cast<double>(i));
-            return;
-        }
-        *this = JSValue(static_cast<uint32_t>(i));
-    }
-
-    inline JSValue::JSValue(long long i)
-    {
-        if (static_cast<int32_t>(i) != i) {
-            *this = JSValue(static_cast<double>(i));
-            return;
-        }
-        *this = JSValue(static_cast<int32_t>(i));
-    }
-
-    inline JSValue::JSValue(unsigned long long i)
-    {
-        if (static_cast<uint32_t>(i) != i) {
-            *this = JSValue(static_cast<double>(i));
-            return;
-        }
-        *this = JSValue(static_cast<uint32_t>(i));
-    }
-
-    inline bool JSValue::isNumber() const
-    {
-        return isInt32() || isDouble();
-    }
-
-    inline bool JSValue::isBoolean() const
-    {
-        return isTrue() || isFalse();
-    }
-
-    inline bool JSValue::getBoolean(bool& v) const
-    {
-        if (isTrue()) {
-            v = true;
-            return true;
-        }
-        if (isFalse()) {
-            v = false;
-            return true;
-        }
-        
-        return false;
-    }
-
-    inline bool JSValue::getBoolean() const
-    {
-        ASSERT(isBoolean());
-        return tag() == TrueTag;
-    }
-
-    inline double JSValue::uncheckedGetNumber() const
-    {
-        ASSERT(isNumber());
-        return isInt32() ? asInt32() : asDouble();
-    }
-
-    ALWAYS_INLINE JSValue JSValue::toJSNumber(ExecState* exec) const
-    {
-        return isNumber() ? asValue() : jsNumber(this->toNumber(exec));
-    }
-
-    inline bool JSValue::getNumber(double& result) const
-    {
-        if (isInt32()) {
-            result = asInt32();
-            return true;
-        }
-        if (isDouble()) {
-            result = asDouble();
-            return true;
-        }
-        return false;
-    }
-
-#else // USE(JSVALUE32_64)
-
-    // JSValue member functions.
-    inline EncodedJSValue JSValue::encode(JSValue value)
-    {
-        return reinterpret_cast<EncodedJSValue>(value.m_ptr);
-    }
-
-    inline JSValue JSValue::decode(EncodedJSValue ptr)
-    {
-        return JSValue(reinterpret_cast<JSCell*>(ptr));
-    }
-
-    inline JSValue JSValue::makeImmediate(intptr_t value)
-    {
-        return JSValue(reinterpret_cast<JSCell*>(value));
-    }
-
-    inline intptr_t JSValue::immediateValue()
-    {
-        return reinterpret_cast<intptr_t>(m_ptr);
-    }
-    
-    // 0x0 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x0, which is in the (invalid) zero page.
-    inline JSValue::JSValue()
-        : m_ptr(0)
-    {
-    }
-
-    // 0x4 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x4, which is in the (invalid) zero page.
-    inline JSValue::JSValue(HashTableDeletedValueTag)
-        : m_ptr(reinterpret_cast<JSCell*>(0x4))
-    {
-    }
-
-    inline JSValue::JSValue(JSCell* ptr)
-        : m_ptr(ptr)
-    {
-#if ENABLE(JSC_ZOMBIES)
-        ASSERT(!isZombie());
-#endif
-    }
-
-    inline JSValue::JSValue(const JSCell* ptr)
-        : m_ptr(const_cast<JSCell*>(ptr))
-    {
-#if ENABLE(JSC_ZOMBIES)
-        ASSERT(!isZombie());
-#endif
-    }
-
-    inline JSValue::operator bool() const
-    {
-        return m_ptr;
-    }
-
-    inline bool JSValue::operator==(const JSValue& other) const
-    {
-        return m_ptr == other.m_ptr;
-    }
-
-    inline bool JSValue::operator!=(const JSValue& other) const
-    {
-        return m_ptr != other.m_ptr;
-    }
-
-    inline bool JSValue::isUndefined() const
-    {
-        return asValue() == jsUndefined();
-    }
-
-    inline bool JSValue::isNull() const
-    {
-        return asValue() == jsNull();
-    }
-#endif // USE(JSVALUE32_64)
+    bool isZombie(const JSCell*);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/JSValueInlineMethods.h b/Source/JavaScriptCore/runtime/JSValueInlineMethods.h
new file mode 100644
index 0000000..b4f6f80
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSValueInlineMethods.h
@@ -0,0 +1,532 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSValueInlineMethods_h
+#define JSValueInlineMethods_h
+
+#include "JSValue.h"
+
+namespace JSC {
+
+    ALWAYS_INLINE int32_t JSValue::toInt32(ExecState* exec) const
+    {
+        if (isInt32())
+            return asInt32();
+        return JSC::toInt32(toNumber(exec));
+    }
+
+    inline uint32_t JSValue::toUInt32(ExecState* exec) const
+    {
+        // See comment on JSC::toUInt32, above.
+        return toInt32(exec);
+    }
+
+    inline bool JSValue::isUInt32() const
+    {
+        return isInt32() && asInt32() >= 0;
+    }
+
+    inline uint32_t JSValue::asUInt32() const
+    {
+        ASSERT(isUInt32());
+        return asInt32();
+    }
+
+    inline double JSValue::uncheckedGetNumber() const
+    {
+        ASSERT(isNumber());
+        return isInt32() ? asInt32() : asDouble();
+    }
+
+    ALWAYS_INLINE JSValue JSValue::toJSNumber(ExecState* exec) const
+    {
+        return isNumber() ? asValue() : jsNumber(this->toNumber(exec));
+    }
+
+    inline JSValue jsNaN()
+    {
+        return JSValue(nonInlineNaN());
+    }
+
+    inline bool JSValue::getNumber(double& result) const
+    {
+        if (isInt32()) {
+            result = asInt32();
+            return true;
+        }
+        if (isDouble()) {
+            result = asDouble();
+            return true;
+        }
+        return false;
+    }
+
+    inline bool JSValue::getBoolean(bool& v) const
+    {
+        if (isTrue()) {
+            v = true;
+            return true;
+        }
+        if (isFalse()) {
+            v = false;
+            return true;
+        }
+        
+        return false;
+    }
+
+    inline JSValue::JSValue(char i)
+    {
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(unsigned char i)
+    {
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(short i)
+    {
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(unsigned short i)
+    {
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(unsigned i)
+    {
+        if (static_cast<int32_t>(i) < 0) {
+            *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(long i)
+    {
+        if (static_cast<int32_t>(i) != i) {
+            *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(unsigned long i)
+    {
+        if (static_cast<uint32_t>(i) != i) {
+            *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(static_cast<uint32_t>(i));
+    }
+
+    inline JSValue::JSValue(long long i)
+    {
+        if (static_cast<int32_t>(i) != i) {
+            *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(static_cast<int32_t>(i));
+    }
+
+    inline JSValue::JSValue(unsigned long long i)
+    {
+        if (static_cast<uint32_t>(i) != i) {
+            *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+            return;
+        }
+        *this = JSValue(static_cast<uint32_t>(i));
+    }
+
+    inline JSValue::JSValue(double d)
+    {
+        const int32_t asInt32 = static_cast<int32_t>(d);
+        if (asInt32 != d || (!asInt32 && signbit(d))) { // true for -0.0
+            *this = JSValue(EncodeAsDouble, d);
+            return;
+        }
+        *this = JSValue(static_cast<int32_t>(d));
+    }
+
+#if USE(JSVALUE32_64)
+    inline EncodedJSValue JSValue::encode(JSValue value)
+    {
+        return value.u.asInt64;
+    }
+
+    inline JSValue JSValue::decode(EncodedJSValue encodedJSValue)
+    {
+        JSValue v;
+        v.u.asInt64 = encodedJSValue;
+        return v;
+    }
+
+    inline JSValue::JSValue()
+    {
+        u.asBits.tag = EmptyValueTag;
+        u.asBits.payload = 0;
+    }
+
+    inline JSValue::JSValue(JSNullTag)
+    {
+        u.asBits.tag = NullTag;
+        u.asBits.payload = 0;
+    }
+    
+    inline JSValue::JSValue(JSUndefinedTag)
+    {
+        u.asBits.tag = UndefinedTag;
+        u.asBits.payload = 0;
+    }
+    
+    inline JSValue::JSValue(JSTrueTag)
+    {
+        u.asBits.tag = BooleanTag;
+        u.asBits.payload = 1;
+    }
+    
+    inline JSValue::JSValue(JSFalseTag)
+    {
+        u.asBits.tag = BooleanTag;
+        u.asBits.payload = 0;
+    }
+
+    inline JSValue::JSValue(HashTableDeletedValueTag)
+    {
+        u.asBits.tag = DeletedValueTag;
+        u.asBits.payload = 0;
+    }
+
+    inline JSValue::JSValue(JSCell* ptr)
+    {
+        if (ptr)
+            u.asBits.tag = CellTag;
+        else
+            u.asBits.tag = EmptyValueTag;
+        u.asBits.payload = reinterpret_cast<int32_t>(ptr);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
+    }
+
+    inline JSValue::JSValue(const JSCell* ptr)
+    {
+        if (ptr)
+            u.asBits.tag = CellTag;
+        else
+            u.asBits.tag = EmptyValueTag;
+        u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
+    }
+
+    inline JSValue::operator bool() const
+    {
+        ASSERT(tag() != DeletedValueTag);
+        return tag() != EmptyValueTag;
+    }
+
+    inline bool JSValue::operator==(const JSValue& other) const
+    {
+        return u.asInt64 == other.u.asInt64;
+    }
+
+    inline bool JSValue::operator!=(const JSValue& other) const
+    {
+        return u.asInt64 != other.u.asInt64;
+    }
+
+    inline bool JSValue::isUndefined() const
+    {
+        return tag() == UndefinedTag;
+    }
+
+    inline bool JSValue::isNull() const
+    {
+        return tag() == NullTag;
+    }
+
+    inline bool JSValue::isUndefinedOrNull() const
+    {
+        return isUndefined() || isNull();
+    }
+
+    inline bool JSValue::isCell() const
+    {
+        return tag() == CellTag;
+    }
+
+    inline bool JSValue::isInt32() const
+    {
+        return tag() == Int32Tag;
+    }
+
+    inline bool JSValue::isDouble() const
+    {
+        return tag() < LowestTag;
+    }
+
+    inline bool JSValue::isTrue() const
+    {
+        return tag() == BooleanTag && payload();
+    }
+
+    inline bool JSValue::isFalse() const
+    {
+        return tag() == BooleanTag && !payload();
+    }
+
+    inline uint32_t JSValue::tag() const
+    {
+        return u.asBits.tag;
+    }
+    
+    inline int32_t JSValue::payload() const
+    {
+        return u.asBits.payload;
+    }
+    
+    inline int32_t JSValue::asInt32() const
+    {
+        ASSERT(isInt32());
+        return u.asBits.payload;
+    }
+    
+    inline double JSValue::asDouble() const
+    {
+        ASSERT(isDouble());
+        return u.asDouble;
+    }
+    
+    ALWAYS_INLINE JSCell* JSValue::asCell() const
+    {
+        ASSERT(isCell());
+        return reinterpret_cast<JSCell*>(u.asBits.payload);
+    }
+
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, double d)
+    {
+        u.asDouble = d;
+    }
+
+    inline JSValue::JSValue(int i)
+    {
+        u.asBits.tag = Int32Tag;
+        u.asBits.payload = i;
+    }
+
+    inline bool JSValue::isNumber() const
+    {
+        return isInt32() || isDouble();
+    }
+
+    inline bool JSValue::isBoolean() const
+    {
+        return isTrue() || isFalse();
+    }
+
+    inline bool JSValue::getBoolean() const
+    {
+        ASSERT(isBoolean());
+        return payload();
+    }
+
+#else // USE(JSVALUE32_64)
+
+    // JSValue member functions.
+    inline EncodedJSValue JSValue::encode(JSValue value)
+    {
+        return value.u.ptr;
+    }
+
+    inline JSValue JSValue::decode(EncodedJSValue ptr)
+    {
+        return JSValue(reinterpret_cast<JSCell*>(ptr));
+    }
+
+    // 0x0 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x0, which is in the (invalid) zero page.
+    inline JSValue::JSValue()
+    {
+        u.asInt64 = ValueEmpty;
+    }
+
+    // 0x4 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x4, which is in the (invalid) zero page.
+    inline JSValue::JSValue(HashTableDeletedValueTag)
+    {
+        u.asInt64 = ValueDeleted;
+    }
+
+    inline JSValue::JSValue(JSCell* ptr)
+    {
+        u.ptr = ptr;
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
+    }
+
+    inline JSValue::JSValue(const JSCell* ptr)
+    {
+        u.ptr = const_cast<JSCell*>(ptr);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie());
+#endif
+    }
+
+    inline JSValue::operator bool() const
+    {
+        return u.ptr;
+    }
+
+    inline bool JSValue::operator==(const JSValue& other) const
+    {
+        return u.ptr == other.u.ptr;
+    }
+
+    inline bool JSValue::operator!=(const JSValue& other) const
+    {
+        return u.ptr != other.u.ptr;
+    }
+
+    inline bool JSValue::isUndefined() const
+    {
+        return asValue() == jsUndefined();
+    }
+
+    inline bool JSValue::isNull() const
+    {
+        return asValue() == jsNull();
+    }
+
+    inline bool JSValue::isTrue() const
+    {
+        return asValue() == JSValue(JSTrue);
+    }
+
+    inline bool JSValue::isFalse() const
+    {
+        return asValue() == JSValue(JSFalse);
+    }
+
+    inline bool JSValue::getBoolean() const
+    {
+        ASSERT(asValue() == jsBoolean(true) || asValue() == jsBoolean(false));
+        return asValue() == jsBoolean(true);
+    }
+
+    inline int32_t JSValue::asInt32() const
+    {
+        ASSERT(isInt32());
+        return static_cast<int32_t>(u.asInt64);
+    }
+
+    inline bool JSValue::isDouble() const
+    {
+        return isNumber() && !isInt32();
+    }
+
+    inline JSValue::JSValue(JSNullTag)
+    {
+        u.asInt64 = ValueNull;
+    }
+    
+    inline JSValue::JSValue(JSUndefinedTag)
+    {
+        u.asInt64 = ValueUndefined;
+    }
+
+    inline JSValue::JSValue(JSTrueTag)
+    {
+        u.asInt64 = ValueTrue;
+    }
+
+    inline JSValue::JSValue(JSFalseTag)
+    {
+        u.asInt64 = ValueFalse;
+    }
+
+    inline bool JSValue::isUndefinedOrNull() const
+    {
+        // Undefined and null share the same value, bar the 'undefined' bit in the extended tag.
+        return (u.asInt64 & ~TagBitUndefined) == ValueNull;
+    }
+
+    inline bool JSValue::isBoolean() const
+    {
+        return (u.asInt64 & ~1) == ValueFalse;
+    }
+
+    inline bool JSValue::isCell() const
+    {
+        return !(u.asInt64 & TagMask);
+    }
+
+    inline bool JSValue::isInt32() const
+    {
+        return (u.asInt64 & TagTypeNumber) == TagTypeNumber;
+    }
+
+    inline intptr_t reinterpretDoubleToIntptr(double value)
+    {
+        return bitwise_cast<intptr_t>(value);
+    }
+    inline double reinterpretIntptrToDouble(intptr_t value)
+    {
+        return bitwise_cast<double>(value);
+    }
+
+    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, double d)
+    {
+        u.asInt64 = reinterpretDoubleToIntptr(d) + DoubleEncodeOffset;
+    }
+
+    inline JSValue::JSValue(int i)
+    {
+        u.asInt64 = TagTypeNumber | static_cast<uint32_t>(i);
+    }
+
+    inline double JSValue::asDouble() const
+    {
+        return reinterpretIntptrToDouble(u.asInt64 - DoubleEncodeOffset);
+    }
+
+    inline bool JSValue::isNumber() const
+    {
+        return u.asInt64 & TagTypeNumber;
+    }
+
+    ALWAYS_INLINE JSCell* JSValue::asCell() const
+    {
+        ASSERT(isCell());
+        return u.ptr;
+    }
+
+#endif // USE(JSVALUE64)
+
+} // namespace JSC
+
+#endif // JSValueInlineMethods_h
diff --git a/Source/JavaScriptCore/runtime/JSVariableObject.cpp b/Source/JavaScriptCore/runtime/JSVariableObject.cpp
index 81d05ba..abe9bbb 100644
--- a/Source/JavaScriptCore/runtime/JSVariableObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSVariableObject.cpp
@@ -62,7 +62,7 @@ bool JSVariableObject::symbolTableGet(const Identifier& propertyName, PropertyDe
 {
     SymbolTableEntry entry = symbolTable().inlineGet(propertyName.impl());
     if (!entry.isNull()) {
-        descriptor.setDescriptor(registerAt(entry.getIndex()).jsValue(), entry.getAttributes() | DontDelete);
+        descriptor.setDescriptor(registerAt(entry.getIndex()).get(), entry.getAttributes() | DontDelete);
         return true;
     }
     return false;
diff --git a/Source/JavaScriptCore/runtime/JSVariableObject.h b/Source/JavaScriptCore/runtime/JSVariableObject.h
index 96a0ec4..89bb6b0 100644
--- a/Source/JavaScriptCore/runtime/JSVariableObject.h
+++ b/Source/JavaScriptCore/runtime/JSVariableObject.h
@@ -40,11 +40,11 @@ namespace JSC {
 
     class Register;
 
-    class JSVariableObject : public JSObject {
+    class JSVariableObject : public JSNonFinalObject {
         friend class JIT;
 
     public:
-        SymbolTable& symbolTable() const { return *d->symbolTable; }
+        SymbolTable& symbolTable() const { return *m_symbolTable; }
 
         virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes) = 0;
 
@@ -54,58 +54,46 @@ namespace JSC {
         virtual bool isVariableObject() const;
         virtual bool isDynamicScope(bool& requiresDynamicChecks) const = 0;
 
-        Register& registerAt(int index) const { return d->registers[index]; }
+        WriteBarrier<Unknown>& registerAt(int index) const { return m_registers[index]; }
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        WriteBarrier<Unknown>* const * addressOfRegisters() const { return &m_registers; }
+
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
         
     protected:
         static const unsigned StructureFlags = OverridesGetPropertyNames | JSObject::StructureFlags;
-        // Subclasses of JSVariableObject can subclass this struct to add data
-        // without increasing their own size (since there's a hard limit on the
-        // size of a JSCell).
-        struct JSVariableObjectData {
-            JSVariableObjectData(SymbolTable* symbolTable, Register* registers)
-                : symbolTable(symbolTable)
-                , registers(registers)
-            {
-                ASSERT(symbolTable);
-            }
-
-            SymbolTable* symbolTable; // Maps name -> offset from "r" in register file.
-            Register* registers; // "r" in the register file.
-            OwnArrayPtr<Register> registerArray; // Independent copy of registers, used when a variable object copies its registers out of the register file.
-
-        private:
-            JSVariableObjectData(const JSVariableObjectData&);
-            JSVariableObjectData& operator=(const JSVariableObjectData&);
-        };
-
-        JSVariableObject(NonNullPassRefPtr<Structure> structure, JSVariableObjectData* data)
-            : JSObject(structure)
-            , d(data) // Subclass owns this pointer.
+
+        JSVariableObject(JSGlobalData& globalData, Structure* structure, SymbolTable* symbolTable, Register* registers)
+            : JSNonFinalObject(globalData, structure)
+            , m_symbolTable(symbolTable)
+            , m_registers(reinterpret_cast<WriteBarrier<Unknown>*>(registers))
         {
+            ASSERT(m_symbolTable);
+            COMPILE_ASSERT(sizeof(WriteBarrier<Unknown>) == sizeof(Register), Register_should_be_same_size_as_WriteBarrier);
         }
 
-        PassOwnArrayPtr<Register> copyRegisterArray(Register* src, size_t count);
-        void setRegisters(Register* registers, PassOwnArrayPtr<Register> registerArray);
+        PassOwnArrayPtr<WriteBarrier<Unknown> > copyRegisterArray(JSGlobalData&, WriteBarrier<Unknown>* src, size_t count, size_t callframeStarts);
+        void setRegisters(WriteBarrier<Unknown>* registers, PassOwnArrayPtr<WriteBarrier<Unknown> > registerArray);
 
         bool symbolTableGet(const Identifier&, PropertySlot&);
         bool symbolTableGet(const Identifier&, PropertyDescriptor&);
         bool symbolTableGet(const Identifier&, PropertySlot&, bool& slotIsWriteable);
-        bool symbolTablePut(const Identifier&, JSValue);
-        bool symbolTablePutWithAttributes(const Identifier&, JSValue, unsigned attributes);
+        bool symbolTablePut(JSGlobalData&, const Identifier&, JSValue);
+        bool symbolTablePutWithAttributes(JSGlobalData&, const Identifier&, JSValue, unsigned attributes);
 
-        JSVariableObjectData* d;
+        SymbolTable* m_symbolTable; // Maps name -> offset from "r" in register file.
+        WriteBarrier<Unknown>* m_registers; // "r" in the register file.
+        OwnArrayPtr<WriteBarrier<Unknown> > m_registerArray; // Independent copy of registers, used when a variable object copies its registers out of the register file.
     };
 
     inline bool JSVariableObject::symbolTableGet(const Identifier& propertyName, PropertySlot& slot)
     {
         SymbolTableEntry entry = symbolTable().inlineGet(propertyName.impl());
         if (!entry.isNull()) {
-            slot.setRegisterSlot(&registerAt(entry.getIndex()));
+            slot.setValue(registerAt(entry.getIndex()).get());
             return true;
         }
         return false;
@@ -115,14 +103,14 @@ namespace JSC {
     {
         SymbolTableEntry entry = symbolTable().inlineGet(propertyName.impl());
         if (!entry.isNull()) {
-            slot.setRegisterSlot(&registerAt(entry.getIndex()));
+            slot.setValue(registerAt(entry.getIndex()).get());
             slotIsWriteable = !entry.isReadOnly();
             return true;
         }
         return false;
     }
 
-    inline bool JSVariableObject::symbolTablePut(const Identifier& propertyName, JSValue value)
+    inline bool JSVariableObject::symbolTablePut(JSGlobalData& globalData, const Identifier& propertyName, JSValue value)
     {
         ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -131,11 +119,11 @@ namespace JSC {
             return false;
         if (entry.isReadOnly())
             return true;
-        registerAt(entry.getIndex()) = value;
+        registerAt(entry.getIndex()).set(globalData, this, value);
         return true;
     }
 
-    inline bool JSVariableObject::symbolTablePutWithAttributes(const Identifier& propertyName, JSValue value, unsigned attributes)
+    inline bool JSVariableObject::symbolTablePutWithAttributes(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
     {
         ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -145,23 +133,26 @@ namespace JSC {
         SymbolTableEntry& entry = iter->second;
         ASSERT(!entry.isNull());
         entry.setAttributes(attributes);
-        registerAt(entry.getIndex()) = value;
+        registerAt(entry.getIndex()).set(globalData, this, value);
         return true;
     }
 
-    inline PassOwnArrayPtr<Register> JSVariableObject::copyRegisterArray(Register* src, size_t count)
+    inline PassOwnArrayPtr<WriteBarrier<Unknown> > JSVariableObject::copyRegisterArray(JSGlobalData& globalData, WriteBarrier<Unknown>* src, size_t count, size_t callframeStarts)
     {
-        OwnArrayPtr<Register> registerArray = adoptArrayPtr(new Register[count]);
-        memcpy(registerArray.get(), src, count * sizeof(Register));
+        OwnArrayPtr<WriteBarrier<Unknown> > registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[count]);
+        for (size_t i = 0; i < callframeStarts; i++)
+            registerArray[i].set(globalData, this, src[i].get());
+        for (size_t i = callframeStarts + RegisterFile::CallFrameHeaderSize; i < count; i++)
+            registerArray[i].set(globalData, this, src[i].get());
 
         return registerArray.release();
     }
 
-    inline void JSVariableObject::setRegisters(Register* registers, PassOwnArrayPtr<Register> registerArray)
+    inline void JSVariableObject::setRegisters(WriteBarrier<Unknown>* registers, PassOwnArrayPtr<WriteBarrier<Unknown> > registerArray)
     {
-        ASSERT(registerArray != d->registerArray);
-        d->registerArray = registerArray;
-        d->registers = registers;
+        ASSERT(registerArray != m_registerArray);
+        m_registerArray = registerArray;
+        m_registers = registers;
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSWrapperObject.h b/Source/JavaScriptCore/runtime/JSWrapperObject.h
index 0b0d3fd..a7dbe0d 100644
--- a/Source/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/Source/JavaScriptCore/runtime/JSWrapperObject.h
@@ -28,21 +28,21 @@ namespace JSC {
 
     // This class is used as a base for classes such as String,
     // Number, Boolean and Date which are wrappers for primitive types.
-    class JSWrapperObject : public JSObject {
+    class JSWrapperObject : public JSNonFinalObject {
     protected:
-        explicit JSWrapperObject(JSGlobalData&, NonNullPassRefPtr<Structure>);
+        explicit JSWrapperObject(JSGlobalData&, Structure*);
 
     public:
-        JSValue internalValue() const { return m_internalValue.get(); }
+        JSValue internalValue() const;
         void setInternalValue(JSGlobalData&, JSValue);
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
-        static const unsigned AnonymousSlotCount = 1 + JSObject::AnonymousSlotCount;
+        static const unsigned StructureFlags = OverridesMarkChildren | JSNonFinalObject::StructureFlags;
 
     private:
         virtual void markChildren(MarkStack&);
@@ -50,10 +50,14 @@ namespace JSC {
         WriteBarrier<Unknown> m_internalValue;
     };
 
-    inline JSWrapperObject::JSWrapperObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure)
-        : JSObject(structure)
+    inline JSWrapperObject::JSWrapperObject(JSGlobalData& globalData, Structure* structure)
+        : JSNonFinalObject(globalData, structure)
     {
-        putAnonymousValue(globalData, 0, jsNull());
+    }
+
+    inline JSValue JSWrapperObject::internalValue() const
+    {
+        return m_internalValue.get();
     }
 
     inline void JSWrapperObject::setInternalValue(JSGlobalData& globalData, JSValue value)
@@ -61,7 +65,6 @@ namespace JSC {
         ASSERT(value);
         ASSERT(!value.isObject());
         m_internalValue.set(globalData, this, value);
-        putAnonymousValue(globalData, 0, value);
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSZombie.cpp b/Source/JavaScriptCore/runtime/JSZombie.cpp
index 8a36bda..efabc93 100644
--- a/Source/JavaScriptCore/runtime/JSZombie.cpp
+++ b/Source/JavaScriptCore/runtime/JSZombie.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSZombie.h"
 #include "ClassInfo.h"
+#include "JSObject.h"
+#include "ScopeChain.h"
 
 #if ENABLE(JSC_ZOMBIES)
 
@@ -33,16 +35,6 @@ namespace JSC {
 
 const ClassInfo JSZombie::s_info = { "Zombie", 0, 0, 0 };
 
-Structure* JSZombie::leakedZombieStructure() {
-    static Structure* structure = 0;
-    if (!structure) {
-        Structure::startIgnoringLeaks();
-        structure = Structure::create(jsNull(), TypeInfo(UnspecifiedType), 0).leakRef();
-        Structure::stopIgnoringLeaks();
-    }
-    return structure;
-}
-
 }
 
 #endif // ENABLE(JSC_ZOMBIES)
diff --git a/Source/JavaScriptCore/runtime/JSZombie.h b/Source/JavaScriptCore/runtime/JSZombie.h
index da45699..0559b96 100644
--- a/Source/JavaScriptCore/runtime/JSZombie.h
+++ b/Source/JavaScriptCore/runtime/JSZombie.h
@@ -27,20 +27,21 @@
 #define JSZombie_h
 
 #include "JSCell.h"
+#include "Structure.h"
 
 #if ENABLE(JSC_ZOMBIES)
 namespace JSC {
 
 class JSZombie : public JSCell {
 public:
-    JSZombie(const ClassInfo* oldInfo, Structure* structure)
-        : JSCell(structure)
+    JSZombie(JSGlobalData& globalData, const ClassInfo* oldInfo, Structure* structure)
+        : JSCell(globalData, structure)
         , m_oldInfo(oldInfo)
     {
+        ASSERT(inherits(&s_info));
     }
+
     virtual bool isZombie() const { return true; }
-    virtual const ClassInfo* classInfo() const { return &s_info; }
-    static Structure* leakedZombieStructure();
 
     virtual bool isGetterSetter() const { ASSERT_NOT_REACHED(); return false; }
     virtual bool isAPIValueWrapper() const { ASSERT_NOT_REACHED(); return false; }
@@ -65,7 +66,13 @@ public:
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
     virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
     
+    static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
+    {
+        return Structure::create(globalData, prototype, TypeInfo(LeafType, 0), AnonymousSlotCount, &s_info);
+    }
+
     static const ClassInfo s_info;
+
 private:
     const ClassInfo* m_oldInfo;
 };
diff --git a/Source/JavaScriptCore/runtime/Lookup.cpp b/Source/JavaScriptCore/runtime/Lookup.cpp
index 3c7d4be..25b516e 100644
--- a/Source/JavaScriptCore/runtime/Lookup.cpp
+++ b/Source/JavaScriptCore/runtime/Lookup.cpp
@@ -22,7 +22,6 @@
 
 #include "Executable.h"
 #include "JSFunction.h"
-#include "PrototypeFunction.h"
 
 namespace JSC {
 
@@ -74,20 +73,20 @@ void setUpStaticFunctionSlot(ExecState* exec, const HashEntry* entry, JSObject*
     ASSERT(thisObj->structure()->anonymousSlotCount() > 0);
     ASSERT(thisObj->getAnonymousValue(0).isCell() && asObject(thisObj->getAnonymousValue(0).asCell())->isGlobalObject());
     ASSERT(entry->attributes() & Function);
-    WriteBarrierBase<Unknown>* location = thisObj->getDirectLocation(propertyName);
+    WriteBarrierBase<Unknown>* location = thisObj->getDirectLocation(exec->globalData(), propertyName);
 
     if (!location) {
-        NativeFunctionWrapper* function;
+        JSFunction* function;
         JSGlobalObject* globalObject = asGlobalObject(thisObj->getAnonymousValue(0).asCell());
 #if ENABLE(JIT) && ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
         if (entry->generator())
-            function = new (exec) NativeFunctionWrapper(exec, globalObject, globalObject->prototypeFunctionStructure(), entry->functionLength(), propertyName, exec->globalData().getHostFunction(entry->function(), entry->generator()));
+            function = new (exec) JSFunction(exec, globalObject, globalObject->functionStructure(), entry->functionLength(), propertyName, exec->globalData().getHostFunction(entry->function(), entry->generator()));
         else
 #endif
-            function = new (exec) NativeFunctionWrapper(exec, globalObject, globalObject->prototypeFunctionStructure(), entry->functionLength(), propertyName, entry->function());
+            function = new (exec) JSFunction(exec, globalObject, globalObject->functionStructure(), entry->functionLength(), propertyName, entry->function());
 
         thisObj->putDirectFunction(exec->globalData(), propertyName, function, entry->attributes());
-        location = thisObj->getDirectLocation(propertyName);
+        location = thisObj->getDirectLocation(exec->globalData(), propertyName);
     }
 
     slot.setValue(thisObj, location->get(), thisObj->offsetForLocation(location));
diff --git a/Source/JavaScriptCore/runtime/MarkedBlock.h b/Source/JavaScriptCore/runtime/MarkedBlock.h
deleted file mode 100644
index f726c25..0000000
--- a/Source/JavaScriptCore/runtime/MarkedBlock.h
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
-
-#ifndef MarkedBlock_h
-#define MarkedBlock_h
-
-#include <wtf/Bitmap.h>
-#include <wtf/FixedArray.h>
-#include <wtf/PageAllocationAligned.h>
-
-#define ASSERT_CLASS_FITS_IN_CELL(class) COMPILE_ASSERT(sizeof(class) <= MarkedBlock::CELL_SIZE, class_fits_in_cell)
-
-namespace JSC {
-
-    class Heap;
-    class JSCell;
-    class JSGlobalData;
-
-    class MarkedBlock {
-#if OS(WINCE) || OS(SYMBIAN) || PLATFORM(BREWMP)
-        static const size_t BLOCK_SIZE = 64 * 1024; // 64k
-#else
-        static const size_t BLOCK_SIZE = 256 * 1024; // 256k
-#endif
-
-        static const size_t BLOCK_OFFSET_MASK = BLOCK_SIZE - 1;
-        static const size_t BLOCK_MASK = ~BLOCK_OFFSET_MASK;
-        static const size_t MINIMUM_CELL_SIZE = 64;
-        static const size_t CELL_ARRAY_LENGTH = (MINIMUM_CELL_SIZE / sizeof(double)) + (MINIMUM_CELL_SIZE % sizeof(double) != 0 ? sizeof(double) : 0);
-    public:
-        // This is still public for now, for use in assertions.
-        static const size_t CELL_SIZE = CELL_ARRAY_LENGTH * sizeof(double);
-    private:
-        static const size_t SMALL_CELL_SIZE = CELL_SIZE / 2;
-        static const size_t CELL_MASK = CELL_SIZE - 1;
-        static const size_t CELL_ALIGN_MASK = ~CELL_MASK;
-        static const size_t BITS_PER_BLOCK = BLOCK_SIZE / CELL_SIZE;
-        static const size_t CELLS_PER_BLOCK = (BLOCK_SIZE - sizeof(Heap*) - sizeof(WTF::Bitmap<BITS_PER_BLOCK>)) / CELL_SIZE; // Division rounds down intentionally.
-        
-        struct CollectorCell {
-            FixedArray<double, CELL_ARRAY_LENGTH> memory;
-        };
-
-        // Cell size needs to be a power of two for CELL_MASK to be valid.
-        COMPILE_ASSERT(!(sizeof(CollectorCell) % 2), Collector_cell_size_is_power_of_two);
-
-    public:
-        static MarkedBlock* create(JSGlobalData*);
-        static void destroy(MarkedBlock*);
-
-        static bool isCellAligned(const void*);
-        static MarkedBlock* blockFor(const void*);
-        
-        Heap* heap() const;
-        
-        void* allocate(size_t& nextCell);
-        void sweep();
-        
-        bool isEmpty();
-
-        void clearMarks();
-        size_t markCount();
-        size_t size();
-        size_t capacity();
-
-        size_t cellNumber(const void*);
-        bool isMarked(const void*);
-        bool testAndSetMarked(const void*);
-        void setMarked(const void*);
-        
-        template <typename Functor> void forEach(Functor&);
-
-        FixedArray<CollectorCell, CELLS_PER_BLOCK> cells;
-
-    private:
-        MarkedBlock(const PageAllocationAligned&, JSGlobalData*);
-
-        WTF::Bitmap<BITS_PER_BLOCK> marked;
-        PageAllocationAligned m_allocation;
-        Heap* m_heap;
-    };
-
-    inline bool MarkedBlock::isCellAligned(const void* p)
-    {
-        return !((intptr_t)(p) & CELL_MASK);
-    }
-
-    inline MarkedBlock* MarkedBlock::blockFor(const void* p)
-    {
-        return reinterpret_cast<MarkedBlock*>(reinterpret_cast<uintptr_t>(p) & BLOCK_MASK);
-    }
-
-    inline Heap* MarkedBlock::heap() const
-    {
-        return m_heap;
-    }
-
-    inline bool MarkedBlock::isEmpty()
-    {
-        marked.clear(CELLS_PER_BLOCK - 1); // Clear the always-set last bit to avoid confusing isEmpty().
-        bool result = marked.isEmpty();
-        marked.set(CELLS_PER_BLOCK - 1);
-        return result;
-    }
-
-    inline void MarkedBlock::clearMarks()
-    {
-        // allocate() assumes that the last mark bit is always set.
-        marked.clearAll();
-        marked.set(CELLS_PER_BLOCK - 1);
-    }
-    
-    inline size_t MarkedBlock::markCount()
-    {
-        return marked.count() - 1; // The last mark bit is always set.
-    }
-
-    inline size_t MarkedBlock::size()
-    {
-        return markCount() * CELL_SIZE;
-    }
-
-    inline size_t MarkedBlock::capacity()
-    {
-        return BLOCK_SIZE;
-    }
-
-    inline size_t MarkedBlock::cellNumber(const void* cell)
-    {
-        return (reinterpret_cast<uintptr_t>(cell) & BLOCK_OFFSET_MASK) / CELL_SIZE;
-    }
-
-    inline bool MarkedBlock::isMarked(const void* cell)
-    {
-        return marked.get(cellNumber(cell));
-    }
-
-    inline bool MarkedBlock::testAndSetMarked(const void* cell)
-    {
-        return marked.testAndSet(cellNumber(cell));
-    }
-
-    inline void MarkedBlock::setMarked(const void* cell)
-    {
-        marked.set(cellNumber(cell));
-    }
-
-    template <typename Functor> inline void MarkedBlock::forEach(Functor& functor)
-    {
-        for (size_t i = 0; i < CELLS_PER_BLOCK - 1; ++i) { // The last cell is a dummy place-holder.
-            if (!marked.get(i))
-                continue;
-            functor(reinterpret_cast<JSCell*>(&cells[i]));
-        }
-    }
-
-} // namespace JSC
-
-#endif // MarkedSpace_h
diff --git a/Source/JavaScriptCore/runtime/MarkedSpace.cpp b/Source/JavaScriptCore/runtime/MarkedSpace.cpp
deleted file mode 100644
index 2f8075d..0000000
--- a/Source/JavaScriptCore/runtime/MarkedSpace.cpp
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
-
-#include "config.h"
-#include "MarkedSpace.h"
-
-#include "JSCell.h"
-#include "JSGlobalData.h"
-#include "JSLock.h"
-
-namespace JSC {
-
-class Structure;
-
-MarkedSpace::MarkedSpace(JSGlobalData* globalData)
-    : m_waterMark(0)
-    , m_highWaterMark(0)
-    , m_globalData(globalData)
-{
-    allocateBlock();
-}
-
-void MarkedSpace::destroy()
-{
-    clearMarks(); // Make sure weak pointers appear dead during destruction.
-
-    while (m_heap.blocks.size())
-        freeBlock(0);
-    m_heap.blocks.clear();
-}
-
-NEVER_INLINE MarkedBlock* MarkedSpace::allocateBlock()
-{
-    MarkedBlock* block = MarkedBlock::create(globalData());
-    m_heap.blocks.append(block);
-    return block;
-}
-
-NEVER_INLINE void MarkedSpace::freeBlock(size_t block)
-{
-    MarkedBlock::destroy(m_heap.blocks[block]);
-
-    // swap with the last block so we compact as we go
-    m_heap.blocks[block] = m_heap.blocks.last();
-    m_heap.blocks.removeLast();
-}
-
-void* MarkedSpace::allocate(size_t)
-{
-    do {
-        ASSERT(m_heap.nextBlock < m_heap.blocks.size());
-        MarkedBlock* block = m_heap.collectorBlock(m_heap.nextBlock);
-        if (void* result = block->allocate(m_heap.nextCell))
-            return result;
-
-        m_waterMark += block->capacity();
-    } while (++m_heap.nextBlock != m_heap.blocks.size());
-
-    if (m_waterMark < m_highWaterMark)
-        return allocateBlock()->allocate(m_heap.nextCell);
-
-    return 0;
-}
-
-void MarkedSpace::shrink()
-{
-    for (size_t i = 0; i != m_heap.blocks.size() && m_heap.blocks.size() > 1; ) { // We assume at least one block exists at all times.
-        if (m_heap.collectorBlock(i)->isEmpty()) {
-            freeBlock(i);
-        } else
-            ++i;
-    }
-}
-
-void MarkedSpace::clearMarks()
-{
-    for (size_t i = 0; i < m_heap.blocks.size(); ++i)
-        m_heap.collectorBlock(i)->clearMarks();
-}
-
-void MarkedSpace::sweep()
-{
-    for (size_t i = 0; i < m_heap.blocks.size(); ++i)
-        m_heap.collectorBlock(i)->sweep();
-}
-
-size_t MarkedSpace::objectCount() const
-{
-    size_t result = 0;
-    for (size_t i = 0; i < m_heap.blocks.size(); ++i)
-        result += m_heap.collectorBlock(i)->markCount();
-    return result;
-}
-
-size_t MarkedSpace::size() const
-{
-    size_t result = 0;
-    for (size_t i = 0; i < m_heap.blocks.size(); ++i)
-        result += m_heap.collectorBlock(i)->size();
-    return result;
-}
-
-size_t MarkedSpace::capacity() const
-{
-    size_t result = 0;
-    for (size_t i = 0; i < m_heap.blocks.size(); ++i)
-        result += m_heap.collectorBlock(i)->capacity();
-    return result;
-}
-
-void MarkedSpace::reset()
-{
-    m_heap.nextCell = 0;
-    m_heap.nextBlock = 0;
-    m_waterMark = 0;
-#if ENABLE(JSC_ZOMBIES)
-    sweep();
-#endif
-}
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/MathObject.cpp b/Source/JavaScriptCore/runtime/MathObject.cpp
index c79316b..52bd76a 100644
--- a/Source/JavaScriptCore/runtime/MathObject.cpp
+++ b/Source/JavaScriptCore/runtime/MathObject.cpp
@@ -61,7 +61,7 @@ namespace JSC {
 
 // ------------------------------ MathObject --------------------------------
 
-const ClassInfo MathObject::info = { "Math", 0, 0, ExecState::mathTable };
+const ClassInfo MathObject::s_info = { "Math", &JSObjectWithGlobalObject::s_info, 0, ExecState::mathTable };
 
 /* Source for MathObject.lut.h
 @begin mathTable
@@ -86,14 +86,16 @@ const ClassInfo MathObject::info = { "Math", 0, 0, ExecState::mathTable };
 @end
 */
 
-MathObject::MathObject(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
+MathObject::MathObject(ExecState* exec, JSGlobalObject* globalObject, Structure* structure)
     : JSObjectWithGlobalObject(globalObject, structure)
 {
+    ASSERT(inherits(&s_info));
+
     putDirectWithoutTransition(exec->globalData(), Identifier(exec, "E"), jsNumber(exp(1.0)), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(exec->globalData(), Identifier(exec, "LN2"), jsNumber(log(2.0)), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(exec->globalData(), Identifier(exec, "LN10"), jsNumber(log(10.0)), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(exec->globalData(), Identifier(exec, "LOG2E"), jsNumber(1.0 / log(2.0)), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(exec->globalData(), Identifier(exec, "LOG10E"), jsNumber(1.0 / log(10.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(exec->globalData(), Identifier(exec, "LOG10E"), jsNumber(0.4342944819032518), DontDelete | DontEnum | ReadOnly); // See ECMA-262 15.8.1.5
     putDirectWithoutTransition(exec->globalData(), Identifier(exec, "PI"), jsNumber(piDouble), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(exec->globalData(), Identifier(exec, "SQRT1_2"), jsNumber(sqrt(0.5)), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(exec->globalData(), Identifier(exec, "SQRT2"), jsNumber(sqrt(2.0)), DontDelete | DontEnum | ReadOnly);
diff --git a/Source/JavaScriptCore/runtime/MathObject.h b/Source/JavaScriptCore/runtime/MathObject.h
index 31fa2fe..75753be 100644
--- a/Source/JavaScriptCore/runtime/MathObject.h
+++ b/Source/JavaScriptCore/runtime/MathObject.h
@@ -27,17 +27,16 @@ namespace JSC {
 
     class MathObject : public JSObjectWithGlobalObject {
     public:
-        MathObject(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>);
+        MathObject(ExecState*, JSGlobalObject*, Structure*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-        static const ClassInfo info;
+        static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
diff --git a/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index 421eecf..9cd5dcb 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -30,22 +30,34 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(NativeErrorConstructor);
 
-const ClassInfo NativeErrorConstructor::info = { "Function", &InternalFunction::info, 0, 0 };
+const ClassInfo NativeErrorConstructor::s_info = { "Function", &InternalFunction::s_info, 0, 0 };
 
-NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, NonNullPassRefPtr<Structure> prototypeStructure, const UString& nameAndMessage)
+NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* prototypeStructure, const UString& nameAndMessage)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, nameAndMessage))
 {
+    ASSERT(inherits(&s_info));
+
     NativeErrorPrototype* prototype = new (exec) NativeErrorPrototype(exec, globalObject, prototypeStructure, nameAndMessage, this);
 
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
     putDirect(exec->globalData(), exec->propertyNames().prototype, prototype, DontDelete | ReadOnly | DontEnum);
-    m_errorStructure = ErrorInstance::createStructure(prototype);
+    m_errorStructure.set(exec->globalData(), this, ErrorInstance::createStructure(exec->globalData(), prototype));
+    ASSERT(m_errorStructure);
+    ASSERT(m_errorStructure->typeInfo().type() == ObjectType);
+}
+
+void NativeErrorConstructor::markChildren(MarkStack& markStack)
+{
+    InternalFunction::markChildren(markStack);
+    if (m_errorStructure)
+        markStack.append(&m_errorStructure);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithNativeErrorConstructor(ExecState* exec)
 {
     JSValue message = exec->argumentCount() ? exec->argument(0) : jsUndefined();
     Structure* errorStructure = static_cast<NativeErrorConstructor*>(exec->callee())->errorStructure();
+    ASSERT(errorStructure);
     return JSValue::encode(ErrorInstance::create(exec, errorStructure, message));
 }
 
diff --git a/Source/JavaScriptCore/runtime/NativeErrorConstructor.h b/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
index 1ff8207..e96daf6 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
+++ b/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
@@ -31,19 +31,24 @@ namespace JSC {
 
     class NativeErrorConstructor : public InternalFunction {
     public:
-        NativeErrorConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure> structure, NonNullPassRefPtr<Structure> prototypeStructure, const UString&);
+        NativeErrorConstructor(ExecState*, JSGlobalObject*, Structure*, Structure* prototypeStructure, const UString&);
 
-        static const ClassInfo info;
+        static const ClassInfo s_info;
+
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
+        {
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        }
 
         Structure* errorStructure() { return m_errorStructure.get(); }
 
     private:
+        static const unsigned StructureFlags = OverridesMarkChildren | InternalFunction::StructureFlags;
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
+        virtual void markChildren(MarkStack&);
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-
-        RefPtr<Structure> m_errorStructure;
+        WriteBarrier<Structure> m_errorStructure;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp b/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp
index 4e10268..de27d59 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp
@@ -31,7 +31,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(NativeErrorPrototype);
 
-NativeErrorPrototype::NativeErrorPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const UString& nameAndMessage, NativeErrorConstructor* constructor)
+NativeErrorPrototype::NativeErrorPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, const UString& nameAndMessage, NativeErrorConstructor* constructor)
     : JSObjectWithGlobalObject(globalObject, structure)
 {
     putDirect(exec->globalData(), exec->propertyNames().name, jsString(exec, nameAndMessage), 0);
diff --git a/Source/JavaScriptCore/runtime/NativeErrorPrototype.h b/Source/JavaScriptCore/runtime/NativeErrorPrototype.h
index 30690d5..e1b05ce 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorPrototype.h
+++ b/Source/JavaScriptCore/runtime/NativeErrorPrototype.h
@@ -28,7 +28,7 @@ namespace JSC {
 
     class NativeErrorPrototype : public JSObjectWithGlobalObject {
     public:
-        NativeErrorPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, const UString&, NativeErrorConstructor*);
+        NativeErrorPrototype(ExecState*, JSGlobalObject*, Structure*, const UString&, NativeErrorConstructor*);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/NumberConstructor.cpp b/Source/JavaScriptCore/runtime/NumberConstructor.cpp
index 7cec875..4193f79 100644
--- a/Source/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -42,7 +42,7 @@ static JSValue numberConstructorMinValue(ExecState*, JSValue, const Identifier&)
 
 namespace JSC {
 
-const ClassInfo NumberConstructor::info = { "Function", &InternalFunction::info, 0, ExecState::numberTable };
+const ClassInfo NumberConstructor::s_info = { "Function", &InternalFunction::s_info, 0, ExecState::numberTable };
 
 /* Source for NumberConstructor.lut.h
 @begin numberTable
@@ -54,9 +54,11 @@ const ClassInfo NumberConstructor::info = { "Function", &InternalFunction::info,
 @end
 */
 
-NumberConstructor::NumberConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, NumberPrototype* numberPrototype)
-    : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, numberPrototype->info.className))
+NumberConstructor::NumberConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, NumberPrototype* numberPrototype)
+    : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, numberPrototype->s_info.className))
 {
+    ASSERT(inherits(&s_info));
+
     // Number.Prototype
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, numberPrototype, DontEnum | DontDelete | ReadOnly);
 
@@ -102,7 +104,7 @@ static JSValue numberConstructorMinValue(ExecState*, JSValue, const Identifier&)
 // ECMA 15.7.1
 static EncodedJSValue JSC_HOST_CALL constructWithNumberConstructor(ExecState* exec)
 {
-    NumberObject* object = new (exec) NumberObject(exec->globalData(), exec->lexicalGlobalObject()->numberObjectStructure());
+    NumberObject* object = new (exec) NumberObject(exec->globalData(), asInternalFunction(exec->callee())->globalObject()->numberObjectStructure());
     double n = exec->argumentCount() ? exec->argument(0).toNumber(exec) : 0;
     object->setInternalValue(exec->globalData(), jsNumber(n));
     return JSValue::encode(object);
diff --git a/Source/JavaScriptCore/runtime/NumberConstructor.h b/Source/JavaScriptCore/runtime/NumberConstructor.h
index d8a2593..69aa8a1 100644
--- a/Source/JavaScriptCore/runtime/NumberConstructor.h
+++ b/Source/JavaScriptCore/runtime/NumberConstructor.h
@@ -29,17 +29,17 @@ namespace JSC {
 
     class NumberConstructor : public InternalFunction {
     public:
-        NumberConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, NumberPrototype*);
+        NumberConstructor(ExecState*, JSGlobalObject*, Structure*, NumberPrototype*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         JSValue getValueProperty(ExecState*, int token) const;
 
-        static const ClassInfo info;
+        static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+            return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
         enum { NaNValue, NegInfinity, PosInfinity, MaxValue, MinValue };
@@ -50,8 +50,6 @@ namespace JSC {
     private:
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
-
-        virtual const ClassInfo* classInfo() const { return &info; }
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/NumberObject.cpp b/Source/JavaScriptCore/runtime/NumberObject.cpp
index 603c2f0..6ee103b 100644
--- a/Source/JavaScriptCore/runtime/NumberObject.cpp
+++ b/Source/JavaScriptCore/runtime/NumberObject.cpp
@@ -29,11 +29,12 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(NumberObject);
 
-const ClassInfo NumberObject::info = { "Number", 0, 0, 0 };
+const ClassInfo NumberObject::s_info = { "Number", &JSWrapperObject::s_info, 0, 0 };
 
-NumberObject::NumberObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure)
+NumberObject::NumberObject(JSGlobalData& globalData, Structure* structure)
     : JSWrapperObject(globalData, structure)
 {
+    ASSERT(inherits(&s_info));
 }
 
 JSValue NumberObject::getJSNumber()
@@ -41,9 +42,9 @@ JSValue NumberObject::getJSNumber()
     return internalValue();
 }
 
-NumberObject* constructNumber(ExecState* exec, JSValue number)
+NumberObject* constructNumber(ExecState* exec, JSGlobalObject* globalObject, JSValue number)
 {
-    NumberObject* object = new (exec) NumberObject(exec->globalData(), exec->lexicalGlobalObject()->numberObjectStructure());
+    NumberObject* object = new (exec) NumberObject(exec->globalData(), globalObject->numberObjectStructure());
     object->setInternalValue(exec->globalData(), number);
     return object;
 }
diff --git a/Source/JavaScriptCore/runtime/NumberObject.h b/Source/JavaScriptCore/runtime/NumberObject.h
index 044f490..cba65dd 100644
--- a/Source/JavaScriptCore/runtime/NumberObject.h
+++ b/Source/JavaScriptCore/runtime/NumberObject.h
@@ -27,25 +27,20 @@ namespace JSC {
 
     class NumberObject : public JSWrapperObject {
     public:
-        explicit NumberObject(JSGlobalData&, NonNullPassRefPtr<Structure>);
+        explicit NumberObject(JSGlobalData&, Structure*);
 
-        static const ClassInfo info;
+        static const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
-    protected:
-        static const unsigned StructureFlags = JSWrapperObject::StructureFlags;
-
     private:
-        virtual const ClassInfo* classInfo() const { return &info; }
-
         virtual JSValue getJSNumber();
     };
 
-    NumberObject* constructNumber(ExecState*, JSValue);
+    NumberObject* constructNumber(ExecState*, JSGlobalObject*, JSValue);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/NumberPrototype.cpp b/Source/JavaScriptCore/runtime/NumberPrototype.cpp
index fbe6992..24532dd 100644
--- a/Source/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -26,7 +26,6 @@
 #include "JSFunction.h"
 #include "JSString.h"
 #include "Operations.h"
-#include "PrototypeFunction.h"
 #include "dtoa.h"
 #include <wtf/Assertions.h>
 #include <wtf/DecimalNumber.h>
@@ -46,19 +45,19 @@ static EncodedJSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState*);
 
 // ECMA 15.7.4
 
-NumberPrototype::NumberPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
+NumberPrototype::NumberPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* functionStructure)
     : NumberObject(exec->globalData(), structure)
 {
     setInternalValue(exec->globalData(), jsNumber(0));
 
     // The constructor will be added later, after NumberConstructor has been constructed
 
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().toString, numberProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, numberProtoFuncToLocaleString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, numberProtoFuncValueOf), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().toFixed, numberProtoFuncToFixed), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().toExponential, numberProtoFuncToExponential), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().toPrecision, numberProtoFuncToPrecision), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().toString, numberProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().toLocaleString, numberProtoFuncToLocaleString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().valueOf, numberProtoFuncValueOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().toFixed, numberProtoFuncToFixed), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().toExponential, numberProtoFuncToExponential), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().toPrecision, numberProtoFuncToPrecision), DontEnum);
 }
 
 // ------------------------------ Functions ---------------------------
diff --git a/Source/JavaScriptCore/runtime/NumberPrototype.h b/Source/JavaScriptCore/runtime/NumberPrototype.h
index 78b690e..45bdfe7 100644
--- a/Source/JavaScriptCore/runtime/NumberPrototype.h
+++ b/Source/JavaScriptCore/runtime/NumberPrototype.h
@@ -27,7 +27,7 @@ namespace JSC {
 
     class NumberPrototype : public NumberObject {
     public:
-        NumberPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure);
+        NumberPrototype(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
index f31da67..aed5e24 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -26,10 +26,10 @@
 #include "JSFunction.h"
 #include "JSArray.h"
 #include "JSGlobalObject.h"
+#include "Lookup.h"
 #include "ObjectPrototype.h"
 #include "PropertyDescriptor.h"
 #include "PropertyNameArray.h"
-#include "PrototypeFunction.h"
 
 namespace JSC {
 
@@ -42,38 +42,71 @@ static EncodedJSValue JSC_HOST_CALL objectConstructorKeys(ExecState*);
 static EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState*);
 static EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState*);
 static EncodedJSValue JSC_HOST_CALL objectConstructorCreate(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectConstructorSeal(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectConstructorFreeze(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectConstructorPreventExtensions(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectConstructorIsSealed(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectConstructorIsFrozen(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectConstructorIsExtensible(ExecState*);
 
-ObjectConstructor::ObjectConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, ObjectPrototype* objectPrototype, Structure* prototypeFunctionStructure)
-: InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, "Object"))
+}
+
+#include "ObjectConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo ObjectConstructor::s_info = { "Function", &InternalFunction::s_info, 0, ExecState::objectConstructorTable };
+
+/* Source for ObjectConstructor.lut.h
+@begin objectConstructorTable
+  getPrototypeOf            objectConstructorGetPrototypeOf             DontEnum|Function 1
+  getOwnPropertyDescriptor  objectConstructorGetOwnPropertyDescriptor   DontEnum|Function 2
+  getOwnPropertyNames       objectConstructorGetOwnPropertyNames        DontEnum|Function 1
+  keys                      objectConstructorKeys                       DontEnum|Function 1
+  defineProperty            objectConstructorDefineProperty             DontEnum|Function 3
+  defineProperties          objectConstructorDefineProperties           DontEnum|Function 2
+  create                    objectConstructorCreate                     DontEnum|Function 2
+  seal                      objectConstructorSeal                       DontEnum|Function 1
+  freeze                    objectConstructorFreeze                     DontEnum|Function 1
+  preventExtensions         objectConstructorPreventExtensions          DontEnum|Function 1
+  isSealed                  objectConstructorIsSealed                   DontEnum|Function 1
+  isFrozen                  objectConstructorIsFrozen                   DontEnum|Function 1
+  isExtensible              objectConstructorIsExtensible               DontEnum|Function 1
+@end
+*/
+
+ObjectConstructor::ObjectConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, ObjectPrototype* objectPrototype)
+    : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, "Object"))
 {
     // ECMA 15.2.3.1
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, objectPrototype, DontEnum | DontDelete | ReadOnly);
-    
     // no. of arguments for constructor
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
-    
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().getPrototypeOf, objectConstructorGetPrototypeOf), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 2, exec->propertyNames().getOwnPropertyDescriptor, objectConstructorGetOwnPropertyDescriptor), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().getOwnPropertyNames, objectConstructorGetOwnPropertyNames), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().keys, objectConstructorKeys), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 3, exec->propertyNames().defineProperty, objectConstructorDefineProperty), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 2, exec->propertyNames().defineProperties, objectConstructorDefineProperties), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 2, exec->propertyNames().create, objectConstructorCreate), DontEnum);
+}
+
+bool ObjectConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot &slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, ExecState::objectConstructorTable(exec), this, propertyName, slot);
+}
+
+bool ObjectConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, ExecState::objectConstructorTable(exec), this, propertyName, descriptor);
 }
 
 // ECMA 15.2.2
-static ALWAYS_INLINE JSObject* constructObject(ExecState* exec, const ArgList& args)
+static ALWAYS_INLINE JSObject* constructObject(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args)
 {
     JSValue arg = args.at(0);
     if (arg.isUndefinedOrNull())
-        return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
-    return arg.toObject(exec);
+        return constructEmptyObject(exec, globalObject);
+    return arg.toObject(exec, globalObject);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithObjectConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructObject(exec, args));
+    return JSValue::encode(constructObject(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 ConstructType ObjectConstructor::getConstructData(ConstructData& constructData)
@@ -85,7 +118,7 @@ ConstructType ObjectConstructor::getConstructData(ConstructData& constructData)
 static EncodedJSValue JSC_HOST_CALL callObjectConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructObject(exec, args));
+    return JSValue::encode(constructObject(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 CallType ObjectConstructor::getCallData(CallData& callData)
@@ -309,7 +342,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorCreate(ExecState* exec)
     if (!exec->argument(0).isObject() && !exec->argument(0).isNull())
         return throwVMError(exec, createTypeError(exec, "Object prototype may only be an Object or null."));
     JSObject* newObject = constructEmptyObject(exec);
-    newObject->setPrototype(exec->argument(0));
+    newObject->setPrototype(exec->globalData(), exec->argument(0));
     if (exec->argument(1).isUndefined())
         return JSValue::encode(newObject);
     if (!exec->argument(1).isObject())
@@ -317,4 +350,55 @@ EncodedJSValue JSC_HOST_CALL objectConstructorCreate(ExecState* exec)
     return JSValue::encode(defineProperties(exec, newObject, asObject(exec->argument(1))));
 }
 
+EncodedJSValue JSC_HOST_CALL objectConstructorSeal(ExecState* exec)
+{
+    JSValue obj = exec->argument(0);
+    if (!obj.isObject())
+        return throwVMError(exec, createTypeError(exec, "Object.seal can only be called on Objects."));
+    asObject(obj)->seal(exec->globalData());
+    return JSValue::encode(obj);
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorFreeze(ExecState* exec)
+{
+    JSValue obj = exec->argument(0);
+    if (!obj.isObject())
+        return throwVMError(exec, createTypeError(exec, "Object.freeze can only be called on Objects."));
+    asObject(obj)->freeze(exec->globalData());
+    return JSValue::encode(obj);
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorPreventExtensions(ExecState* exec)
+{
+    JSValue obj = exec->argument(0);
+    if (!obj.isObject())
+        return throwVMError(exec, createTypeError(exec, "Object.preventExtensions can only be called on Objects."));
+    asObject(obj)->preventExtensions(exec->globalData());
+    return JSValue::encode(obj);
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorIsSealed(ExecState* exec)
+{
+    JSValue obj = exec->argument(0);
+    if (!obj.isObject())
+        return throwVMError(exec, createTypeError(exec, "Object.isSealed can only be called on Objects."));
+    return JSValue::encode(jsBoolean(asObject(obj)->isSealed(exec->globalData())));
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorIsFrozen(ExecState* exec)
+{
+    JSValue obj = exec->argument(0);
+    if (!obj.isObject())
+        return throwVMError(exec, createTypeError(exec, "Object.isFrozen can only be called on Objects."));
+    return JSValue::encode(jsBoolean(asObject(obj)->isFrozen(exec->globalData())));
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorIsExtensible(ExecState* exec)
+{
+    JSValue obj = exec->argument(0);
+    if (!obj.isObject())
+        return throwVMError(exec, createTypeError(exec, "Object.isExtensible can only be called on Objects."));
+    return JSValue::encode(jsBoolean(asObject(obj)->isExtensible()));
+}
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.h b/Source/JavaScriptCore/runtime/ObjectConstructor.h
index 04a3c1a..6ebafcd 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.h
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.h
@@ -29,7 +29,20 @@ namespace JSC {
 
     class ObjectConstructor : public InternalFunction {
     public:
-        ObjectConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, ObjectPrototype*, Structure* prototypeFunctionStructure);
+        ObjectConstructor(ExecState*, JSGlobalObject*, Structure*, ObjectPrototype*);
+
+        virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
+
+        static const ClassInfo s_info;
+
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
+        {
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | InternalFunction::StructureFlags;
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
diff --git a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
index 57a8a31..7469172 100644
--- a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -25,7 +25,6 @@
 #include "JSFunction.h"
 #include "JSString.h"
 #include "JSStringBuilder.h"
-#include "PrototypeFunction.h"
 
 namespace JSC {
 
@@ -41,22 +40,22 @@ static EncodedJSValue JSC_HOST_CALL objectProtoFuncLookupSetter(ExecState*);
 static EncodedJSValue JSC_HOST_CALL objectProtoFuncPropertyIsEnumerable(ExecState*);
 static EncodedJSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState*);
 
-ObjectPrototype::ObjectPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> stucture, Structure* prototypeFunctionStructure)
-    : JSObject(stucture)
+ObjectPrototype::ObjectPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* stucture, Structure* functionStructure)
+    : JSNonFinalObject(exec->globalData(), stucture)
     , m_hasNoPropertiesWithUInt32Names(true)
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().toString, objectProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, objectProtoFuncToLocaleString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, objectProtoFuncValueOf), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().hasOwnProperty, objectProtoFuncHasOwnProperty), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().propertyIsEnumerable, objectProtoFuncPropertyIsEnumerable), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().isPrototypeOf, objectProtoFuncIsPrototypeOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().toString, objectProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().toLocaleString, objectProtoFuncToLocaleString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().valueOf, objectProtoFuncValueOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().hasOwnProperty, objectProtoFuncHasOwnProperty), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().propertyIsEnumerable, objectProtoFuncPropertyIsEnumerable), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().isPrototypeOf, objectProtoFuncIsPrototypeOf), DontEnum);
 
     // Mozilla extensions
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 2, exec->propertyNames().__defineGetter__, objectProtoFuncDefineGetter), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 2, exec->propertyNames().__defineSetter__, objectProtoFuncDefineSetter), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().__lookupGetter__, objectProtoFuncLookupGetter), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().__lookupSetter__, objectProtoFuncLookupSetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 2, exec->propertyNames().__defineGetter__, objectProtoFuncDefineGetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 2, exec->propertyNames().__defineSetter__, objectProtoFuncDefineSetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().__lookupGetter__, objectProtoFuncLookupGetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().__lookupSetter__, objectProtoFuncLookupSetter), DontEnum);
 }
 
 void ObjectPrototype::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
diff --git a/Source/JavaScriptCore/runtime/ObjectPrototype.h b/Source/JavaScriptCore/runtime/ObjectPrototype.h
index 0382ae4..9fb7fae 100644
--- a/Source/JavaScriptCore/runtime/ObjectPrototype.h
+++ b/Source/JavaScriptCore/runtime/ObjectPrototype.h
@@ -25,9 +25,9 @@
 
 namespace JSC {
 
-    class ObjectPrototype : public JSObject {
+    class ObjectPrototype : public JSNonFinalObject {
     public:
-        ObjectPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure);
+        ObjectPrototype(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure);
 
     private:
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
diff --git a/Source/JavaScriptCore/runtime/Operations.h b/Source/JavaScriptCore/runtime/Operations.h
index 6e84123..c102eeb 100644
--- a/Source/JavaScriptCore/runtime/Operations.h
+++ b/Source/JavaScriptCore/runtime/Operations.h
@@ -24,9 +24,8 @@
 
 #include "ExceptionHelpers.h"
 #include "Interpreter.h"
-#include "JSImmediate.h"
-#include "JSNumberCell.h"
 #include "JSString.h"
+#include "JSValueInlineMethods.h"
 
 namespace JSC {
 
@@ -431,7 +430,7 @@ namespace JSC {
             if (cell->structure()->isDictionary()) {
                 asObject(cell)->flattenDictionaryObject(callFrame->globalData());
                 if (slotBase == cell)
-                    slotOffset = cell->structure()->get(propertyName); 
+                    slotOffset = cell->structure()->get(callFrame->globalData(), propertyName); 
             }
 
             ++count;
@@ -472,8 +471,11 @@ namespace JSC {
         JSObject* base;
         while (true) {
             base = iter->get();
-            if (next == end)
-                return isStrictPut ? JSValue() : base;
+            if (next == end) {
+                if (isStrictPut && !base->getPropertySlot(callFrame, property, slot))
+                    return JSValue();
+                return base;
+            }
             if (base->getPropertySlot(callFrame, property, slot))
                 return base;
 
diff --git a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
index bd452b6..fc195cd 100644
--- a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -22,69 +22,536 @@
 #define PropertyMapHashTable_h
 
 #include "UString.h"
+#include "WriteBarrier.h"
+#include <wtf/HashTable.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
+
+#ifndef NDEBUG
+#define DUMP_PROPERTYMAP_STATS 0
+#else
+#define DUMP_PROPERTYMAP_STATS 0
+#endif
+
+#if DUMP_PROPERTYMAP_STATS
+
+extern int numProbes;
+extern int numCollisions;
+extern int numRehashes;
+extern int numRemoves;
+
+#endif
+
+#define PROPERTY_MAP_DELETED_ENTRY_KEY ((StringImpl*)1) 
+
 namespace JSC {
 
-    struct PropertyMapEntry {
-        StringImpl* key;
-        unsigned offset;
-        unsigned attributes;
-        JSCell* specificValue;
-        unsigned index;
-
-        PropertyMapEntry(StringImpl* key, unsigned attributes, JSCell* specificValue)
-            : key(key)
-            , offset(0)
-            , attributes(attributes)
-            , specificValue(specificValue)
-            , index(0)
+inline bool isPowerOf2(unsigned v)
+{
+    // Taken from http://www.cs.utk.edu/~vose/c-stuff/bithacks.html
+    
+    return !(v & (v - 1)) && v;
+}
+
+inline unsigned nextPowerOf2(unsigned v)
+{
+    // Taken from http://www.cs.utk.edu/~vose/c-stuff/bithacks.html
+    // Devised by Sean Anderson, Sepember 14, 2001
+
+    v--;
+    v |= v >> 1;
+    v |= v >> 2;
+    v |= v >> 4;
+    v |= v >> 8;
+    v |= v >> 16;
+    v++;
+
+    return v;
+}
+
+struct PropertyMapEntry {
+    StringImpl* key;
+    unsigned offset;
+    unsigned attributes;
+    WriteBarrier<JSCell> specificValue;
+
+    PropertyMapEntry(JSGlobalData& globalData, JSCell* owner, StringImpl* key, unsigned offset, unsigned attributes, JSCell* specificValue)
+        : key(key)
+        , offset(offset)
+        , attributes(attributes)
+        , specificValue(globalData, owner, specificValue)
+    {
+    }
+};
+
+class PropertyTable {
+    WTF_MAKE_FAST_ALLOCATED;
+
+    // This is the implementation for 'iterator' and 'const_iterator',
+    // used for iterating over the table in insertion order.
+    template<typename T>
+    class ordered_iterator {
+    public:
+        ordered_iterator<T>& operator++()
         {
+            m_valuePtr = skipDeletedEntries(m_valuePtr + 1);
+            return *this;
         }
 
-        PropertyMapEntry(StringImpl* key, unsigned offset, unsigned attributes, JSCell* specificValue, unsigned index)
-            : key(key)
-            , offset(offset)
-            , attributes(attributes)
-            , specificValue(specificValue)
-            , index(index)
+        bool operator==(const ordered_iterator<T>& other)
         {
+            return m_valuePtr == other.m_valuePtr;
+        }
+
+        bool operator!=(const ordered_iterator<T>& other)
+        {
+            return m_valuePtr != other.m_valuePtr;
+        }
+
+        T& operator*()
+        {
+            return *m_valuePtr;
         }
-    };
 
-    // lastIndexUsed is an ever-increasing index used to identify the order items
-    // were inserted into the property map. It's required that getEnumerablePropertyNames
-    // return the properties in the order they were added for compatibility with other
-    // browsers' JavaScript implementations.
-    struct PropertyMapHashTable {
-        unsigned sizeMask;
-        unsigned size;
-        unsigned keyCount;
-        unsigned deletedSentinelCount;
-        unsigned lastIndexUsed;
-        Vector<unsigned>* deletedOffsets;
-        unsigned entryIndices[1];
-
-        PropertyMapEntry* entries()
+        T* operator->()
         {
-            // The entries vector comes after the indices vector.
-            // The 0th item in the entries vector is not really used; it has to
-            // have a 0 in its key to allow the hash table lookup to handle deleted
-            // sentinels without any special-case code, but the other fields are unused.
-            return reinterpret_cast<PropertyMapEntry*>(&entryIndices[size]);
+            return m_valuePtr;
         }
 
-        static size_t allocationSize(unsigned size)
+        ordered_iterator(T* valuePtr)
+            : m_valuePtr(valuePtr)
         {
-            // We never let a hash table get more than half full,
-            // So the number of indices we need is the size of the hash table.
-            // But the number of entries is half that (plus one for the deleted sentinel).
-            return sizeof(PropertyMapHashTable)
-                + (size - 1) * sizeof(unsigned)
-                + (1 + size / 2) * sizeof(PropertyMapEntry);
         }
+
+    private:
+        T* m_valuePtr;
     };
 
+public:
+    typedef StringImpl* KeyType;
+    typedef PropertyMapEntry ValueType;
+
+    // The in order iterator provides overloaded * and -> to access the Value at the current position.
+    typedef ordered_iterator<ValueType> iterator;
+    typedef ordered_iterator<const ValueType> const_iterator;
+
+    // The find_iterator is a pair of a pointer to a Value* an the entry in the index.
+    // If 'find' does not find an entry then iter.first will be 0, and iter.second will
+    // give the point in m_index where an entry should be inserted.
+    typedef std::pair<ValueType*, unsigned> find_iterator;
+
+    // Constructor is passed an initial capacity, a PropertyTable to copy, or both.
+    explicit PropertyTable(unsigned initialCapacity);
+    PropertyTable(JSGlobalData&, JSCell*, const PropertyTable&);
+    PropertyTable(JSGlobalData&, JSCell*, unsigned initialCapacity, const PropertyTable&);
+    ~PropertyTable();
+
+    // Ordered iteration methods.
+    iterator begin();
+    iterator end();
+    const_iterator begin() const;
+    const_iterator end() const;
+
+    // Find a value in the table.
+    find_iterator find(const KeyType& key);
+    // Add a value to the table
+    std::pair<find_iterator, bool> add(const ValueType& entry);
+    // Remove a value from the table.
+    void remove(const find_iterator& iter);
+    void remove(const KeyType& key);
+
+    // Returns the number of values in the hashtable.
+    unsigned size() const;
+
+    // Checks if there are any values in the hashtable.
+    bool isEmpty() const;
+
+    // Number of slots in the property storage array in use, included deletedOffsets.
+    unsigned propertyStorageSize() const;
+
+    // Used to maintain a list of unused entries in the property storage.
+    void clearDeletedOffsets();
+    bool hasDeletedOffset();
+    unsigned getDeletedOffset();
+    void addDeletedOffset(unsigned offset);
+
+    // Copy this PropertyTable, ensuring the copy has at least the capacity provided.
+    PassOwnPtr<PropertyTable> copy(JSGlobalData&, JSCell* owner, unsigned newCapacity);
+
+#ifndef NDEBUG
+    size_t sizeInMemory();
+    void checkConsistency();
+#endif
+
+private:
+    PropertyTable(const PropertyTable&);
+    // Used to insert a value known not to be in the table, and where we know capacity to be available.
+    void reinsert(const ValueType& entry);
+
+    // Rehash the table.  Used to grow, or to recover deleted slots.
+    void rehash(unsigned newCapacity);
+
+    // The capacity of the table of values is half of the size of the index.
+    unsigned tableCapacity() const;
+
+    // We keep an extra deleted slot after the array to make iteration work,
+    // and to use for deleted values. Index values into the array are 1-based,
+    // so this is tableCapacity() + 1.
+    // For example, if m_tableSize is 16, then tableCapacity() is 8 - but the
+    // values array is actually 9 long (the 9th used for the deleted value/
+    // iteration guard).  The 8 valid entries are numbered 1..8, so the
+    // deleted index is 9 (0 being reserved for empty).
+    unsigned deletedEntryIndex() const;
+
+    // Used in iterator creation/progression.
+    template<typename T>
+    static T* skipDeletedEntries(T* valuePtr);
+
+    // The table of values lies after the hash index.
+    ValueType* table();
+    const ValueType* table() const;
+
+    // total number of  used entries in the values array - by either valid entries, or deleted ones.
+    unsigned usedCount() const;
+
+    // The size in bytes of data needed for by the table.
+    size_t dataSize();
+
+    // Calculates the appropriate table size (rounds up to a power of two).
+    static unsigned sizeForCapacity(unsigned capacity);
+
+    // Check if capacity is available.
+    bool canInsert();
+
+    unsigned m_indexSize;
+    unsigned m_indexMask;
+    unsigned* m_index;
+    unsigned m_keyCount;
+    unsigned m_deletedCount;
+    OwnPtr< Vector<unsigned> > m_deletedOffsets;
+
+    static const unsigned MinimumTableSize = 16;
+    static const unsigned EmptyEntryIndex = 0;
+};
+
+inline PropertyTable::PropertyTable(unsigned initialCapacity)
+    : m_indexSize(sizeForCapacity(initialCapacity))
+    , m_indexMask(m_indexSize - 1)
+    , m_index(static_cast<unsigned*>(fastZeroedMalloc(dataSize())))
+    , m_keyCount(0)
+    , m_deletedCount(0)
+{
+    ASSERT(isPowerOf2(m_indexSize));
+}
+
+inline PropertyTable::PropertyTable(JSGlobalData& globalData, JSCell* owner, const PropertyTable& other)
+    : m_indexSize(other.m_indexSize)
+    , m_indexMask(other.m_indexMask)
+    , m_index(static_cast<unsigned*>(fastMalloc(dataSize())))
+    , m_keyCount(other.m_keyCount)
+    , m_deletedCount(other.m_deletedCount)
+{
+    ASSERT(isPowerOf2(m_indexSize));
+
+    memcpy(m_index, other.m_index, dataSize());
+
+    iterator end = this->end();
+    for (iterator iter = begin(); iter != end; ++iter) {
+        iter->key->ref();
+        writeBarrier(globalData, owner, iter->specificValue.get());
+    }
+
+    // Copy the m_deletedOffsets vector.
+    Vector<unsigned>* otherDeletedOffsets = other.m_deletedOffsets.get();
+    if (otherDeletedOffsets)
+        m_deletedOffsets.set(new Vector<unsigned>(*otherDeletedOffsets));
+}
+
+inline PropertyTable::PropertyTable(JSGlobalData& globalData, JSCell* owner, unsigned initialCapacity, const PropertyTable& other)
+    : m_indexSize(sizeForCapacity(initialCapacity))
+    , m_indexMask(m_indexSize - 1)
+    , m_index(static_cast<unsigned*>(fastZeroedMalloc(dataSize())))
+    , m_keyCount(0)
+    , m_deletedCount(0)
+{
+    ASSERT(isPowerOf2(m_indexSize));
+    ASSERT(initialCapacity >= other.m_keyCount);
+
+    const_iterator end = other.end();
+    for (const_iterator iter = other.begin(); iter != end; ++iter) {
+        ASSERT(canInsert());
+        reinsert(*iter);
+        iter->key->ref();
+        writeBarrier(globalData, owner, iter->specificValue.get());
+    }
+
+    // Copy the m_deletedOffsets vector.
+    Vector<unsigned>* otherDeletedOffsets = other.m_deletedOffsets.get();
+    if (otherDeletedOffsets)
+        m_deletedOffsets.set(new Vector<unsigned>(*otherDeletedOffsets));
+}
+
+inline PropertyTable::~PropertyTable()
+{
+    iterator end = this->end();
+    for (iterator iter = begin(); iter != end; ++iter)
+        iter->key->deref();
+
+    fastFree(m_index);
+}
+
+inline PropertyTable::iterator PropertyTable::begin()
+{
+    return iterator(skipDeletedEntries(table()));
+}
+
+inline PropertyTable::iterator PropertyTable::end()
+{
+    return iterator(table() + usedCount());
+}
+
+inline PropertyTable::const_iterator PropertyTable::begin() const
+{
+    return const_iterator(skipDeletedEntries(table()));
+}
+
+inline PropertyTable::const_iterator PropertyTable::end() const
+{
+    return const_iterator(table() + usedCount());
+}
+
+inline PropertyTable::find_iterator PropertyTable::find(const KeyType& key)
+{
+    ASSERT(key);
+    unsigned hash = key->existingHash();
+    unsigned step = 0;
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numProbes;
+#endif
+
+    while (true) {
+        unsigned entryIndex = m_index[hash & m_indexMask];
+        if (entryIndex == EmptyEntryIndex)
+            return std::make_pair((ValueType*)0, hash & m_indexMask);
+        if (key == table()[entryIndex - 1].key)
+            return std::make_pair(&table()[entryIndex - 1], hash & m_indexMask);
+
+#if DUMP_PROPERTYMAP_STATS
+        ++numCollisions;
+#endif
+
+        if (!step)
+            step =WTF::doubleHash(key->existingHash()) | 1;
+        hash += step;
+
+#if DUMP_PROPERTYMAP_STATS
+        ++numRehashes;
+#endif
+    }
+}
+
+inline std::pair<PropertyTable::find_iterator, bool> PropertyTable::add(const ValueType& entry)
+{
+    // Look for a value with a matching key already in the array.
+    find_iterator iter = find(entry.key);
+    if (iter.first)
+        return std::make_pair(iter, false);
+
+    // Ref the key
+    entry.key->ref();
+
+    // ensure capacity is available.
+    if (!canInsert()) {
+        rehash(m_keyCount + 1);
+        iter = find(entry.key);
+        ASSERT(!iter.first);
+    }
+
+    // Allocate a slot in the hashtable, and set the index to reference this.
+    unsigned entryIndex = usedCount() + 1;
+    m_index[iter.second] = entryIndex;
+    iter.first = &table()[entryIndex - 1];
+    *iter.first = entry;
+
+    ++m_keyCount;
+    return std::make_pair(iter, true);
+}
+
+inline void PropertyTable::remove(const find_iterator& iter)
+{
+    // Removing a key that doesn't exist does nothing!
+    if (!iter.first)
+        return;
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numRemoves;
+#endif
+
+    // Replace this one element with the deleted sentinel. Also clear out
+    // the entry so we can iterate all the entries as needed.
+    m_index[iter.second] = deletedEntryIndex();
+    iter.first->key->deref();
+    iter.first->key = PROPERTY_MAP_DELETED_ENTRY_KEY;
+
+    ASSERT(m_keyCount >= 1);
+    --m_keyCount;
+    ++m_deletedCount;
+
+    if (m_deletedCount * 4 >= m_indexSize)
+        rehash(m_keyCount);
+}
+
+inline void PropertyTable::remove(const KeyType& key)
+{
+    remove(find(key));
+}
+
+// returns the number of values in the hashtable.
+inline unsigned PropertyTable::size() const
+{
+    return m_keyCount;
+}
+
+inline bool PropertyTable::isEmpty() const
+{
+    return !m_keyCount;
+}
+
+inline unsigned PropertyTable::propertyStorageSize() const
+{
+    return size() + (m_deletedOffsets ? m_deletedOffsets->size() : 0);
+}
+
+inline void PropertyTable::clearDeletedOffsets()
+{
+    m_deletedOffsets.clear();
+}
+
+inline bool PropertyTable::hasDeletedOffset()
+{
+    return m_deletedOffsets && !m_deletedOffsets->isEmpty();
+}
+
+inline unsigned PropertyTable::getDeletedOffset()
+{
+    unsigned offset = m_deletedOffsets->last();
+    m_deletedOffsets->removeLast();
+    return offset;
+}
+
+inline void PropertyTable::addDeletedOffset(unsigned offset)
+{
+    if (!m_deletedOffsets)
+        m_deletedOffsets.set(new Vector<unsigned>);
+    m_deletedOffsets->append(offset);
+}
+
+inline PassOwnPtr<PropertyTable> PropertyTable::copy(JSGlobalData& globalData, JSCell* owner, unsigned newCapacity)
+{
+    ASSERT(newCapacity >= m_keyCount);
+
+    // Fast case; if the new table will be the same m_indexSize as this one, we can memcpy it,
+    // save rehashing all keys.
+    if (sizeForCapacity(newCapacity) == m_indexSize)
+        return new PropertyTable(globalData, owner, *this);
+    return new PropertyTable(globalData, owner, newCapacity, *this);
+}
+
+#ifndef NDEBUG
+inline size_t PropertyTable::sizeInMemory()
+{
+    size_t result = sizeof(PropertyTable) + dataSize();
+    if (m_deletedOffsets)
+        result += (m_deletedOffsets->capacity() * sizeof(unsigned));
+    return result;
+}
+#endif
+
+inline void PropertyTable::reinsert(const ValueType& entry)
+{
+    // Used to insert a value known not to be in the table, and where
+    // we know capacity to be available.
+    ASSERT(canInsert());
+    find_iterator iter = find(entry.key);
+    ASSERT(!iter.first);
+
+    unsigned entryIndex = usedCount() + 1;
+    m_index[iter.second] = entryIndex;
+    table()[entryIndex - 1] = entry;
+
+    ++m_keyCount;
+}
+
+inline void PropertyTable::rehash(unsigned newCapacity)
+{
+    unsigned* oldEntryIndices = m_index;
+    iterator iter = this->begin();
+    iterator end = this->end();
+
+    m_indexSize = sizeForCapacity(newCapacity);
+    m_indexMask = m_indexSize - 1;
+    m_keyCount = 0;
+    m_deletedCount = 0;
+    m_index = static_cast<unsigned*>(fastZeroedMalloc(dataSize()));
+
+    for (; iter != end; ++iter) {
+        ASSERT(canInsert());
+        reinsert(*iter);
+    }
+
+    fastFree(oldEntryIndices);
+}
+
+inline unsigned PropertyTable::tableCapacity() const { return m_indexSize >> 1; }
+
+inline unsigned PropertyTable::deletedEntryIndex() const { return tableCapacity() + 1; }
+
+template<typename T>
+inline T* PropertyTable::skipDeletedEntries(T* valuePtr)
+{
+    while (valuePtr->key == PROPERTY_MAP_DELETED_ENTRY_KEY)
+        ++valuePtr;
+    return valuePtr;
+}
+
+inline PropertyTable::ValueType* PropertyTable::table()
+{
+    // The table of values lies after the hash index.
+    return reinterpret_cast<ValueType*>(m_index + m_indexSize);
+}
+
+inline const PropertyTable::ValueType* PropertyTable::table() const
+{
+    // The table of values lies after the hash index.
+    return reinterpret_cast<const ValueType*>(m_index + m_indexSize);
+}
+
+inline unsigned PropertyTable::usedCount() const
+{
+    // Total number of  used entries in the values array - by either valid entries, or deleted ones.
+    return m_keyCount + m_deletedCount;
+}
+
+inline size_t PropertyTable::dataSize()
+{
+    // The size in bytes of data needed for by the table.
+    return m_indexSize * sizeof(unsigned) + ((tableCapacity()) + 1) * sizeof(ValueType);
+}
+
+inline unsigned PropertyTable::sizeForCapacity(unsigned capacity)
+{
+    if (capacity < 8)
+        return MinimumTableSize;
+    return nextPowerOf2(capacity + 1) * 2;
+}
+
+inline bool PropertyTable::canInsert()
+{
+    return usedCount() < tableCapacity();
+}
+
 } // namespace JSC
 
 #endif // PropertyMapHashTable_h
diff --git a/Source/JavaScriptCore/runtime/PropertyNameArray.cpp b/Source/JavaScriptCore/runtime/PropertyNameArray.cpp
index afb41be..8efb406 100644
--- a/Source/JavaScriptCore/runtime/PropertyNameArray.cpp
+++ b/Source/JavaScriptCore/runtime/PropertyNameArray.cpp
@@ -21,6 +21,8 @@
 #include "config.h"
 #include "PropertyNameArray.h"
 
+#include "JSObject.h"
+#include "ScopeChain.h"
 #include "Structure.h"
 #include "StructureChain.h"
 
diff --git a/Source/JavaScriptCore/runtime/PropertySlot.h b/Source/JavaScriptCore/runtime/PropertySlot.h
index cdda6ff..ce29ac4 100644
--- a/Source/JavaScriptCore/runtime/PropertySlot.h
+++ b/Source/JavaScriptCore/runtime/PropertySlot.h
@@ -123,15 +123,6 @@ namespace JSC {
             m_value = value;
         }
 
-        void setRegisterSlot(Register* registerSlot)
-        {
-            ASSERT(registerSlot);
-            clearBase();
-            clearOffset();
-            m_getValue = JSC_VALUE_MARKER;
-            m_value = registerSlot->jsValue();
-        }
-
         void setCustom(JSValue slotBase, GetValueFunc getValue)
         {
             ASSERT(slotBase);
diff --git a/Source/JavaScriptCore/runtime/Protect.h b/Source/JavaScriptCore/runtime/Protect.h
index 0c1b5e8..843c9e1 100644
--- a/Source/JavaScriptCore/runtime/Protect.h
+++ b/Source/JavaScriptCore/runtime/Protect.h
@@ -61,155 +61,6 @@ namespace JSC {
             gcUnprotect(value.asCell());
     }
 
-    // FIXME: Share more code with RefPtr template? The only differences are the ref/deref operation
-    // and the implicit conversion to raw pointer
-    template <class T> class ProtectedPtr {
-    public:
-        ProtectedPtr() : m_ptr(0) {}
-        ProtectedPtr(T* ptr);
-        ProtectedPtr(const ProtectedPtr&);
-        ~ProtectedPtr();
-
-        template <class U> ProtectedPtr(const ProtectedPtr<U>&);
-        
-        T* get() const { return m_ptr; }
-        operator T*() const { return m_ptr; }
-        operator JSValue() const { return JSValue(m_ptr); }
-        T* operator->() const { return m_ptr; }
-        
-        operator bool() const { return m_ptr; }
-        bool operator!() const { return !m_ptr; }
-
-        ProtectedPtr& operator=(const ProtectedPtr&);
-        ProtectedPtr& operator=(T*);
-        
-    private:
-        T* m_ptr;
-    };
-
-    class ProtectedJSValue {
-    public:
-        ProtectedJSValue() {}
-        ProtectedJSValue(JSValue value);
-        ProtectedJSValue(const ProtectedJSValue&);
-        ~ProtectedJSValue();
-
-        template <class U> ProtectedJSValue(const ProtectedPtr<U>&);
-        
-        JSValue get() const { return m_value; }
-        operator JSValue() const { return m_value; }
-        JSValue operator->() const { return m_value; }
-        
-        operator bool() const { return m_value; }
-        bool operator!() const { return !m_value; }
-
-        ProtectedJSValue& operator=(const ProtectedJSValue&);
-        ProtectedJSValue& operator=(JSValue);
-        
-    private:
-        JSValue m_value;
-    };
-
-    template <class T> inline ProtectedPtr<T>::ProtectedPtr(T* ptr)
-        : m_ptr(ptr)
-    {
-        gcProtectNullTolerant(m_ptr);
-    }
-
-    template <class T> inline ProtectedPtr<T>::ProtectedPtr(const ProtectedPtr& o)
-        : m_ptr(o.get())
-    {
-        gcProtectNullTolerant(m_ptr);
-    }
-
-    template <class T> inline ProtectedPtr<T>::~ProtectedPtr()
-    {
-        gcUnprotectNullTolerant(m_ptr);
-    }
-
-    template <class T> template <class U> inline ProtectedPtr<T>::ProtectedPtr(const ProtectedPtr<U>& o)
-        : m_ptr(o.get())
-    {
-        gcProtectNullTolerant(m_ptr);
-    }
-
-    template <class T> inline ProtectedPtr<T>& ProtectedPtr<T>::operator=(const ProtectedPtr<T>& o) 
-    {
-        T* optr = o.m_ptr;
-        gcProtectNullTolerant(optr);
-        gcUnprotectNullTolerant(m_ptr);
-        m_ptr = optr;
-        return *this;
-    }
-
-    template <class T> inline ProtectedPtr<T>& ProtectedPtr<T>::operator=(T* optr)
-    {
-        gcProtectNullTolerant(optr);
-        gcUnprotectNullTolerant(m_ptr);
-        m_ptr = optr;
-        return *this;
-    }
-
-    inline ProtectedJSValue::ProtectedJSValue(JSValue value)
-        : m_value(value)
-    {
-        gcProtect(m_value);
-    }
-
-    inline ProtectedJSValue::ProtectedJSValue(const ProtectedJSValue& o)
-        : m_value(o.get())
-    {
-        gcProtect(m_value);
-    }
-
-    inline ProtectedJSValue::~ProtectedJSValue()
-    {
-        gcUnprotect(m_value);
-    }
-
-    template <class U> ProtectedJSValue::ProtectedJSValue(const ProtectedPtr<U>& o)
-        : m_value(o.get())
-    {
-        gcProtect(m_value);
-    }
-
-    inline ProtectedJSValue& ProtectedJSValue::operator=(const ProtectedJSValue& o) 
-    {
-        JSValue ovalue = o.m_value;
-        gcProtect(ovalue);
-        gcUnprotect(m_value);
-        m_value = ovalue;
-        return *this;
-    }
-
-    inline ProtectedJSValue& ProtectedJSValue::operator=(JSValue ovalue)
-    {
-        gcProtect(ovalue);
-        gcUnprotect(m_value);
-        m_value = ovalue;
-        return *this;
-    }
-
-    template <class T> inline bool operator==(const ProtectedPtr<T>& a, const ProtectedPtr<T>& b) { return a.get() == b.get(); }
-    template <class T> inline bool operator==(const ProtectedPtr<T>& a, const T* b) { return a.get() == b; }
-    template <class T> inline bool operator==(const T* a, const ProtectedPtr<T>& b) { return a == b.get(); }
-
-    template <class T> inline bool operator!=(const ProtectedPtr<T>& a, const ProtectedPtr<T>& b) { return a.get() != b.get(); }
-    template <class T> inline bool operator!=(const ProtectedPtr<T>& a, const T* b) { return a.get() != b; }
-    template <class T> inline bool operator!=(const T* a, const ProtectedPtr<T>& b) { return a != b.get(); }
-
-    inline bool operator==(const ProtectedJSValue& a, const ProtectedJSValue& b) { return a.get() == b.get(); }
-    inline bool operator==(const ProtectedJSValue& a, const JSValue b) { return a.get() == b; }
-    template <class T> inline bool operator==(const ProtectedJSValue& a, const ProtectedPtr<T>& b) { return a.get() == JSValue(b.get()); }
-    inline bool operator==(const JSValue a, const ProtectedJSValue& b) { return a == b.get(); }
-    template <class T> inline bool operator==(const ProtectedPtr<T>& a, const ProtectedJSValue& b) { return JSValue(a.get()) == b.get(); }
-
-    inline bool operator!=(const ProtectedJSValue& a, const ProtectedJSValue& b) { return a.get() != b.get(); }
-    inline bool operator!=(const ProtectedJSValue& a, const JSValue b) { return a.get() != b; }
-    template <class T> inline bool operator!=(const ProtectedJSValue& a, const ProtectedPtr<T>& b) { return a.get() != JSValue(b.get()); }
-    inline bool operator!=(const JSValue a, const ProtectedJSValue& b) { return a != b.get(); }
-    template <class T> inline bool operator!=(const ProtectedPtr<T>& a, const ProtectedJSValue& b) { return JSValue(a.get()) != b.get(); }
- 
 } // namespace JSC
 
 #endif // Protect_h
diff --git a/Source/JavaScriptCore/runtime/PrototypeFunction.cpp b/Source/JavaScriptCore/runtime/PrototypeFunction.cpp
deleted file mode 100644
index 95e1033..0000000
--- a/Source/JavaScriptCore/runtime/PrototypeFunction.cpp
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
- *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
- *  Copyright (C) 2007 Maks Orlovich
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "PrototypeFunction.h"
-
-#include "JSGlobalObject.h"
-#include <wtf/Assertions.h>
-
-namespace JSC {
-
-ASSERT_CLASS_FITS_IN_CELL(PrototypeFunction);
-
-PrototypeFunction::PrototypeFunction(ExecState* exec, JSGlobalObject* globalObject, int length, const Identifier& name, NativeFunction function)
-    : InternalFunction(&exec->globalData(), globalObject, exec->lexicalGlobalObject()->prototypeFunctionStructure(), name)
-    , m_function(function)
-{
-    ASSERT_ARG(function, function);
-    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
-}
-
-PrototypeFunction::PrototypeFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> prototypeFunctionStructure, int length, const Identifier& name, NativeFunction function)
-    : InternalFunction(&exec->globalData(), globalObject, prototypeFunctionStructure, name)
-    , m_function(function)
-{
-    ASSERT_ARG(function, function);
-    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
-}
-    
-CallType PrototypeFunction::getCallData(CallData& callData)
-{
-    callData.native.function = m_function;
-    return CallTypeHost;
-}
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/PrototypeFunction.h b/Source/JavaScriptCore/runtime/PrototypeFunction.h
deleted file mode 100644
index 6ca2342..0000000
--- a/Source/JavaScriptCore/runtime/PrototypeFunction.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2006, 2007, 2008 Apple Inc. All rights reserved.
- *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
- *  Copyright (C) 2007 Maks Orlovich
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef PrototypeFunction_h
-#define PrototypeFunction_h
-
-#include "InternalFunction.h"
-#include "CallData.h"
-
-namespace JSC {
-
-    class PrototypeFunction : public InternalFunction {
-    public:
-        PrototypeFunction(ExecState*, JSGlobalObject*, int length, const Identifier&, NativeFunction);
-        PrototypeFunction(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, int length, const Identifier&, NativeFunction);
-
-    private:
-        virtual CallType getCallData(CallData&);
-
-        const NativeFunction m_function;
-    };
-
-} // namespace JSC
-
-#endif // PrototypeFunction_h
diff --git a/Source/JavaScriptCore/runtime/PutPropertySlot.h b/Source/JavaScriptCore/runtime/PutPropertySlot.h
index 4c9e0e6..69d1f8b 100644
--- a/Source/JavaScriptCore/runtime/PutPropertySlot.h
+++ b/Source/JavaScriptCore/runtime/PutPropertySlot.h
@@ -45,14 +45,14 @@ namespace JSC {
         {
         }
 
-        void setExistingProperty(DeprecatedPtr<JSObject> base, size_t offset)
+        void setExistingProperty(JSObject* base, size_t offset)
         {
             m_type = ExistingProperty;
             m_base = base;
             m_offset = offset;
         }
 
-        void setNewProperty(DeprecatedPtr<JSObject> base, size_t offset)
+        void setNewProperty(JSObject* base, size_t offset)
         {
             m_type = NewProperty;
             m_base = base;
@@ -60,7 +60,7 @@ namespace JSC {
         }
 
         Type type() const { return m_type; }
-        JSObject* base() const { return m_base.get(); }
+        JSObject* base() const { return m_base; }
 
         bool isStrictMode() const { return m_isStrictMode; }
         bool isCacheable() const { return m_type != Uncachable; }
@@ -68,9 +68,10 @@ namespace JSC {
             ASSERT(isCacheable());
             return m_offset;
         }
+
     private:
         Type m_type;
-        DeprecatedPtr<JSObject> m_base;
+        JSObject* m_base;
         size_t m_offset;
         bool m_isStrictMode;
     };
diff --git a/Source/JavaScriptCore/runtime/RegExp.cpp b/Source/JavaScriptCore/runtime/RegExp.cpp
index 95ce5e9..25cb2d5 100644
--- a/Source/JavaScriptCore/runtime/RegExp.cpp
+++ b/Source/JavaScriptCore/runtime/RegExp.cpp
@@ -34,6 +34,38 @@
 
 namespace JSC {
 
+RegExpFlags regExpFlags(const UString& string)
+{
+    RegExpFlags flags = NoFlags;
+
+    for (unsigned i = 0; i < string.length(); ++i) {
+        switch (string.characters()[i]) {
+        case 'g':
+            if (flags & FlagGlobal)
+                return InvalidFlags;
+            flags = static_cast<RegExpFlags>(flags | FlagGlobal);
+            break;
+
+        case 'i':
+            if (flags & FlagIgnoreCase)
+                return InvalidFlags;
+            flags = static_cast<RegExpFlags>(flags | FlagIgnoreCase);
+            break;
+
+        case 'm':
+            if (flags & FlagMultiline)
+                return InvalidFlags;
+            flags = static_cast<RegExpFlags>(flags | FlagMultiline);
+            break;
+
+        default:
+            return InvalidFlags;
+        }
+    }
+
+    return flags;
+}
+  
 struct RegExpRepresentation {
 #if ENABLE(YARR_JIT)
     Yarr::YarrCodeBlock m_regExpJITCode;
@@ -41,9 +73,9 @@ struct RegExpRepresentation {
     OwnPtr<Yarr::BytecodePattern> m_regExpBytecode;
 };
 
-inline RegExp::RegExp(JSGlobalData* globalData, const UString& patternString, const UString& flags)
+inline RegExp::RegExp(JSGlobalData* globalData, const UString& patternString, RegExpFlags flags)
     : m_patternString(patternString)
-    , m_flagBits(0)
+    , m_flags(flags)
     , m_constructionError(0)
     , m_numSubpatterns(0)
 #if ENABLE(REGEXP_TRACING)
@@ -52,17 +84,6 @@ inline RegExp::RegExp(JSGlobalData* globalData, const UString& patternString, co
 #endif
     , m_representation(adoptPtr(new RegExpRepresentation))
 {
-    // NOTE: The global flag is handled on a case-by-case basis by functions like
-    // String::match and RegExpObject::match.
-    if (!flags.isNull()) {
-        if (flags.find('g') != notFound)
-            m_flagBits |= Global;
-        if (flags.find('i') != notFound)
-            m_flagBits |= IgnoreCase;
-        if (flags.find('m') != notFound)
-            m_flagBits |= Multiline;
-    }
-
     m_state = compile(globalData);
 }
 
@@ -70,7 +91,7 @@ RegExp::~RegExp()
 {
 }
 
-PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& patternString, const UString& flags)
+PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& patternString, RegExpFlags flags)
 {
     RefPtr<RegExp> res = adoptRef(new RegExp(globalData, patternString, flags));
 #if ENABLE(REGEXP_TRACING)
diff --git a/Source/JavaScriptCore/runtime/RegExp.h b/Source/JavaScriptCore/runtime/RegExp.h
index d99befb..000c33a 100644
--- a/Source/JavaScriptCore/runtime/RegExp.h
+++ b/Source/JavaScriptCore/runtime/RegExp.h
@@ -24,6 +24,7 @@
 
 #include "UString.h"
 #include "ExecutableAllocator.h"
+#include "RegExpKey.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
 
@@ -32,18 +33,20 @@ namespace JSC {
     struct RegExpRepresentation;
     class JSGlobalData;
 
+    RegExpFlags regExpFlags(const UString&);
+
     class RegExp : public RefCounted<RegExp> {
     public:
-        static PassRefPtr<RegExp> create(JSGlobalData* globalData, const UString& pattern, const UString& flags);
+        static PassRefPtr<RegExp> create(JSGlobalData* globalData, const UString& pattern, RegExpFlags);
         ~RegExp();
 
-        bool global() const { return m_flagBits & Global; }
-        bool ignoreCase() const { return m_flagBits & IgnoreCase; }
-        bool multiline() const { return m_flagBits & Multiline; }
+        bool global() const { return m_flags & FlagGlobal; }
+        bool ignoreCase() const { return m_flags & FlagIgnoreCase; }
+        bool multiline() const { return m_flags & FlagMultiline; }
 
         const UString& pattern() const { return m_patternString; }
 
-        bool isValid() const { return !m_constructionError; }
+        bool isValid() const { return !m_constructionError && m_flags != InvalidFlags; }
         const char* errorMessage() const { return m_constructionError; }
 
         int match(const UString&, int startOffset, Vector<int, 32>* ovector = 0);
@@ -54,7 +57,7 @@ namespace JSC {
 #endif
 
     private:
-        RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags);
+        RegExp(JSGlobalData* globalData, const UString& pattern, RegExpFlags);
 
         enum RegExpState {
             ParseError,
@@ -68,9 +71,8 @@ namespace JSC {
         void matchCompareWithInterpreter(const UString&, int startOffset, int* offsetVector, int jitResult);
 #endif
 
-        enum FlagBits { Global = 1, IgnoreCase = 2, Multiline = 4 };
         UString m_patternString;
-        int m_flagBits;
+        RegExpFlags m_flags;
         const char* m_constructionError;
         unsigned m_numSubpatterns;
 #if ENABLE(REGEXP_TRACING)
diff --git a/Source/JavaScriptCore/runtime/RegExpCache.cpp b/Source/JavaScriptCore/runtime/RegExpCache.cpp
index d101758..c96b047 100644
--- a/Source/JavaScriptCore/runtime/RegExpCache.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpCache.cpp
@@ -31,7 +31,7 @@
 
 namespace JSC {
 
-PassRefPtr<RegExp> RegExpCache::lookupOrCreate(const UString& patternString, const UString& flags)
+PassRefPtr<RegExp> RegExpCache::lookupOrCreate(const UString& patternString, RegExpFlags flags)
 {
     if (patternString.length() < maxCacheablePatternLength) {
         pair<RegExpCacheMap::iterator, bool> result = m_cacheMap.add(RegExpKey(flags, patternString), 0);
@@ -43,7 +43,7 @@ PassRefPtr<RegExp> RegExpCache::lookupOrCreate(const UString& patternString, con
     return create(patternString, flags, m_cacheMap.end());
 }
 
-PassRefPtr<RegExp> RegExpCache::create(const UString& patternString, const UString& flags, RegExpCacheMap::iterator iterator) 
+PassRefPtr<RegExp> RegExpCache::create(const UString& patternString, RegExpFlags flags, RegExpCacheMap::iterator iterator) 
 {
     RefPtr<RegExp> regExp = RegExp::create(m_globalData, patternString, flags);
 
diff --git a/Source/JavaScriptCore/runtime/RegExpCache.h b/Source/JavaScriptCore/runtime/RegExpCache.h
index b5b637f..b4a6ae5 100644
--- a/Source/JavaScriptCore/runtime/RegExpCache.h
+++ b/Source/JavaScriptCore/runtime/RegExpCache.h
@@ -41,8 +41,8 @@ class RegExpCache {
 typedef HashMap<RegExpKey, RefPtr<RegExp> > RegExpCacheMap;
 
 public:
-    PassRefPtr<RegExp> lookupOrCreate(const UString& patternString, const UString& flags);
-    PassRefPtr<RegExp> create(const UString& patternString, const UString& flags, RegExpCacheMap::iterator iterator);
+    PassRefPtr<RegExp> lookupOrCreate(const UString& patternString, RegExpFlags);
+    PassRefPtr<RegExp> create(const UString& patternString, RegExpFlags, RegExpCacheMap::iterator);
     RegExpCache(JSGlobalData* globalData);
 
 private:
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
index 1b30514..3da0198 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -67,7 +67,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(RegExpConstructor);
 
-const ClassInfo RegExpConstructor::info = { "Function", &InternalFunction::info, 0, ExecState::regExpConstructorTable };
+const ClassInfo RegExpConstructor::s_info = { "Function", &InternalFunction::s_info, 0, ExecState::regExpConstructorTable };
 
 /* Source for RegExpConstructor.lut.h
 @begin regExpConstructorTable
@@ -95,10 +95,12 @@ const ClassInfo RegExpConstructor::info = { "Function", &InternalFunction::info,
 @end
 */
 
-RegExpConstructor::RegExpConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, RegExpPrototype* regExpPrototype)
+RegExpConstructor::RegExpConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, RegExpPrototype* regExpPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, "RegExp"))
     , d(adoptPtr(new RegExpConstructorPrivate))
 {
+    ASSERT(inherits(&s_info));
+
     // ECMA 15.10.5.1 RegExp.prototype
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, regExpPrototype, DontEnum | DontDelete | ReadOnly);
 
@@ -107,7 +109,7 @@ RegExpConstructor::RegExpConstructor(ExecState* exec, JSGlobalObject* globalObje
 }
 
 RegExpMatchesArray::RegExpMatchesArray(ExecState* exec, RegExpConstructorPrivate* data)
-    : JSArray(exec->lexicalGlobalObject()->regExpMatchesArrayStructure(), data->lastNumSubPatterns + 1, CreateInitialized)
+    : JSArray(exec->globalData(), exec->lexicalGlobalObject()->regExpMatchesArrayStructure(), data->lastNumSubPatterns + 1, CreateInitialized)
 {
     RegExpConstructorPrivate* d = new RegExpConstructorPrivate;
     d->input = data->lastInput;
@@ -289,32 +291,42 @@ void setRegExpConstructorMultiline(ExecState* exec, JSObject* baseObject, JSValu
 {
     asRegExpConstructor(baseObject)->setMultiline(value.toBoolean(exec));
 }
-  
+
 // ECMA 15.10.4
-JSObject* constructRegExp(ExecState* exec, const ArgList& args)
+JSObject* constructRegExp(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args)
 {
     JSValue arg0 = args.at(0);
     JSValue arg1 = args.at(1);
 
-    if (arg0.inherits(&RegExpObject::info)) {
+    if (arg0.inherits(&RegExpObject::s_info)) {
         if (!arg1.isUndefined())
             return throwError(exec, createTypeError(exec, "Cannot supply flags when constructing one RegExp from another."));
         return asObject(arg0);
     }
 
     UString pattern = arg0.isUndefined() ? UString("") : arg0.toString(exec);
-    UString flags = arg1.isUndefined() ? UString("") : arg1.toString(exec);
+    if (exec->hadException())
+        return 0;
+
+    RegExpFlags flags = NoFlags;
+    if (!arg1.isUndefined()) {
+        flags = regExpFlags(arg1.toString(exec));
+        if (exec->hadException())
+            return 0;
+        if (flags == InvalidFlags)
+            return throwError(exec, createSyntaxError(exec, "Invalid flags supplied to RegExp constructor."));
+    }
 
     RefPtr<RegExp> regExp = exec->globalData().regExpCache()->lookupOrCreate(pattern, flags);
     if (!regExp->isValid())
         return throwError(exec, createSyntaxError(exec, regExp->errorMessage()));
-    return new (exec) RegExpObject(exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->regExpStructure(), regExp.release());
+    return new (exec) RegExpObject(exec->lexicalGlobalObject(), globalObject->regExpStructure(), regExp.release());
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithRegExpConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructRegExp(exec, args));
+    return JSValue::encode(constructRegExp(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 ConstructType RegExpConstructor::getConstructData(ConstructData& constructData)
@@ -327,7 +339,7 @@ ConstructType RegExpConstructor::getConstructData(ConstructData& constructData)
 static EncodedJSValue JSC_HOST_CALL callRegExpConstructor(ExecState* exec)
 {
     ArgList args(exec);
-    return JSValue::encode(constructRegExp(exec, args));
+    return JSValue::encode(constructRegExp(exec, asInternalFunction(exec->callee())->globalObject(), args));
 }
 
 CallType RegExpConstructor::getCallData(CallData& callData)
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.h b/Source/JavaScriptCore/runtime/RegExpConstructor.h
index 1714bd3..548664e 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.h
@@ -57,18 +57,18 @@ namespace JSC {
 
     class RegExpConstructor : public InternalFunction {
     public:
-        RegExpConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, RegExpPrototype*);
+        RegExpConstructor(ExecState*, JSGlobalObject*, Structure*, RegExpPrototype*);
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
-        static const ClassInfo info;
+        static const ClassInfo s_info;
 
         void performMatch(RegExp*, const UString&, int startOffset, int& position, int& length, int** ovector = 0);
         JSObject* arrayOfMatches(ExecState*) const;
@@ -91,18 +91,16 @@ namespace JSC {
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-
         OwnPtr<RegExpConstructorPrivate> d;
     };
 
     RegExpConstructor* asRegExpConstructor(JSValue);
 
-    JSObject* constructRegExp(ExecState*, const ArgList&);
+    JSObject* constructRegExp(ExecState*, JSGlobalObject*, const ArgList&);
 
     inline RegExpConstructor* asRegExpConstructor(JSValue value)
     {
-        ASSERT(asObject(value)->inherits(&RegExpConstructor::info));
+        ASSERT(asObject(value)->inherits(&RegExpConstructor::s_info));
         return static_cast<RegExpConstructor*>(asObject(value));
     }
 
diff --git a/Source/JavaScriptCore/runtime/RegExpKey.h b/Source/JavaScriptCore/runtime/RegExpKey.h
index cd1368d..b4847f9 100644
--- a/Source/JavaScriptCore/runtime/RegExpKey.h
+++ b/Source/JavaScriptCore/runtime/RegExpKey.h
@@ -25,63 +25,54 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "UString.h"
-#include <wtf/text/StringHash.h>
-
 #ifndef RegExpKey_h
 #define RegExpKey_h
 
+#include "UString.h"
+#include <wtf/text/StringHash.h>
+
 namespace JSC {
 
+enum RegExpFlags {
+    NoFlags = 0,
+    FlagGlobal = 1,
+    FlagIgnoreCase = 2,
+    FlagMultiline = 4,
+    InvalidFlags = 8,
+    DeletedValueFlags = -1
+};
+
 struct RegExpKey {
-    int flagsValue;
+    RegExpFlags flagsValue;
     RefPtr<StringImpl> pattern;
 
     RegExpKey()
-        : flagsValue(0)
+        : flagsValue(NoFlags)
     {
     }
 
-    RegExpKey(int flags)
+    RegExpKey(RegExpFlags flags)
         : flagsValue(flags)
     {
     }
 
-    RegExpKey(int flags, const UString& pattern)
+    RegExpKey(RegExpFlags flags, const UString& pattern)
         : flagsValue(flags)
         , pattern(pattern.impl())
     {
     }
 
-    RegExpKey(int flags, const PassRefPtr<StringImpl> pattern)
+    RegExpKey(RegExpFlags flags, const PassRefPtr<StringImpl> pattern)
         : flagsValue(flags)
         , pattern(pattern)
     {
     }
 
-    RegExpKey(int flags, const RefPtr<StringImpl>& pattern)
+    RegExpKey(RegExpFlags flags, const RefPtr<StringImpl>& pattern)
         : flagsValue(flags)
         , pattern(pattern)
     {
     }
-
-    RegExpKey(const UString& flags, const UString& pattern)
-        : pattern(pattern.impl())
-    {
-        flagsValue = getFlagsValue(flags);
-    }
-
-    int getFlagsValue(const UString flags) 
-    {
-        flagsValue = 0;
-        if (flags.find('g') != notFound)
-            flagsValue += 4;
-        if (flags.find('i') != notFound)
-            flagsValue += 2;
-        if (flags.find('m') != notFound)
-            flagsValue += 1;
-        return flagsValue;
-    }
 };
 
 inline bool operator==(const RegExpKey& a, const RegExpKey& b) 
@@ -112,8 +103,8 @@ template<> struct DefaultHash<JSC::RegExpKey> {
 };
 
 template<> struct HashTraits<JSC::RegExpKey> : GenericHashTraits<JSC::RegExpKey> {
-    static void constructDeletedValue(JSC::RegExpKey& slot) { slot.flagsValue = -1; }
-    static bool isDeletedValue(const JSC::RegExpKey& value) { return value.flagsValue == -1; }
+    static void constructDeletedValue(JSC::RegExpKey& slot) { slot.flagsValue = JSC::DeletedValueFlags; }
+    static bool isDeletedValue(const JSC::RegExpKey& value) { return value.flagsValue == JSC::DeletedValueFlags; }
 };
 } // namespace WTF
 
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.cpp b/Source/JavaScriptCore/runtime/RegExpObject.cpp
index b969e38..d824ecd 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpObject.cpp
@@ -49,7 +49,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(RegExpObject);
 
-const ClassInfo RegExpObject::info = { "RegExp", 0, 0, ExecState::regExpTable };
+const ClassInfo RegExpObject::s_info = { "RegExp", &JSObjectWithGlobalObject::s_info, 0, ExecState::regExpTable };
 
 /* Source for RegExpObject.lut.h
 @begin regExpTable
@@ -61,16 +61,24 @@ const ClassInfo RegExpObject::info = { "RegExp", 0, 0, ExecState::regExpTable };
 @end
 */
 
-RegExpObject::RegExpObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, NonNullPassRefPtr<RegExp> regExp)
+RegExpObject::RegExpObject(JSGlobalObject* globalObject, Structure* structure, NonNullPassRefPtr<RegExp> regExp)
     : JSObjectWithGlobalObject(globalObject, structure)
-    , d(adoptPtr(new RegExpObjectData(regExp, 0)))
+    , d(adoptPtr(new RegExpObjectData(regExp)))
 {
+    ASSERT(inherits(&s_info));
 }
 
 RegExpObject::~RegExpObject()
 {
 }
 
+void RegExpObject::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+    if (UNLIKELY(!d->lastIndex.get().isInt32()))
+        markStack.append(&d->lastIndex);
+}
+
 bool RegExpObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     return getStaticValueSlot<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), this, propertyName, slot);
@@ -103,7 +111,7 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, const Identifier&)
 
 JSValue regExpObjectLastIndex(ExecState*, JSValue slotBase, const Identifier&)
 {
-    return jsNumber(asRegExpObject(slotBase)->lastIndex());
+    return asRegExpObject(slotBase)->getLastIndex();
 }
 
 void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
@@ -113,7 +121,7 @@ void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValue
 
 void setRegExpObjectLastIndex(ExecState* exec, JSObject* baseObject, JSValue value)
 {
-    asRegExpObject(baseObject)->setLastIndex(value.toInteger(exec));
+    asRegExpObject(baseObject)->setLastIndex(exec->globalData(), value);
 }
 
 JSValue RegExpObject::test(ExecState* exec)
@@ -132,12 +140,7 @@ JSValue RegExpObject::exec(ExecState* exec)
 bool RegExpObject::match(ExecState* exec)
 {
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
-
-    UString input = !exec->argumentCount() ? regExpConstructor->input() : exec->argument(0).toString(exec);
-    if (input.isNull()) {
-        throwError(exec, createError(exec, makeUString("No input to ", toString(exec), ".")));
-        return false;
-    }
+    UString input = exec->argument(0).toString(exec);
 
     if (!regExp()->global()) {
         int position;
@@ -146,20 +149,32 @@ bool RegExpObject::match(ExecState* exec)
         return position >= 0;
     }
 
-    if (d->lastIndex < 0 || d->lastIndex > input.length()) {
-        d->lastIndex = 0;
-        return false;
+    JSValue jsLastIndex = getLastIndex();
+    unsigned lastIndex;
+    if (LIKELY(jsLastIndex.isUInt32())) {
+        lastIndex = jsLastIndex.asUInt32();
+        if (lastIndex > input.length()) {
+            setLastIndex(0);
+            return false;
+        }
+    } else {
+        double doubleLastIndex = jsLastIndex.toInteger(exec);
+        if (doubleLastIndex < 0 || doubleLastIndex > input.length()) {
+            setLastIndex(0);
+            return false;
+        }
+        lastIndex = static_cast<unsigned>(doubleLastIndex);
     }
 
     int position;
     int length = 0;
-    regExpConstructor->performMatch(d->regExp.get(), input, static_cast<int>(d->lastIndex), position, length);
+    regExpConstructor->performMatch(d->regExp.get(), input, lastIndex, position, length);
     if (position < 0) {
-        d->lastIndex = 0;
+        setLastIndex(0);
         return false;
     }
 
-    d->lastIndex = position + length;
+    setLastIndex(position + length);
     return true;
 }
 
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.h b/Source/JavaScriptCore/runtime/RegExpObject.h
index 99c84da..4274fff 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.h
+++ b/Source/JavaScriptCore/runtime/RegExpObject.h
@@ -28,14 +28,26 @@ namespace JSC {
 
     class RegExpObject : public JSObjectWithGlobalObject {
     public:
-        RegExpObject(JSGlobalObject* globalObject, NonNullPassRefPtr<Structure>, NonNullPassRefPtr<RegExp>);
+        typedef JSObjectWithGlobalObject Base;
+
+        RegExpObject(JSGlobalObject*, Structure*, NonNullPassRefPtr<RegExp>);
         virtual ~RegExpObject();
 
         void setRegExp(PassRefPtr<RegExp> r) { d->regExp = r; }
         RegExp* regExp() const { return d->regExp.get(); }
 
-        void setLastIndex(double lastIndex) { d->lastIndex = lastIndex; }
-        double lastIndex() const { return d->lastIndex; }
+        void setLastIndex(size_t lastIndex)
+        {
+            d->lastIndex.setWithoutWriteBarrier(jsNumber(lastIndex));
+        }
+        void setLastIndex(JSGlobalData& globalData, JSValue lastIndex)
+        {
+            d->lastIndex.set(globalData, this, lastIndex);
+        }
+        JSValue getLastIndex() const
+        {
+            return d->lastIndex.get();
+        }
 
         JSValue test(ExecState*);
         JSValue exec(ExecState*);
@@ -44,33 +56,34 @@ namespace JSC {
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-        static JS_EXPORTDATA const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo s_info;
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
-        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObjectWithGlobalObject::StructureFlags;
-        
+        static const unsigned StructureFlags = OverridesMarkChildren | OverridesGetOwnPropertySlot | JSObjectWithGlobalObject::StructureFlags;
+
     private:
+        virtual void markChildren(MarkStack&);
+
         bool match(ExecState*);
 
         struct RegExpObjectData {
             WTF_MAKE_FAST_ALLOCATED;
         public:
-            RegExpObjectData(NonNullPassRefPtr<RegExp> regExp, double lastIndex)
+            RegExpObjectData(NonNullPassRefPtr<RegExp> regExp)
                 : regExp(regExp)
-                , lastIndex(lastIndex)
             {
+                lastIndex.setWithoutWriteBarrier(jsNumber(0));
             }
 
             RefPtr<RegExp> regExp;
-            double lastIndex;
+            WriteBarrier<Unknown> lastIndex;
         };
-#if PLATFORM(WIN)
+#if COMPILER(MSVC)
         friend void WTF::deleteOwnedPtr<RegExpObjectData>(RegExpObjectData*);
 #endif
         OwnPtr<RegExpObjectData> d;
@@ -80,7 +93,7 @@ namespace JSC {
 
     inline RegExpObject* asRegExpObject(JSValue value)
     {
-        ASSERT(asObject(value)->inherits(&RegExpObject::info));
+        ASSERT(asObject(value)->inherits(&RegExpObject::s_info));
         return static_cast<RegExpObject*>(asObject(value));
     }
 
diff --git a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
index a7c447d..5bb8ad8 100644
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -30,7 +30,6 @@
 #include "JSStringBuilder.h"
 #include "JSValue.h"
 #include "ObjectPrototype.h"
-#include "PrototypeFunction.h"
 #include "RegExpObject.h"
 #include "RegExp.h"
 #include "RegExpCache.h"
@@ -48,13 +47,13 @@ static EncodedJSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState*);
 
 // ECMA 15.10.5
 
-RegExpPrototype::RegExpPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
-    : RegExpObject(globalObject, structure, RegExp::create(&exec->globalData(), "", ""))
+RegExpPrototype::RegExpPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* functionStructure)
+    : RegExpObject(globalObject, structure, RegExp::create(&exec->globalData(), "", NoFlags))
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().compile, regExpProtoFuncCompile), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().exec, regExpProtoFuncExec), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().test, regExpProtoFuncTest), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 0, exec->propertyNames().toString, regExpProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 2, exec->propertyNames().compile, regExpProtoFuncCompile), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().exec, regExpProtoFuncExec), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().test, regExpProtoFuncTest), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 0, exec->propertyNames().toString, regExpProtoFuncToString), DontEnum);
 }
 
 // ------------------------------ Functions ---------------------------
@@ -62,7 +61,7 @@ RegExpPrototype::RegExpPrototype(ExecState* exec, JSGlobalObject* globalObject,
 EncodedJSValue JSC_HOST_CALL regExpProtoFuncTest(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&RegExpObject::info))
+    if (!thisValue.inherits(&RegExpObject::s_info))
         return throwVMTypeError(exec);
     return JSValue::encode(asRegExpObject(thisValue)->test(exec));
 }
@@ -70,7 +69,7 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncTest(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&RegExpObject::info))
+    if (!thisValue.inherits(&RegExpObject::s_info))
         return throwVMTypeError(exec);
     return JSValue::encode(asRegExpObject(thisValue)->exec(exec));
 }
@@ -78,20 +77,30 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&RegExpObject::info))
+    if (!thisValue.inherits(&RegExpObject::s_info))
         return throwVMTypeError(exec);
 
     RefPtr<RegExp> regExp;
     JSValue arg0 = exec->argument(0);
     JSValue arg1 = exec->argument(1);
     
-    if (arg0.inherits(&RegExpObject::info)) {
+    if (arg0.inherits(&RegExpObject::s_info)) {
         if (!arg1.isUndefined())
             return throwVMError(exec, createTypeError(exec, "Cannot supply flags when constructing one RegExp from another."));
         regExp = asRegExpObject(arg0)->regExp();
     } else {
         UString pattern = !exec->argumentCount() ? UString("") : arg0.toString(exec);
-        UString flags = arg1.isUndefined() ? UString("") : arg1.toString(exec);
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
+
+        RegExpFlags flags = NoFlags;
+        if (!arg1.isUndefined()) {
+            flags = regExpFlags(arg1.toString(exec));
+            if (exec->hadException())
+                return JSValue::encode(jsUndefined());
+            if (flags == InvalidFlags)
+                return throwVMError(exec, createSyntaxError(exec, "Invalid flags supplied to RegExp constructor."));
+        }
         regExp = exec->globalData().regExpCache()->lookupOrCreate(pattern, flags);
     }
 
@@ -106,8 +115,8 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
-    if (!thisValue.inherits(&RegExpObject::info)) {
-        if (thisValue.inherits(&RegExpPrototype::info))
+    if (!thisValue.inherits(&RegExpObject::s_info)) {
+        if (thisValue.inherits(&RegExpPrototype::s_info))
             return JSValue::encode(jsNontrivialString(exec, "//"));
         return throwVMTypeError(exec);
     }
diff --git a/Source/JavaScriptCore/runtime/RegExpPrototype.h b/Source/JavaScriptCore/runtime/RegExpPrototype.h
index eb4ae00..2cc5405 100644
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.h
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.h
@@ -28,7 +28,7 @@ namespace JSC {
 
     class RegExpPrototype : public RegExpObject {
     public:
-        RegExpPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure);
+        RegExpPrototype(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ScopeChain.cpp b/Source/JavaScriptCore/runtime/ScopeChain.cpp
index 976cff6..026d729 100644
--- a/Source/JavaScriptCore/runtime/ScopeChain.cpp
+++ b/Source/JavaScriptCore/runtime/ScopeChain.cpp
@@ -31,16 +31,16 @@ namespace JSC {
 
 #ifndef NDEBUG
 
-void ScopeChainNode::print() const
+void ScopeChainNode::print()
 {
     ScopeChainIterator scopeEnd = end();
     for (ScopeChainIterator scopeIter = begin(); scopeIter != scopeEnd; ++scopeIter) {
-        DeprecatedPtr<JSObject> o = *scopeIter;
+        JSObject* o = scopeIter->get();
         PropertyNameArray propertyNames(globalObject->globalExec());
         o->getPropertyNames(globalObject->globalExec(), propertyNames);
         PropertyNameArray::const_iterator propEnd = propertyNames.end();
 
-        fprintf(stderr, "----- [scope %p] -----\n", o.get());
+        fprintf(stderr, "----- [scope %p] -----\n", o);
         for (PropertyNameArray::const_iterator propIter = propertyNames.begin(); propIter != propEnd; propIter++) {
             Identifier name = *propIter;
             fprintf(stderr, "%s, ", name.ustring().utf8().data());
@@ -51,12 +51,14 @@ void ScopeChainNode::print() const
 
 #endif
 
-int ScopeChain::localDepth() const
+const ClassInfo ScopeChainNode::s_info = { "ScopeChainNode", 0, 0, 0 };
+
+int ScopeChainNode::localDepth()
 {
     int scopeDepth = 0;
     ScopeChainIterator iter = this->begin();
     ScopeChainIterator end = this->end();
-    while (!(*iter)->inherits(&JSActivation::info)) {
+    while (!(*iter)->inherits(&JSActivation::s_info)) {
         ++iter;
         if (iter == end)
             break;
@@ -65,4 +67,13 @@ int ScopeChain::localDepth() const
     return scopeDepth;
 }
 
+void ScopeChainNode::markChildren(MarkStack& markStack)
+{
+    if (next)
+        markStack.append(&next);
+    markStack.append(&object);
+    markStack.append(&globalObject);
+    markStack.append(&globalThis);
+}
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ScopeChain.h b/Source/JavaScriptCore/runtime/ScopeChain.h
index 11f3692..d0a2672 100644
--- a/Source/JavaScriptCore/runtime/ScopeChain.h
+++ b/Source/JavaScriptCore/runtime/ScopeChain.h
@@ -21,7 +21,8 @@
 #ifndef ScopeChain_h
 #define ScopeChain_h
 
-#include "WriteBarrier.h"
+#include "JSCell.h"
+#include "Structure.h"
 #include <wtf/FastAllocBase.h>
 
 namespace JSC {
@@ -32,109 +33,68 @@ namespace JSC {
     class MarkStack;
     class ScopeChainIterator;
     
-    class ScopeChainNode {
-        WTF_MAKE_FAST_ALLOCATED;
+    class ScopeChainNode : public JSCell {
     public:
         ScopeChainNode(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSGlobalObject* globalObject, JSObject* globalThis)
-            : next(next)
-            , object(object)
+            : JSCell(*globalData, globalData->scopeChainNodeStructure.get())
             , globalData(globalData)
-            , globalObject(globalObject)
-            , globalThis(globalThis)
-            , refCount(1)
+            , next(*globalData, this, next)
+            , object(*globalData, this, object)
+            , globalObject(*globalData, this, globalObject)
+            , globalThis(*globalData, this, globalThis)
         {
             ASSERT(globalData);
             ASSERT(globalObject);
         }
-#ifndef NDEBUG
-        // Due to the number of subtle and timing dependent bugs that have occurred due
-        // to deleted but still "valid" ScopeChainNodes we now deliberately clobber the
-        // contents in debug builds.
-        ~ScopeChainNode()
-        {
-            next = 0;
-            globalData = 0;
-            globalObject = 0;
-            globalThis = 0;
-        }
-#endif
 
-        ScopeChainNode* next;
-        DeprecatedPtr<JSObject> object;
         JSGlobalData* globalData;
-        JSGlobalObject* globalObject;
-        JSObject* globalThis;
-        int refCount;
-
-        void deref() { ASSERT(refCount); if (--refCount == 0) { release();} }
-        void ref() { ASSERT(refCount); ++refCount; }
-        void release();
-
-        // Before calling "push" on a bare ScopeChainNode, a client should
-        // logically "copy" the node. Later, the client can "deref" the head
-        // of its chain of ScopeChainNodes to reclaim all the nodes it added
-        // after the logical copy, leaving nodes added before the logical copy
-        // (nodes shared with other clients) untouched.
-        ScopeChainNode* copy()
-        {
-            ref();
-            return this;
-        }
+        WriteBarrier<ScopeChainNode> next;
+        WriteBarrier<JSObject> object;
+        WriteBarrier<JSGlobalObject> globalObject;
+        WriteBarrier<JSObject> globalThis;
 
         ScopeChainNode* push(JSObject*);
         ScopeChainNode* pop();
 
-        ScopeChainIterator begin() const;
-        ScopeChainIterator end() const;
+        ScopeChainIterator begin();
+        ScopeChainIterator end();
+
+        int localDepth();
 
 #ifndef NDEBUG        
-        void print() const;
+        void print();
 #endif
+        
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, &s_info); }
+        virtual void markChildren(MarkStack&);
+    private:
+        static const unsigned StructureFlags = OverridesMarkChildren;
+        static const ClassInfo s_info;
     };
 
     inline ScopeChainNode* ScopeChainNode::push(JSObject* o)
     {
         ASSERT(o);
-        return new ScopeChainNode(this, o, globalData, globalObject, globalThis);
+        return new (globalData) ScopeChainNode(this, o, globalData, globalObject.get(), globalThis.get());
     }
 
     inline ScopeChainNode* ScopeChainNode::pop()
     {
         ASSERT(next);
-        ScopeChainNode* result = next;
-
-        if (--refCount != 0)
-            ++result->refCount;
-        else
-            delete this;
-
-        return result;
-    }
-
-    inline void ScopeChainNode::release()
-    {
-        // This function is only called by deref(),
-        // Deref ensures these conditions are true.
-        ASSERT(refCount == 0);
-        ScopeChainNode* n = this;
-        do {
-            ScopeChainNode* next = n->next;
-            delete n;
-            n = next;
-        } while (n && --n->refCount == 0);
+        return next.get();
     }
 
     class ScopeChainIterator {
     public:
-        ScopeChainIterator(const ScopeChainNode* node)
+        ScopeChainIterator(ScopeChainNode* node)
             : m_node(node)
         {
         }
 
-        DeprecatedPtr<JSObject> const & operator*() const { return m_node->object; }
-        DeprecatedPtr<JSObject> const * operator->() const { return &(operator*()); }
+        WriteBarrier<JSObject> const & operator*() const { return m_node->object; }
+        WriteBarrier<JSObject> const * operator->() const { return &(operator*()); }
     
-        ScopeChainIterator& operator++() { m_node = m_node->next; return *this; }
+        ScopeChainIterator& operator++() { m_node = m_node->next.get(); return *this; }
 
         // postfix ++ intentionally omitted
 
@@ -142,99 +102,43 @@ namespace JSC {
         bool operator!=(const ScopeChainIterator& other) const { return m_node != other.m_node; }
 
     private:
-        const ScopeChainNode* m_node;
+        ScopeChainNode* m_node;
     };
 
-    inline ScopeChainIterator ScopeChainNode::begin() const
+    inline ScopeChainIterator ScopeChainNode::begin()
     {
         return ScopeChainIterator(this); 
     }
 
-    inline ScopeChainIterator ScopeChainNode::end() const
+    inline ScopeChainIterator ScopeChainNode::end()
     { 
         return ScopeChainIterator(0); 
     }
 
-    class NoScopeChain {};
-
-    class ScopeChain {
-        friend class JIT;
-    public:
-        ScopeChain(NoScopeChain)
-            : m_node(0)
-        {
-        }
-
-        ScopeChain(JSObject* o, JSGlobalData* globalData, JSGlobalObject* globalObject, JSObject* globalThis)
-            : m_node(new ScopeChainNode(0, o, globalData, globalObject, globalThis))
-        {
-        }
-
-        ScopeChain(const ScopeChain& c)
-            : m_node(c.m_node->copy())
-        {
-        }
-
-        ScopeChain& operator=(const ScopeChain& c);
-
-        explicit ScopeChain(ScopeChainNode* node)
-            : m_node(node->copy())
-        {
-        }
-
-        ~ScopeChain()
-        {
-            if (m_node)
-                m_node->deref();
-#ifndef NDEBUG
-            m_node = 0;
-#endif
-        }
-
-        void swap(ScopeChain&);
-
-        ScopeChainNode* node() const { return m_node; }
-
-        JSObject* top() const { return m_node->object.get(); }
-
-        ScopeChainIterator begin() const { return m_node->begin(); }
-        ScopeChainIterator end() const { return m_node->end(); }
-
-        void push(JSObject* o) { m_node = m_node->push(o); }
-
-        void pop() { m_node = m_node->pop(); }
-        void clear() { m_node->deref(); m_node = 0; }
-        
-        JSGlobalObject* globalObject() const { return m_node->globalObject; }
-
-        void markAggregate(MarkStack&) const;
-
-        // Caution: this should only be used if the codeblock this is being used
-        // with needs a full scope chain, otherwise this returns the depth of
-        // the preceeding call frame
-        //
-        // Returns the depth of the current call frame's scope chain
-        int localDepth() const;
-
-#ifndef NDEBUG        
-        void print() const { m_node->print(); }
-#endif
-
-    private:
-        ScopeChainNode* m_node;
-    };
-
-    inline void ScopeChain::swap(ScopeChain& o)
+    ALWAYS_INLINE JSGlobalData& ExecState::globalData() const
     {
-        ScopeChainNode* tmp = m_node;
-        m_node = o.m_node;
-        o.m_node = tmp;
+        ASSERT(scopeChain()->globalData);
+        return *scopeChain()->globalData;
     }
 
-    inline ScopeChain& ScopeChain::operator=(const ScopeChain& c)
+    ALWAYS_INLINE JSGlobalObject* ExecState::lexicalGlobalObject() const
+    {
+        return scopeChain()->globalObject.get();
+    }
+    
+    ALWAYS_INLINE JSObject* ExecState::globalThisValue() const
+    {
+        return scopeChain()->globalThis.get();
+    }
+    
+    ALWAYS_INLINE ScopeChainNode* Register::scopeChain() const
+    {
+        return static_cast<ScopeChainNode*>(jsValue().asCell());
+    }
+    
+    ALWAYS_INLINE Register& Register::operator=(ScopeChainNode* scopeChain)
     {
-        ScopeChain tmp(c);
-        swap(tmp);
+        *this = JSValue(scopeChain);
         return *this;
     }
 
diff --git a/Source/JavaScriptCore/runtime/ScopeChainMark.h b/Source/JavaScriptCore/runtime/ScopeChainMark.h
index faa4824..35701f1 100644
--- a/Source/JavaScriptCore/runtime/ScopeChainMark.h
+++ b/Source/JavaScriptCore/runtime/ScopeChainMark.h
@@ -25,12 +25,6 @@
 
 namespace JSC {
 
-    inline void ScopeChain::markAggregate(MarkStack& markStack) const
-    {
-        for (ScopeChainNode* n = m_node; n; n = n->next)
-            markStack.append(&n->object);
-    }
-
 } // namespace JSC
 
 #endif // ScopeChainMark_h
diff --git a/Source/JavaScriptCore/runtime/SmallStrings.cpp b/Source/JavaScriptCore/runtime/SmallStrings.cpp
index 9b193f5..ac67020 100644
--- a/Source/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/Source/JavaScriptCore/runtime/SmallStrings.cpp
@@ -33,8 +33,6 @@
 
 namespace JSC {
 
-static const unsigned numCharactersToStore = 0x100;
-
 static inline bool isMarked(JSCell* string)
 {
     return string && Heap::isMarked(string);
@@ -45,17 +43,22 @@ class SmallStringsStorage {
 public:
     SmallStringsStorage();
 
-    StringImpl* rep(unsigned char character) { return m_reps[character].get(); }
+    StringImpl* rep(unsigned char character)
+    {
+        return m_reps[character].get();
+    }
 
 private:
-    RefPtr<StringImpl> m_reps[numCharactersToStore];
+    static const unsigned singleCharacterStringCount = maxSingleCharacterString + 1;
+
+    RefPtr<StringImpl> m_reps[singleCharacterStringCount];
 };
 
 SmallStringsStorage::SmallStringsStorage()
 {
     UChar* characterBuffer = 0;
-    RefPtr<StringImpl> baseString = StringImpl::createUninitialized(numCharactersToStore, characterBuffer);
-    for (unsigned i = 0; i < numCharactersToStore; ++i) {
+    RefPtr<StringImpl> baseString = StringImpl::createUninitialized(singleCharacterStringCount, characterBuffer);
+    for (unsigned i = 0; i < singleCharacterStringCount; ++i) {
         characterBuffer[i] = i;
         m_reps[i] = StringImpl::create(baseString, i, 1);
     }
@@ -63,7 +66,7 @@ SmallStringsStorage::SmallStringsStorage()
 
 SmallStrings::SmallStrings()
 {
-    COMPILE_ASSERT(numCharactersToStore == sizeof(m_singleCharacterStrings) / sizeof(m_singleCharacterStrings[0]), IsNumCharactersConstInSyncWithClassUsage);
+    COMPILE_ASSERT(singleCharacterStringCount == sizeof(m_singleCharacterStrings) / sizeof(m_singleCharacterStrings[0]), IsNumCharactersConstInSyncWithClassUsage);
     clear();
 }
 
@@ -71,7 +74,7 @@ SmallStrings::~SmallStrings()
 {
 }
 
-void SmallStrings::markChildren(MarkStack& markStack)
+void SmallStrings::markChildren(HeapRootMarker& heapRootMarker)
 {
     /*
        Our hypothesis is that small strings are very common. So, we cache them
@@ -83,9 +86,9 @@ void SmallStrings::markChildren(MarkStack& markStack)
        so, it's probably reasonable to mark the rest. If not, we clear the cache.
      */
 
-    bool isAnyStringMarked = isMarked(m_emptyString.get());
-    for (unsigned i = 0; i < numCharactersToStore && !isAnyStringMarked; ++i)
-        isAnyStringMarked = isMarked(m_singleCharacterStrings[i].get());
+    bool isAnyStringMarked = isMarked(m_emptyString);
+    for (unsigned i = 0; i < singleCharacterStringCount && !isAnyStringMarked; ++i)
+        isAnyStringMarked = isMarked(m_singleCharacterStrings[i]);
     
     if (!isAnyStringMarked) {
         clear();
@@ -93,17 +96,17 @@ void SmallStrings::markChildren(MarkStack& markStack)
     }
     
     if (m_emptyString)
-        markStack.append(&m_emptyString);
-    for (unsigned i = 0; i < numCharactersToStore; ++i) {
+        heapRootMarker.mark(&m_emptyString);
+    for (unsigned i = 0; i < singleCharacterStringCount; ++i) {
         if (m_singleCharacterStrings[i])
-            markStack.append(&m_singleCharacterStrings[i]);
+            heapRootMarker.mark(&m_singleCharacterStrings[i]);
     }
 }
 
 void SmallStrings::clear()
 {
     m_emptyString = 0;
-    for (unsigned i = 0; i < numCharactersToStore; ++i)
+    for (unsigned i = 0; i < singleCharacterStringCount; ++i)
         m_singleCharacterStrings[i] = 0;
 }
 
@@ -112,7 +115,7 @@ unsigned SmallStrings::count() const
     unsigned count = 0;
     if (m_emptyString)
         ++count;
-    for (unsigned i = 0; i < numCharactersToStore; ++i) {
+    for (unsigned i = 0; i < singleCharacterStringCount; ++i) {
         if (m_singleCharacterStrings[i])
             ++count;
     }
diff --git a/Source/JavaScriptCore/runtime/SmallStrings.h b/Source/JavaScriptCore/runtime/SmallStrings.h
index ee795b6..b54d020 100644
--- a/Source/JavaScriptCore/runtime/SmallStrings.h
+++ b/Source/JavaScriptCore/runtime/SmallStrings.h
@@ -33,13 +33,16 @@
 
 namespace JSC {
 
+    class HeapRootMarker;
     class JSGlobalData;
     class JSString;
     class MarkStack;
     class SmallStringsStorage;
 
+    static const unsigned maxSingleCharacterString = 0xFF;
+
     class SmallStrings {
-        WTF_MAKE_NONCOPYABLE(SmallStrings); WTF_MAKE_FAST_ALLOCATED;
+        WTF_MAKE_NONCOPYABLE(SmallStrings);
     public:
         SmallStrings();
         ~SmallStrings();
@@ -48,30 +51,33 @@ namespace JSC {
         {
             if (!m_emptyString)
                 createEmptyString(globalData);
-            return m_emptyString.get();
+            return m_emptyString;
         }
+
         JSString* singleCharacterString(JSGlobalData* globalData, unsigned char character)
         {
             if (!m_singleCharacterStrings[character])
                 createSingleCharacterString(globalData, character);
-            return m_singleCharacterStrings[character].get();
+            return m_singleCharacterStrings[character];
         }
 
         StringImpl* singleCharacterStringRep(unsigned char character);
 
-        void markChildren(MarkStack&);
+        void markChildren(HeapRootMarker&);
         void clear();
 
         unsigned count() const;
-#if ENABLE(JIT)
-        JSCell** singleCharacterStrings() { return m_singleCharacterStrings[0].slot(); }
-#endif
+
+        JSString** singleCharacterStrings() { return &m_singleCharacterStrings[0]; }
+
     private:
+        static const unsigned singleCharacterStringCount = maxSingleCharacterString + 1;
+
         void createEmptyString(JSGlobalData*);
         void createSingleCharacterString(JSGlobalData*, unsigned char);
 
-        DeprecatedPtr<JSString> m_emptyString;
-        FixedArray<DeprecatedPtr<JSString>, 0x100> m_singleCharacterStrings;
+        JSString* m_emptyString;
+        JSString* m_singleCharacterStrings[singleCharacterStringCount];
         OwnPtr<SmallStringsStorage> m_storage;
     };
 
diff --git a/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp b/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp
index 5bb013b..e666dee 100644
--- a/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp
+++ b/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp
@@ -29,7 +29,7 @@
 namespace JSC {
 
 StrictEvalActivation::StrictEvalActivation(ExecState* exec)
-    : JSObject(exec->globalData().strictEvalActivationStructure)
+    : JSNonFinalObject(exec->globalData(), exec->globalData().strictEvalActivationStructure.get())
 {
 }
 
diff --git a/Source/JavaScriptCore/runtime/StrictEvalActivation.h b/Source/JavaScriptCore/runtime/StrictEvalActivation.h
index 1385eec..e2885cc 100644
--- a/Source/JavaScriptCore/runtime/StrictEvalActivation.h
+++ b/Source/JavaScriptCore/runtime/StrictEvalActivation.h
@@ -30,7 +30,7 @@
 
 namespace JSC {
 
-class StrictEvalActivation : public JSObject {
+class StrictEvalActivation : public JSNonFinalObject {
 public:
     StrictEvalActivation(ExecState*);
     virtual bool deleteProperty(ExecState*, const Identifier&);
diff --git a/Source/JavaScriptCore/runtime/StringConstructor.cpp b/Source/JavaScriptCore/runtime/StringConstructor.cpp
index 604473b..560202a 100644
--- a/Source/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/StringConstructor.cpp
@@ -25,7 +25,6 @@
 #include "JITCode.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
-#include "PrototypeFunction.h"
 #include "StringPrototype.h"
 
 namespace JSC {
@@ -49,7 +48,7 @@ static EncodedJSValue JSC_HOST_CALL stringFromCharCode(ExecState* exec)
 
 ASSERT_CLASS_FITS_IN_CELL(StringConstructor);
 
-StringConstructor::StringConstructor(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, Structure* prototypeFunctionStructure, StringPrototype* stringPrototype)
+StringConstructor::StringConstructor(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* functionStructure, StringPrototype* stringPrototype)
     : InternalFunction(&exec->globalData(), globalObject, structure, Identifier(exec, stringPrototype->classInfo()->className))
 {
     // ECMA 15.5.3.1 String.prototype
@@ -57,9 +56,9 @@ StringConstructor::StringConstructor(ExecState* exec, JSGlobalObject* globalObje
 
     // ECMA 15.5.3.2 fromCharCode()
 #if ENABLE(JIT) && ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().fromCharCode, exec->globalData().getHostFunction(stringFromCharCode, fromCharCodeThunkGenerator)), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().fromCharCode, exec->globalData().getHostFunction(stringFromCharCode, fromCharCodeThunkGenerator)), DontEnum);
 #else
-    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, globalObject, prototypeFunctionStructure, 1, exec->propertyNames().fromCharCode, stringFromCharCode), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) JSFunction(exec, globalObject, functionStructure, 1, exec->propertyNames().fromCharCode, stringFromCharCode), DontEnum);
 #endif
     // no. of arguments for constructor
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
@@ -68,9 +67,10 @@ StringConstructor::StringConstructor(ExecState* exec, JSGlobalObject* globalObje
 // ECMA 15.5.2
 static EncodedJSValue JSC_HOST_CALL constructWithStringConstructor(ExecState* exec)
 {
+    JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
     if (!exec->argumentCount())
-        return JSValue::encode(new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure()));
-    return JSValue::encode(new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure(), exec->argument(0).toString(exec)));
+        return JSValue::encode(new (exec) StringObject(exec, globalObject->stringObjectStructure()));
+    return JSValue::encode(new (exec) StringObject(exec, globalObject->stringObjectStructure(), exec->argument(0).toString(exec)));
 }
 
 ConstructType StringConstructor::getConstructData(ConstructData& constructData)
diff --git a/Source/JavaScriptCore/runtime/StringConstructor.h b/Source/JavaScriptCore/runtime/StringConstructor.h
index 20f3a52..117cce8 100644
--- a/Source/JavaScriptCore/runtime/StringConstructor.h
+++ b/Source/JavaScriptCore/runtime/StringConstructor.h
@@ -29,7 +29,7 @@ namespace JSC {
 
     class StringConstructor : public InternalFunction {
     public:
-        StringConstructor(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>, Structure* prototypeFunctionStructure, StringPrototype*);
+        StringConstructor(ExecState*, JSGlobalObject*, Structure*, Structure* functionStructure, StringPrototype*);
 
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
diff --git a/Source/JavaScriptCore/runtime/StringObject.cpp b/Source/JavaScriptCore/runtime/StringObject.cpp
index eb9cfa3..67dc291 100644
--- a/Source/JavaScriptCore/runtime/StringObject.cpp
+++ b/Source/JavaScriptCore/runtime/StringObject.cpp
@@ -27,23 +27,26 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(StringObject);
 
-const ClassInfo StringObject::info = { "String", 0, 0, 0 };
+const ClassInfo StringObject::s_info = { "String", &JSWrapperObject::s_info, 0, 0 };
 
-StringObject::StringObject(ExecState* exec, NonNullPassRefPtr<Structure> structure)
+StringObject::StringObject(ExecState* exec, Structure* structure)
     : JSWrapperObject(exec->globalData(), structure)
 {
+    ASSERT(inherits(&s_info));
     setInternalValue(exec->globalData(), jsEmptyString(exec));
 }
 
-StringObject::StringObject(JSGlobalData& globalData, NonNullPassRefPtr<Structure> structure, JSString* string)
+StringObject::StringObject(JSGlobalData& globalData, Structure* structure, JSString* string)
     : JSWrapperObject(globalData, structure)
 {
+    ASSERT(inherits(&s_info));
     setInternalValue(globalData, string);
 }
 
-StringObject::StringObject(ExecState* exec, NonNullPassRefPtr<Structure> structure, const UString& string)
+StringObject::StringObject(ExecState* exec, Structure* structure, const UString& string)
     : JSWrapperObject(exec->globalData(), structure)
 {
+    ASSERT(inherits(&s_info));
     setInternalValue(exec->globalData(), jsString(exec, string));
 }
 
diff --git a/Source/JavaScriptCore/runtime/StringObject.h b/Source/JavaScriptCore/runtime/StringObject.h
index 03488f5..4c16044 100644
--- a/Source/JavaScriptCore/runtime/StringObject.h
+++ b/Source/JavaScriptCore/runtime/StringObject.h
@@ -28,10 +28,10 @@ namespace JSC {
 
     class StringObject : public JSWrapperObject {
     public:
-        StringObject(ExecState*, NonNullPassRefPtr<Structure>);
-        StringObject(ExecState*, NonNullPassRefPtr<Structure>, const UString&);
+        StringObject(ExecState*, Structure*);
+        StringObject(ExecState*, Structure*, const UString&);
 
-        static StringObject* create(ExecState*, JSString*);
+        static StringObject* create(ExecState*, JSGlobalObject*, JSString*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
@@ -41,26 +41,25 @@ namespace JSC {
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-        static const JS_EXPORTDATA ClassInfo info;
+        static const JS_EXPORTDATA ClassInfo s_info;
 
         JSString* internalValue() const { return asString(JSWrapperObject::internalValue());}
 
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount);
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
-        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSWrapperObject::StructureFlags;
-        StringObject(JSGlobalData&, NonNullPassRefPtr<Structure>, JSString*);
-  };
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSWrapperObject::StructureFlags;
+        StringObject(JSGlobalData&, Structure*, JSString*);
+    };
 
     StringObject* asStringObject(JSValue);
 
     inline StringObject* asStringObject(JSValue value)
     {
-        ASSERT(asObject(value)->inherits(&StringObject::info));
+        ASSERT(asObject(value)->inherits(&StringObject::s_info));
         return static_cast<StringObject*>(asObject(value));
     }
 
diff --git a/Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index 43c3e38..3133944 100644
--- a/Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/Source/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -33,18 +33,18 @@ namespace JSC {
         static StringObjectThatMasqueradesAsUndefined* create(ExecState* exec, const UString& string)
         {
             return new (exec) StringObjectThatMasqueradesAsUndefined(exec,
-                createStructure(exec->lexicalGlobalObject()->stringPrototype()), string);
+                createStructure(exec->globalData(), exec->lexicalGlobalObject()->stringPrototype()), string);
         }
 
     private:
-        StringObjectThatMasqueradesAsUndefined(ExecState* exec, NonNullPassRefPtr<Structure> structure, const UString& string)
+        StringObjectThatMasqueradesAsUndefined(ExecState* exec, Structure* structure, const UString& string)
             : StringObject(exec, structure, string)
         {
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) 
+        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount); 
+            return Structure::create(globalData, proto, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
         static const unsigned StructureFlags = OverridesGetOwnPropertySlot | MasqueradesAsUndefined | OverridesGetPropertyNames | StringObject::StructureFlags;
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
index 545c93e..91112a5 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
@@ -85,7 +85,7 @@ static EncodedJSValue JSC_HOST_CALL stringProtoFuncTrimRight(ExecState*);
 
 namespace JSC {
 
-const ClassInfo StringPrototype::info = { "String", &StringObject::info, 0, ExecState::stringTable };
+const ClassInfo StringPrototype::s_info = { "String", &StringObject::s_info, 0, ExecState::stringTable };
 
 /* Source for StringPrototype.lut.h
 @begin stringTable 26
@@ -131,9 +131,11 @@ const ClassInfo StringPrototype::info = { "String", &StringObject::info, 0, Exec
 */
 
 // ECMA 15.5.4
-StringPrototype::StringPrototype(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure)
+StringPrototype::StringPrototype(ExecState* exec, JSGlobalObject* globalObject, Structure* structure)
     : StringObject(exec, structure)
 {
+    ASSERT(inherits(&s_info));
+
     putAnonymousValue(exec->globalData(), 0, globalObject);
     // The constructor will be added later, after StringConstructor has been built
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
@@ -305,7 +307,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
     if (callType == CallTypeNone)
         replacementString = replacement.toString(exec);
 
-    if (pattern.inherits(&RegExpObject::info)) {
+    if (pattern.inherits(&RegExpObject::s_info)) {
         const UString& source = sourceVal->value(exec);
         unsigned sourceLen = source.length();
         if (exec->hadException())
@@ -473,7 +475,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncToString(ExecState* exec)
     if (thisValue.isString())
         return JSValue::encode(thisValue);
 
-    if (thisValue.inherits(&StringObject::info))
+    if (thisValue.inherits(&StringObject::s_info))
         return JSValue::encode(asStringObject(thisValue)->internalValue());
 
     return throwVMTypeError(exec);
@@ -602,10 +604,8 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec)
 
     JSValue a0 = exec->argument(0);
 
-    UString u = s;
     RefPtr<RegExp> reg;
-    RegExpObject* imp = 0;
-    if (a0.inherits(&RegExpObject::info))
+    if (a0.inherits(&RegExpObject::s_info))
         reg = asRegExpObject(a0)->regExp();
     else {
         /*
@@ -613,12 +613,12 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec)
          *  If regexp is not an object whose [[Class]] property is "RegExp", it is
          *  replaced with the result of the expression new RegExp(regexp).
          */
-        reg = exec->globalData().regExpCache()->lookupOrCreate(a0.toString(exec), UString());
+        reg = exec->globalData().regExpCache()->lookupOrCreate(a0.toString(exec), NoFlags);
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
     int matchLength = 0;
-    regExpConstructor->performMatch(reg.get(), u, 0, pos, matchLength);
+    regExpConstructor->performMatch(reg.get(), s, 0, pos, matchLength);
     if (!(reg->global())) {
         // case without 'g' flag is handled like RegExp.prototype.exec
         if (pos < 0)
@@ -628,15 +628,13 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec)
 
     // return array of matches
     MarkedArgumentBuffer list;
-    int lastIndex = 0;
+    unsigned lastIndex = 0;
     while (pos >= 0) {
-        list.append(jsSubstring(exec, u, pos, matchLength));
+        list.append(jsSubstring(exec, s, pos, matchLength));
         lastIndex = pos;
         pos += matchLength == 0 ? 1 : matchLength;
-        regExpConstructor->performMatch(reg.get(), u, pos, pos, matchLength);
+        regExpConstructor->performMatch(reg.get(), s, pos, pos, matchLength);
     }
-    if (imp)
-        imp->setLastIndex(lastIndex);
     if (list.isEmpty()) {
         // if there are no matches at all, it's important to return
         // Null instead of an empty array, because this matches
@@ -656,9 +654,8 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec)
 
     JSValue a0 = exec->argument(0);
 
-    UString u = s;
     RefPtr<RegExp> reg;
-    if (a0.inherits(&RegExpObject::info))
+    if (a0.inherits(&RegExpObject::s_info))
         reg = asRegExpObject(a0)->regExp();
     else { 
         /*
@@ -666,12 +663,12 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec)
          *  If regexp is not an object whose [[Class]] property is "RegExp", it is
          *  replaced with the result of the expression new RegExp(regexp).
          */
-        reg = exec->globalData().regExpCache()->lookupOrCreate(a0.toString(exec), UString());
+        reg = exec->globalData().regExpCache()->lookupOrCreate(a0.toString(exec), NoFlags);
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
     int matchLength = 0;
-    regExpConstructor->performMatch(reg.get(), u, 0, pos, matchLength);
+    regExpConstructor->performMatch(reg.get(), s, 0, pos, matchLength);
     return JSValue::encode(jsNumber(pos));
 }
 
@@ -716,7 +713,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
     unsigned i = 0;
     unsigned p0 = 0;
     unsigned limit = a1.isUndefined() ? 0xFFFFFFFFU : a1.toUInt32(exec);
-    if (a0.inherits(&RegExpObject::info)) {
+    if (a0.inherits(&RegExpObject::s_info)) {
         RegExp* reg = asRegExpObject(a0)->regExp();
         if (s.isEmpty() && reg->match(s, 0) >= 0) {
             // empty string matched by regexp -> empty array
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.h b/Source/JavaScriptCore/runtime/StringPrototype.h
index 4b0f88f..6c4b475 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.h
+++ b/Source/JavaScriptCore/runtime/StringPrototype.h
@@ -29,13 +29,23 @@ namespace JSC {
 
     class StringPrototype : public StringObject {
     public:
-        StringPrototype(ExecState*, JSGlobalObject*, NonNullPassRefPtr<Structure>);
+        StringPrototype(ExecState*, JSGlobalObject*, Structure*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
 
-        virtual const ClassInfo* classInfo() const { return &info; }
-        static const ClassInfo info;
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
+        {
+            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        }
+
+        static const ClassInfo s_info;
+        
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | StringObject::StructureFlags;
+
+        COMPILE_ASSERT(!StringObject::AnonymousSlotCount, StringPrototype_stomps_on_your_anonymous_slot);
+        static const unsigned AnonymousSlotCount = 1;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index e8f5d7a..dcc8e7c 100644
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -50,132 +50,82 @@
 using namespace std;
 using namespace WTF;
 
-namespace JSC {
-
-// Choose a number for the following so that most property maps are smaller,
-// but it's not going to blow out the stack to allocate this number of pointers.
-static const int smallMapThreshold = 1024;
-
-// The point at which the function call overhead of the qsort implementation
-// becomes small compared to the inefficiency of insertion sort.
-static const unsigned tinyMapThreshold = 20;
-
-static const unsigned newTableSize = 16;
+#if DUMP_PROPERTYMAP_STATS
 
-#ifndef NDEBUG
-static WTF::RefCountedLeakCounter structureCounter("Structure");
+int numProbes;
+int numCollisions;
+int numRehashes;
+int numRemoves;
 
-#if ENABLE(JSC_MULTIPLE_THREADS)
-static Mutex& ignoreSetMutex = *(new Mutex);
 #endif
 
-static bool shouldIgnoreLeaks;
-static HashSet<Structure*>& ignoreSet = *(new HashSet<Structure*>);
-#endif
+namespace JSC {
 
 #if DUMP_STRUCTURE_ID_STATISTICS
 static HashSet<Structure*>& liveStructureSet = *(new HashSet<Structure*>);
 #endif
 
-static int comparePropertyMapEntryIndices(const void* a, const void* b);
-
-inline void Structure::setTransitionTable(TransitionTable* table)
-{
-    ASSERT(m_isUsingSingleSlot);
-#ifndef NDEBUG
-    setSingleTransition(0);
-#endif
-    m_isUsingSingleSlot = false;
-    m_transitions.m_table = table;
-    // This implicitly clears the flag that indicates we're using a single transition
-    ASSERT(!m_isUsingSingleSlot);
-}
-
-// The contains and get methods accept imprecise matches, so if an unspecialised transition exists
-// for the given key they will consider that transition to be a match.  If a specialised transition
-// exists and it matches the provided specificValue, get will return the specific transition.
-inline bool Structure::transitionTableContains(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
-{
-    if (m_isUsingSingleSlot) {
-        Structure* existingTransition = singleTransition();
-        return existingTransition && existingTransition->m_nameInPrevious.get() == key.first
-               && existingTransition->m_attributesInPrevious == key.second
-               && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0);
-    }
-    TransitionTable::iterator find = transitionTable()->find(key);
-    if (find == transitionTable()->end())
-        return false;
-
-    return find->second.first || find->second.second->transitionedFor(specificValue);
-}
-
-inline Structure* Structure::transitionTableGet(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const
+bool StructureTransitionTable::contains(StringImpl* rep, unsigned attributes) const
 {
-    if (m_isUsingSingleSlot) {
-        Structure* existingTransition = singleTransition();
-        if (existingTransition && existingTransition->m_nameInPrevious.get() == key.first
-            && existingTransition->m_attributesInPrevious == key.second
-            && (existingTransition->m_specificValueInPrevious == specificValue || existingTransition->m_specificValueInPrevious == 0))
-            return existingTransition;
-        return 0;
+    if (isUsingSingleSlot()) {
+        Structure* transition = singleTransition();
+        return transition && transition->m_nameInPrevious == rep && transition->m_attributesInPrevious == attributes;
     }
-
-    Transition transition = transitionTable()->get(key);
-    if (transition.second && transition.second->transitionedFor(specificValue))
-        return transition.second;
-    return transition.first;
+    return map()->contains(make_pair(rep, attributes));
 }
 
-inline bool Structure::transitionTableHasTransition(const StructureTransitionTableHash::Key& key) const
+inline Structure* StructureTransitionTable::get(StringImpl* rep, unsigned attributes) const
 {
-    if (m_isUsingSingleSlot) {
+    if (isUsingSingleSlot()) {
         Structure* transition = singleTransition();
-        return transition && transition->m_nameInPrevious == key.first
-        && transition->m_attributesInPrevious == key.second;
+        return (transition && transition->m_nameInPrevious == rep && transition->m_attributesInPrevious == attributes) ? transition : 0;
     }
-    return transitionTable()->contains(key);
+    return map()->get(make_pair(rep, attributes));
 }
 
-inline void Structure::transitionTableRemove(const StructureTransitionTableHash::Key& key, JSCell* specificValue)
+inline void StructureTransitionTable::remove(Structure* structure)
 {
-    if (m_isUsingSingleSlot) {
-        ASSERT(transitionTableContains(key, specificValue));
-        setSingleTransition(0);
-        return;
+    if (isUsingSingleSlot()) {
+        // If more than one transition had been added, then we wouldn't be in
+        // single slot mode (even despecifying a from a specific value triggers
+        // map mode).
+        // As such, the passed structure *must* be the existing transition.
+        ASSERT(singleTransition() == structure);
+        clearSingleTransition();
+    } else {
+        // Check whether a mapping exists for structure's key, and whether the
+        // entry is structure (the latter check may fail if we initially had a
+        // transition with a specific value, and this has been despecified).
+        TransitionMap::iterator entry = map()->find(make_pair(structure->m_nameInPrevious, structure->m_attributesInPrevious));
+        if (entry != map()->end() && structure == entry.get().second)
+            map()->remove(entry);
     }
-    TransitionTable::iterator find = transitionTable()->find(key);
-    if (!specificValue)
-        find->second.first = 0;
-    else
-        find->second.second = 0;
-    if (!find->second.first && !find->second.second)
-        transitionTable()->remove(find);
 }
 
-inline void Structure::transitionTableAdd(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue)
+inline void StructureTransitionTable::add(JSGlobalData& globalData, Structure* structure)
 {
-    if (m_isUsingSingleSlot) {
-        if (!singleTransition()) {
-            setSingleTransition(structure);
+    if (isUsingSingleSlot()) {
+        Structure* existingTransition = singleTransition();
+
+        // This handles the first transition being added.
+        if (!existingTransition) {
+            setSingleTransition(globalData, structure);
             return;
         }
-        Structure* existingTransition = singleTransition();
-        TransitionTable* transitionTable = new TransitionTable;
-        setTransitionTable(transitionTable);
-        if (existingTransition)
-            transitionTableAdd(std::make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition, existingTransition->m_specificValueInPrevious);
+
+        // This handles the second transition being added
+        // (or the first transition being despecified!)
+        setMap(new TransitionMap());
+        add(globalData, existingTransition);
     }
-    if (!specificValue) {
-        TransitionTable::iterator find = transitionTable()->find(key);
-        if (find == transitionTable()->end())
-            transitionTable()->add(key, Transition(structure, static_cast<Structure*>(0)));
-        else
-            find->second.first = structure;
-    } else {
-        // If we're adding a transition to a specific value, then there cannot be
-        // an existing transition
-        ASSERT(!transitionTable()->contains(key));
-        transitionTable()->add(key, Transition(static_cast<Structure*>(0), structure));
+
+    // Add the structure to the map.
+    std::pair<TransitionMap::iterator, bool> result = map()->add(globalData, make_pair(structure->m_nameInPrevious, structure->m_attributesInPrevious), structure);
+    if (!result.second) {
+        // There already is an entry! - we should only hit this when despecifying.
+        ASSERT(result.first.get().second->m_specificValueInPrevious);
+        ASSERT(!structure->m_specificValueInPrevious);
+        map()->set(result.first, structure);
     }
 }
 
@@ -191,21 +141,22 @@ void Structure::dumpStatistics()
     HashSet<Structure*>::const_iterator end = liveStructureSet.end();
     for (HashSet<Structure*>::const_iterator it = liveStructureSet.begin(); it != end; ++it) {
         Structure* structure = *it;
-        if (structure->m_usingSingleTransitionSlot) {
-            if (!structure->m_transitions.singleTransition)
+
+        switch (structure->m_transitionTable.size()) {
+            case 0:
                 ++numberLeaf;
-            else
-                ++numberUsingSingleSlot;
+               if (!structure->m_previous)
+                    ++numberSingletons;
+                break;
 
-           if (!structure->m_previous && !structure->m_transitions.singleTransition)
-                ++numberSingletons;
+            case 1:
+                ++numberUsingSingleSlot;
+                break;
         }
 
         if (structure->m_propertyTable) {
             ++numberWithPropertyMaps;
-            totalPropertyMapsSize += PropertyMapHashTable::allocationSize(structure->m_propertyTable->size);
-            if (structure->m_propertyTable->deletedOffsets)
-                totalPropertyMapsSize += (structure->m_propertyTable->deletedOffsets->capacity() * sizeof(unsigned)); 
+            totalPropertyMapsSize += structure->m_propertyTable->sizeInMemory();
         }
     }
 
@@ -223,12 +174,12 @@ void Structure::dumpStatistics()
 #endif
 }
 
-Structure::Structure(JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount)
-    : m_typeInfo(typeInfo)
-    , m_prototype(prototype)
-    , m_specificValueInPrevious(0)
-    , m_propertyTable(0)
-    , m_propertyStorageCapacity(JSObject::inlineStorageCapacity)
+Structure::Structure(JSGlobalData& globalData, JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount, const ClassInfo* classInfo)
+    : JSCell(globalData, globalData.structureStructure.get())
+    , m_typeInfo(typeInfo)
+    , m_prototype(globalData, this, prototype)
+    , m_classInfo(classInfo)
+    , m_propertyStorageCapacity(typeInfo.isFinal() ? JSFinalObject_inlineStorageCapacity : JSNonFinalObject_inlineStorageCapacity)
     , m_offset(noOffset)
     , m_dictionaryKind(NoneDictionaryKind)
     , m_isPinnedPropertyTable(false)
@@ -237,119 +188,60 @@ Structure::Structure(JSValue prototype, const TypeInfo& typeInfo, unsigned anony
     , m_attributesInPrevious(0)
     , m_specificFunctionThrashCount(0)
     , m_anonymousSlotCount(anonymousSlotCount)
-    , m_isUsingSingleSlot(true)
+    , m_preventExtensions(false)
 {
-    m_transitions.m_singleTransition = 0;
-
     ASSERT(m_prototype);
-    ASSERT(m_prototype->isObject() || m_prototype->isNull());
-
-#ifndef NDEBUG
-#if ENABLE(JSC_MULTIPLE_THREADS)
-    MutexLocker protect(ignoreSetMutex);
-#endif
-    if (shouldIgnoreLeaks)
-        ignoreSet.add(this);
-    else
-        structureCounter.increment();
-#endif
-
-#if DUMP_STRUCTURE_ID_STATISTICS
-    liveStructureSet.add(this);
-#endif
-}
-
-Structure::~Structure()
-{
-    if (m_previous) {
-        ASSERT(m_nameInPrevious);
-        m_previous->transitionTableRemove(make_pair(m_nameInPrevious.get(), m_attributesInPrevious), m_specificValueInPrevious);
-
-    }
-    ASSERT(!m_enumerationCache.hasDeadObject());
-
-    if (m_propertyTable) {
-        unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
-        for (unsigned i = 1; i <= entryCount; i++) {
-            if (StringImpl* key = m_propertyTable->entries()[i].key)
-                key->deref();
-        }
-
-        delete m_propertyTable->deletedOffsets;
-        fastFree(m_propertyTable);
-    }
-
-    if (!m_isUsingSingleSlot)
-        delete transitionTable();
-
-#ifndef NDEBUG
-#if ENABLE(JSC_MULTIPLE_THREADS)
-    MutexLocker protect(ignoreSetMutex);
-#endif
-    HashSet<Structure*>::iterator it = ignoreSet.find(this);
-    if (it != ignoreSet.end())
-        ignoreSet.remove(it);
-    else
-        structureCounter.decrement();
-#endif
-
-#if DUMP_STRUCTURE_ID_STATISTICS
-    liveStructureSet.remove(this);
-#endif
-}
-
-void Structure::startIgnoringLeaks()
-{
-#ifndef NDEBUG
-    shouldIgnoreLeaks = true;
-#endif
+    ASSERT(m_prototype.isObject() || m_prototype.isNull());
 }
 
-void Structure::stopIgnoringLeaks()
-{
-#ifndef NDEBUG
-    shouldIgnoreLeaks = false;
-#endif
-}
+const ClassInfo Structure::s_info = { "Structure", 0, 0, 0 };
 
-static bool isPowerOf2(unsigned v)
+Structure::Structure(JSGlobalData& globalData)
+    : JSCell(globalData, this)
+    , m_typeInfo(CompoundType, OverridesMarkChildren)
+    , m_prototype(globalData, this, jsNull())
+    , m_classInfo(&s_info)
+    , m_propertyStorageCapacity(0)
+    , m_offset(noOffset)
+    , m_dictionaryKind(NoneDictionaryKind)
+    , m_isPinnedPropertyTable(false)
+    , m_hasGetterSetterProperties(false)
+    , m_hasNonEnumerableProperties(false)
+    , m_attributesInPrevious(0)
+    , m_specificFunctionThrashCount(0)
+    , m_anonymousSlotCount(0)
+    , m_preventExtensions(false)
 {
-    // Taken from http://www.cs.utk.edu/~vose/c-stuff/bithacks.html
-    
-    return !(v & (v - 1)) && v;
+    ASSERT(m_prototype);
+    ASSERT(m_prototype.isNull());
+    ASSERT(!globalData.structureStructure);
 }
 
-static unsigned nextPowerOf2(unsigned v)
+Structure::Structure(JSGlobalData& globalData, const Structure* previous)
+    : JSCell(globalData, globalData.structureStructure.get())
+    , m_typeInfo(previous->typeInfo())
+    , m_prototype(globalData, this, previous->storedPrototype())
+    , m_classInfo(previous->m_classInfo)
+    , m_propertyStorageCapacity(previous->m_propertyStorageCapacity)
+    , m_offset(noOffset)
+    , m_dictionaryKind(NoneDictionaryKind)
+    , m_isPinnedPropertyTable(false)
+    , m_hasGetterSetterProperties(previous->m_hasGetterSetterProperties)
+    , m_hasNonEnumerableProperties(previous->m_hasNonEnumerableProperties)
+    , m_attributesInPrevious(0)
+    , m_specificFunctionThrashCount(previous->m_specificFunctionThrashCount)
+    , m_anonymousSlotCount(previous->anonymousSlotCount())
+    , m_preventExtensions(previous->m_preventExtensions)
 {
-    // Taken from http://www.cs.utk.edu/~vose/c-stuff/bithacks.html
-    // Devised by Sean Anderson, Sepember 14, 2001
-
-    v--;
-    v |= v >> 1;
-    v |= v >> 2;
-    v |= v >> 4;
-    v |= v >> 8;
-    v |= v >> 16;
-    v++;
-
-    return v;
+    ASSERT(m_prototype);
+    ASSERT(m_prototype.isObject() || m_prototype.isNull());
 }
 
-static unsigned sizeForKeyCount(size_t keyCount)
+Structure::~Structure()
 {
-    if (keyCount == notFound)
-        return newTableSize;
-
-    if (keyCount < 8)
-        return newTableSize;
-
-    if (isPowerOf2(keyCount))
-        return keyCount * 4;
-
-    return nextPowerOf2(keyCount) * 2;
 }
 
-void Structure::materializePropertyMap()
+void Structure::materializePropertyMap(JSGlobalData& globalData)
 {
     ASSERT(!m_propertyTable);
 
@@ -358,13 +250,13 @@ void Structure::materializePropertyMap()
 
     Structure* structure = this;
 
-    // Search for the last Structure with a property table. 
+    // Search for the last Structure with a property table.
     while ((structure = structure->previousID())) {
         if (structure->m_isPinnedPropertyTable) {
             ASSERT(structure->m_propertyTable);
             ASSERT(!structure->m_previous);
 
-            m_propertyTable = structure->copyPropertyTable();
+            m_propertyTable = structure->m_propertyTable->copy(globalData, 0, m_offset + 1);
             break;
         }
 
@@ -372,80 +264,46 @@ void Structure::materializePropertyMap()
     }
 
     if (!m_propertyTable)
-        createPropertyMapHashTable(sizeForKeyCount(m_offset + 1));
-    else {
-        if (sizeForKeyCount(m_offset + 1) > m_propertyTable->size)
-            rehashPropertyMapHashTable(sizeForKeyCount(m_offset + 1)); // This could be made more efficient by combining with the copy above. 
-    }
+        createPropertyMap(m_offset + 1);
 
     for (ptrdiff_t i = structures.size() - 2; i >= 0; --i) {
         structure = structures[i];
-        structure->m_nameInPrevious->ref();
-        PropertyMapEntry entry(structure->m_nameInPrevious.get(), m_anonymousSlotCount + structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious, ++m_propertyTable->lastIndexUsed);
-        insertIntoPropertyMapHashTable(entry);
+        PropertyMapEntry entry(globalData, this, structure->m_nameInPrevious.get(), m_anonymousSlotCount + structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious.get());
+        m_propertyTable->add(entry);
     }
 }
 
 void Structure::growPropertyStorageCapacity()
 {
-    if (m_propertyStorageCapacity == JSObject::inlineStorageCapacity)
-        m_propertyStorageCapacity = JSObject::nonInlineBaseStorageCapacity;
+    if (isUsingInlineStorage())
+        m_propertyStorageCapacity = JSObject::baseExternalStorageCapacity;
     else
         m_propertyStorageCapacity *= 2;
 }
 
-void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
+void Structure::despecifyDictionaryFunction(JSGlobalData& globalData, const Identifier& propertyName)
 {
-    const StringImpl* rep = propertyName.impl();
+    StringImpl* rep = propertyName.impl();
 
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
 
     ASSERT(isDictionary());
     ASSERT(m_propertyTable);
 
-    unsigned i = rep->existingHash();
-
-#if DUMP_PROPERTYMAP_STATS
-    ++numProbes;
-#endif
-
-    unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-    ASSERT(entryIndex != emptyEntryIndex);
-
-    if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
-        m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
-        return;
-    }
-
-#if DUMP_PROPERTYMAP_STATS
-    ++numCollisions;
-#endif
-
-    unsigned k = 1 | doubleHash(rep->existingHash());
-
-    while (1) {
-        i += k;
-
-#if DUMP_PROPERTYMAP_STATS
-        ++numRehashes;
-#endif
-
-        entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-        ASSERT(entryIndex != emptyEntryIndex);
-
-        if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
-            m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
-            return;
-        }
-    }
+    PropertyMapEntry* entry = m_propertyTable->find(rep).first;
+    ASSERT(entry);
+    entry->specificValue.clear();
 }
 
-PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
+Structure* Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
     ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
 
-    if (Structure* existingTransition = structure->transitionTableGet(make_pair(propertyName.impl(), attributes), specificValue)) {
+    if (Structure* existingTransition = structure->m_transitionTable.get(propertyName.impl(), attributes)) {
+        JSCell* specificValueInPrevious = existingTransition->m_specificValueInPrevious.get();
+        if (specificValueInPrevious && specificValueInPrevious != specificValue)
+            return 0;
         ASSERT(existingTransition->m_offset != noOffset);
         offset = existingTransition->m_offset + existingTransition->m_anonymousSlotCount;
         ASSERT(offset >= structure->m_anonymousSlotCount);
@@ -456,8 +314,18 @@ PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Struct
     return 0;
 }
 
-PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
+Structure* Structure::addPropertyTransition(JSGlobalData& globalData, Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
+    // If we have a specific function, we may have got to this point if there is
+    // already a transition with the correct property name and attributes, but
+    // specialized to a different function.  In this case we just want to give up
+    // and despecialize the transition.
+    // In this case we clear the value of specificFunction which will result
+    // in us adding a non-specific transition, and any subsequent lookup in
+    // Structure::addPropertyTransitionToExistingStructure will just use that.
+    if (specificValue && structure->m_transitionTable.contains(propertyName.impl(), attributes))
+        specificValue = 0;
+
     ASSERT(!structure->isDictionary());
     ASSERT(structure->typeInfo().type() == ObjectType);
     ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
@@ -466,43 +334,37 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
         specificValue = 0;
 
     if (structure->transitionCount() > s_maxTransitionLength) {
-        RefPtr<Structure> transition = toCacheableDictionaryTransition(structure);
+        Structure* transition = toCacheableDictionaryTransition(globalData, structure);
         ASSERT(structure != transition);
-        offset = transition->put(propertyName, attributes, specificValue);
+        offset = transition->putSpecificValue(globalData, propertyName, attributes, specificValue);
         ASSERT(offset >= structure->m_anonymousSlotCount);
         ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
         if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
             transition->growPropertyStorageCapacity();
-        return transition.release();
+        return transition;
     }
 
-    RefPtr<Structure> transition = create(structure->m_prototype.get(), structure->typeInfo(), structure->anonymousSlotCount());
+    Structure* transition = create(globalData, structure);
 
-    transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
-    transition->m_previous = structure;
+    transition->m_cachedPrototypeChain.set(globalData, transition, structure->m_cachedPrototypeChain.get());
+    transition->m_previous.set(globalData, transition, structure);
     transition->m_nameInPrevious = propertyName.impl();
     transition->m_attributesInPrevious = attributes;
-    transition->m_specificValueInPrevious = specificValue;
-    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
-    transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
-    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
-    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
+    transition->m_specificValueInPrevious.set(globalData, transition, specificValue);
 
     if (structure->m_propertyTable) {
         if (structure->m_isPinnedPropertyTable)
-            transition->m_propertyTable = structure->copyPropertyTable();
-        else {
-            transition->m_propertyTable = structure->m_propertyTable;
-            structure->m_propertyTable = 0;
-        }
+            transition->m_propertyTable = structure->m_propertyTable->copy(globalData, 0, structure->m_propertyTable->size() + 1);
+        else
+            transition->m_propertyTable = structure->m_propertyTable.release();
     } else {
         if (structure->m_previous)
-            transition->materializePropertyMap();
+            transition->materializePropertyMap(globalData);
         else
-            transition->createPropertyMapHashTable();
+            transition->createPropertyMap();
     }
 
-    offset = transition->put(propertyName, attributes, specificValue);
+    offset = transition->putSpecificValue(globalData, propertyName, attributes, specificValue);
     ASSERT(offset >= structure->m_anonymousSlotCount);
     ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
     if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
@@ -510,183 +372,235 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
 
     transition->m_offset = offset - structure->m_anonymousSlotCount;
     ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
-    structure->transitionTableAdd(make_pair(propertyName.impl(), attributes), transition.get(), specificValue);
-    return transition.release();
+    structure->m_transitionTable.add(globalData, transition);
+    return transition;
 }
 
-PassRefPtr<Structure> Structure::removePropertyTransition(Structure* structure, const Identifier& propertyName, size_t& offset)
+Structure* Structure::removePropertyTransition(JSGlobalData& globalData, Structure* structure, const Identifier& propertyName, size_t& offset)
 {
     ASSERT(!structure->isUncacheableDictionary());
 
-    RefPtr<Structure> transition = toUncacheableDictionaryTransition(structure);
+    Structure* transition = toUncacheableDictionaryTransition(globalData, structure);
 
     offset = transition->remove(propertyName);
     ASSERT(offset >= structure->m_anonymousSlotCount);
     ASSERT(structure->m_anonymousSlotCount == transition->m_anonymousSlotCount);
 
-    return transition.release();
+    return transition;
 }
 
-PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValue prototype)
+Structure* Structure::changePrototypeTransition(JSGlobalData& globalData, Structure* structure, JSValue prototype)
 {
-    RefPtr<Structure> transition = create(prototype, structure->typeInfo(), structure->anonymousSlotCount());
+    Structure* transition = create(globalData, structure);
 
-    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
-    transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
-    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
-    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
+    transition->m_prototype.set(globalData, transition, prototype);
 
     // Don't set m_offset, as one can not transition to this.
 
-    structure->materializePropertyMapIfNecessary();
-    transition->m_propertyTable = structure->copyPropertyTable();
+    structure->materializePropertyMapIfNecessary(globalData);
+    transition->m_propertyTable = structure->copyPropertyTable(globalData, transition);
     transition->m_isPinnedPropertyTable = true;
     
     ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
-    return transition.release();
+    return transition;
 }
 
-PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structure, const Identifier& replaceFunction)
+Structure* Structure::despecifyFunctionTransition(JSGlobalData& globalData, Structure* structure, const Identifier& replaceFunction)
 {
     ASSERT(structure->m_specificFunctionThrashCount < maxSpecificFunctionThrashCount);
-    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo(), structure->anonymousSlotCount());
+    Structure* transition = create(globalData, structure);
 
-    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
-    transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
-    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
-    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount + 1;
+    ++transition->m_specificFunctionThrashCount;
 
     // Don't set m_offset, as one can not transition to this.
 
-    structure->materializePropertyMapIfNecessary();
-    transition->m_propertyTable = structure->copyPropertyTable();
+    structure->materializePropertyMapIfNecessary(globalData);
+    transition->m_propertyTable = structure->copyPropertyTable(globalData, transition);
     transition->m_isPinnedPropertyTable = true;
 
     if (transition->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
-        transition->despecifyAllFunctions();
+        transition->despecifyAllFunctions(globalData);
     else {
-        bool removed = transition->despecifyFunction(replaceFunction);
+        bool removed = transition->despecifyFunction(globalData, replaceFunction);
         ASSERT_UNUSED(removed, removed);
     }
     
     ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
-    return transition.release();
+    return transition;
 }
 
-PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
+Structure* Structure::getterSetterTransition(JSGlobalData& globalData, Structure* structure)
 {
-    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo(), structure->anonymousSlotCount());
-    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
-    transition->m_hasGetterSetterProperties = transition->m_hasGetterSetterProperties;
-    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
-    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
+    Structure* transition = create(globalData, structure);
 
     // Don't set m_offset, as one can not transition to this.
 
-    structure->materializePropertyMapIfNecessary();
-    transition->m_propertyTable = structure->copyPropertyTable();
+    structure->materializePropertyMapIfNecessary(globalData);
+    transition->m_propertyTable = structure->copyPropertyTable(globalData, transition);
     transition->m_isPinnedPropertyTable = true;
     
     ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
-    return transition.release();
+    return transition;
 }
 
-PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure, DictionaryKind kind)
+Structure* Structure::toDictionaryTransition(JSGlobalData& globalData, Structure* structure, DictionaryKind kind)
 {
     ASSERT(!structure->isUncacheableDictionary());
     
-    RefPtr<Structure> transition = create(structure->m_prototype.get(), structure->typeInfo(), structure->anonymousSlotCount());
+    Structure* transition = create(globalData, structure);
+
+    structure->materializePropertyMapIfNecessary(globalData);
+    transition->m_propertyTable = structure->copyPropertyTable(globalData, transition);
+    transition->m_isPinnedPropertyTable = true;
     transition->m_dictionaryKind = kind;
-    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
-    transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
-    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
-    transition->m_specificFunctionThrashCount = structure->m_specificFunctionThrashCount;
     
-    structure->materializePropertyMapIfNecessary();
-    transition->m_propertyTable = structure->copyPropertyTable();
+    ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
+    return transition;
+}
+
+Structure* Structure::toCacheableDictionaryTransition(JSGlobalData& globalData, Structure* structure)
+{
+    return toDictionaryTransition(globalData, structure, CachedDictionaryKind);
+}
+
+Structure* Structure::toUncacheableDictionaryTransition(JSGlobalData& globalData, Structure* structure)
+{
+    return toDictionaryTransition(globalData, structure, UncachedDictionaryKind);
+}
+
+// In future we may want to cache this transition.
+Structure* Structure::sealTransition(JSGlobalData& globalData, Structure* structure)
+{
+    Structure* transition = preventExtensionsTransition(globalData, structure);
+
+    if (transition->m_propertyTable) {
+        PropertyTable::iterator end = transition->m_propertyTable->end();
+        for (PropertyTable::iterator iter = transition->m_propertyTable->begin(); iter != end; ++iter)
+            iter->attributes |= DontDelete;
+    }
+
+    return transition;
+}
+
+// In future we may want to cache this transition.
+Structure* Structure::freezeTransition(JSGlobalData& globalData, Structure* structure)
+{
+    Structure* transition = preventExtensionsTransition(globalData, structure);
+
+    if (transition->m_propertyTable) {
+        PropertyTable::iterator end = transition->m_propertyTable->end();
+        for (PropertyTable::iterator iter = transition->m_propertyTable->begin(); iter != end; ++iter)
+            iter->attributes |= (DontDelete | ReadOnly);
+    }
+
+    return transition;
+}
+
+// In future we may want to cache this transition.
+Structure* Structure::preventExtensionsTransition(JSGlobalData& globalData, Structure* structure)
+{
+    Structure* transition = create(globalData, structure);
+
+    // Don't set m_offset, as one can not transition to this.
+
+    structure->materializePropertyMapIfNecessary(globalData);
+    transition->m_propertyTable = structure->copyPropertyTable(globalData, transition);
     transition->m_isPinnedPropertyTable = true;
-    
+    transition->m_preventExtensions = true;
+
     ASSERT(structure->anonymousSlotCount() == transition->anonymousSlotCount());
-    return transition.release();
+    return transition;
 }
 
-PassRefPtr<Structure> Structure::toCacheableDictionaryTransition(Structure* structure)
+// In future we may want to cache this property.
+bool Structure::isSealed(JSGlobalData& globalData)
 {
-    return toDictionaryTransition(structure, CachedDictionaryKind);
+    if (isExtensible())
+        return false;
+
+    materializePropertyMapIfNecessary(globalData);
+    if (!m_propertyTable)
+        return true;
+
+    PropertyTable::iterator end = m_propertyTable->end();
+    for (PropertyTable::iterator iter = m_propertyTable->begin(); iter != end; ++iter) {
+        if ((iter->attributes & DontDelete) != DontDelete)
+            return false;
+    }
+    return true;
 }
 
-PassRefPtr<Structure> Structure::toUncacheableDictionaryTransition(Structure* structure)
+// In future we may want to cache this property.
+bool Structure::isFrozen(JSGlobalData& globalData)
 {
-    return toDictionaryTransition(structure, UncachedDictionaryKind);
+    if (isExtensible())
+        return false;
+
+    materializePropertyMapIfNecessary(globalData);
+    if (!m_propertyTable)
+        return true;
+
+    PropertyTable::iterator end = m_propertyTable->end();
+    for (PropertyTable::iterator iter = m_propertyTable->begin(); iter != end; ++iter) {
+        if ((iter->attributes & (DontDelete | ReadOnly)) != (DontDelete | ReadOnly))
+            return false;
+    }
+    return true;
 }
 
-PassRefPtr<Structure> Structure::flattenDictionaryStructure(JSGlobalData& globalData, JSObject* object)
+Structure* Structure::flattenDictionaryStructure(JSGlobalData& globalData, JSObject* object)
 {
     ASSERT(isDictionary());
     if (isUncacheableDictionary()) {
         ASSERT(m_propertyTable);
-        Vector<PropertyMapEntry*> sortedPropertyEntries(m_propertyTable->keyCount);
-        PropertyMapEntry** p = sortedPropertyEntries.data();
-        unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
-        for (unsigned i = 1; i <= entryCount; i++) {
-            if (m_propertyTable->entries()[i].key)
-                *p++ = &m_propertyTable->entries()[i];
-        }
-        size_t propertyCount = p - sortedPropertyEntries.data();
-        qsort(sortedPropertyEntries.data(), propertyCount, sizeof(PropertyMapEntry*), comparePropertyMapEntryIndices);
-        sortedPropertyEntries.resize(propertyCount);
 
-        // We now have the properties currently defined on this object
-        // in the order that they are expected to be in, but we need to
-        // reorder the storage, so we have to copy the current values out
-        Vector<JSValue> values(propertyCount);
         unsigned anonymousSlotCount = m_anonymousSlotCount;
-        for (unsigned i = 0; i < propertyCount; i++) {
-            PropertyMapEntry* entry = sortedPropertyEntries[i];
-            values[i] = object->getDirectOffset(entry->offset);
+        size_t propertyCount = m_propertyTable->size();
+        Vector<JSValue> values(propertyCount);
+
+        unsigned i = 0;
+        PropertyTable::iterator end = m_propertyTable->end();
+        for (PropertyTable::iterator iter = m_propertyTable->begin(); iter != end; ++iter, ++i) {
+            values[i] = object->getDirectOffset(iter->offset);
             // Update property table to have the new property offsets
-            entry->offset = anonymousSlotCount + i;
-            entry->index = i;
+            iter->offset = anonymousSlotCount + i;
         }
         
         // Copy the original property values into their final locations
         for (unsigned i = 0; i < propertyCount; i++)
             object->putDirectOffset(globalData, anonymousSlotCount + i, values[i]);
 
-        if (m_propertyTable->deletedOffsets) {
-            delete m_propertyTable->deletedOffsets;
-            m_propertyTable->deletedOffsets = 0;
-        }
+        m_propertyTable->clearDeletedOffsets();
     }
 
     m_dictionaryKind = NoneDictionaryKind;
     return this;
 }
 
-size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
+size_t Structure::addPropertyWithoutTransition(JSGlobalData& globalData, const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!m_enumerationCache);
 
     if (m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
         specificValue = 0;
 
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
 
     m_isPinnedPropertyTable = true;
 
-    size_t offset = put(propertyName, attributes, specificValue);
+    size_t offset = putSpecificValue(globalData, propertyName, attributes, specificValue);
     ASSERT(offset >= m_anonymousSlotCount);
     if (propertyStorageSize() > propertyStorageCapacity())
         growPropertyStorageCapacity();
     return offset;
 }
 
-size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName)
+size_t Structure::removePropertyWithoutTransition(JSGlobalData& globalData, const Identifier& propertyName)
 {
     ASSERT(isUncacheableDictionary());
     ASSERT(!m_enumerationCache);
 
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
 
     m_isPinnedPropertyTable = true;
     size_t offset = remove(propertyName);
@@ -696,11 +610,6 @@ size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName
 
 #if DUMP_PROPERTYMAP_STATS
 
-static int numProbes;
-static int numCollisions;
-static int numRehashes;
-static int numRemoves;
-
 struct PropertyMapStatisticsExitLogger {
     ~PropertyMapStatisticsExitLogger();
 };
@@ -718,8 +627,6 @@ PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger()
 
 #endif
 
-static const unsigned deletedSentinelIndex = 1;
-
 #if !DO_PROPERTYMAP_CONSTENCY_CHECK
 
 inline void Structure::checkConsistency()
@@ -728,238 +635,82 @@ inline void Structure::checkConsistency()
 
 #endif
 
-PropertyMapHashTable* Structure::copyPropertyTable()
+PropertyTable* Structure::copyPropertyTable(JSGlobalData& globalData, Structure* owner)
 {
-    if (!m_propertyTable)
-        return 0;
-
-    size_t tableSize = PropertyMapHashTable::allocationSize(m_propertyTable->size);
-    PropertyMapHashTable* newTable = static_cast<PropertyMapHashTable*>(fastMalloc(tableSize));
-    memcpy(newTable, m_propertyTable, tableSize);
-
-    unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
-    for (unsigned i = 1; i <= entryCount; ++i) {
-        if (StringImpl* key = newTable->entries()[i].key)
-            key->ref();
-    }
-
-    // Copy the deletedOffsets vector.
-    if (m_propertyTable->deletedOffsets)
-        newTable->deletedOffsets = new Vector<unsigned>(*m_propertyTable->deletedOffsets);
-
-    return newTable;
+    return m_propertyTable ? new PropertyTable(globalData, owner, *m_propertyTable) : 0;
 }
 
-size_t Structure::get(const StringImpl* rep, unsigned& attributes, JSCell*& specificValue)
+size_t Structure::get(JSGlobalData& globalData, StringImpl* propertyName, unsigned& attributes, JSCell*& specificValue)
 {
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
     if (!m_propertyTable)
-        return notFound;
-
-    unsigned i = rep->existingHash();
-
-#if DUMP_PROPERTYMAP_STATS
-    ++numProbes;
-#endif
-
-    unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-    if (entryIndex == emptyEntryIndex)
-        return notFound;
-
-    if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
-        attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
-        specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
-        ASSERT(m_propertyTable->entries()[entryIndex - 1].offset >= m_anonymousSlotCount);
-        return m_propertyTable->entries()[entryIndex - 1].offset;
-    }
-
-#if DUMP_PROPERTYMAP_STATS
-    ++numCollisions;
-#endif
-
-    unsigned k = 1 | doubleHash(rep->existingHash());
-
-    while (1) {
-        i += k;
-
-#if DUMP_PROPERTYMAP_STATS
-        ++numRehashes;
-#endif
+        return WTF::notFound;
 
-        entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-        if (entryIndex == emptyEntryIndex)
-            return notFound;
+    PropertyMapEntry* entry = m_propertyTable->find(propertyName).first;
+    if (!entry)
+        return WTF::notFound;
 
-        if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
-            attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
-            specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
-            ASSERT(m_propertyTable->entries()[entryIndex - 1].offset >= m_anonymousSlotCount);
-            return m_propertyTable->entries()[entryIndex - 1].offset;
-        }
-    }
+    attributes = entry->attributes;
+    specificValue = entry->specificValue.get();
+    ASSERT(entry->offset >= m_anonymousSlotCount);
+    return entry->offset;
 }
 
-bool Structure::despecifyFunction(const Identifier& propertyName)
+bool Structure::despecifyFunction(JSGlobalData& globalData, const Identifier& propertyName)
 {
-    ASSERT(!propertyName.isNull());
-
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
     if (!m_propertyTable)
         return false;
 
-    StringImpl* rep = propertyName.impl();
-
-    unsigned i = rep->existingHash();
-
-#if DUMP_PROPERTYMAP_STATS
-    ++numProbes;
-#endif
-
-    unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-    if (entryIndex == emptyEntryIndex)
+    ASSERT(!propertyName.isNull());
+    PropertyMapEntry* entry = m_propertyTable->find(propertyName.impl()).first;
+    if (!entry)
         return false;
 
-    if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
-        ASSERT(m_propertyTable->entries()[entryIndex - 1].specificValue);
-        m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
-        return true;
-    }
-
-#if DUMP_PROPERTYMAP_STATS
-    ++numCollisions;
-#endif
-
-    unsigned k = 1 | doubleHash(rep->existingHash());
-
-    while (1) {
-        i += k;
-
-#if DUMP_PROPERTYMAP_STATS
-        ++numRehashes;
-#endif
-
-        entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-        if (entryIndex == emptyEntryIndex)
-            return false;
-
-        if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
-            ASSERT(m_propertyTable->entries()[entryIndex - 1].specificValue);
-            m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
-            return true;
-        }
-    }
+    ASSERT(entry->specificValue);
+    entry->specificValue.clear();
+    return true;
 }
 
-void Structure::despecifyAllFunctions()
+void Structure::despecifyAllFunctions(JSGlobalData& globalData)
 {
-    materializePropertyMapIfNecessary();
+    materializePropertyMapIfNecessary(globalData);
     if (!m_propertyTable)
         return;
-    
-    unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
-    for (unsigned i = 1; i <= entryCount; ++i)
-        m_propertyTable->entries()[i].specificValue = 0;
+
+    PropertyTable::iterator end = m_propertyTable->end();
+    for (PropertyTable::iterator iter = m_propertyTable->begin(); iter != end; ++iter)
+        iter->specificValue.clear();
 }
 
-size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
+size_t Structure::putSpecificValue(JSGlobalData& globalData, const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!propertyName.isNull());
-    ASSERT(get(propertyName) == notFound);
+    ASSERT(get(globalData, propertyName) == notFound);
 
     checkConsistency();
-
     if (attributes & DontEnum)
         m_hasNonEnumerableProperties = true;
 
     StringImpl* rep = propertyName.impl();
 
     if (!m_propertyTable)
-        createPropertyMapHashTable();
-
-    // FIXME: Consider a fast case for tables with no deleted sentinels.
-
-    unsigned i = rep->existingHash();
-    unsigned k = 0;
-    bool foundDeletedElement = false;
-    unsigned deletedElementIndex = 0; // initialize to make the compiler happy
-
-#if DUMP_PROPERTYMAP_STATS
-    ++numProbes;
-#endif
-
-    while (1) {
-        unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-        if (entryIndex == emptyEntryIndex)
-            break;
-
-        if (entryIndex == deletedSentinelIndex) {
-            // If we find a deleted-element sentinel, remember it for use later.
-            if (!foundDeletedElement) {
-                foundDeletedElement = true;
-                deletedElementIndex = i;
-            }
-        }
-
-        if (k == 0) {
-            k = 1 | doubleHash(rep->existingHash());
-#if DUMP_PROPERTYMAP_STATS
-            ++numCollisions;
-#endif
-        }
-
-        i += k;
-
-#if DUMP_PROPERTYMAP_STATS
-        ++numRehashes;
-#endif
-    }
-
-    // Figure out which entry to use.
-    unsigned entryIndex = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount + 2;
-    if (foundDeletedElement) {
-        i = deletedElementIndex;
-        --m_propertyTable->deletedSentinelCount;
-
-        // Since we're not making the table bigger, we can't use the entry one past
-        // the end that we were planning on using, so search backwards for the empty
-        // slot that we can use. We know it will be there because we did at least one
-        // deletion in the past that left an entry empty.
-        while (m_propertyTable->entries()[--entryIndex - 1].key) { }
-    }
-
-    // Create a new hash table entry.
-    m_propertyTable->entryIndices[i & m_propertyTable->sizeMask] = entryIndex;
-
-    // Create a new hash table entry.
-    rep->ref();
-    m_propertyTable->entries()[entryIndex - 1].key = rep;
-    m_propertyTable->entries()[entryIndex - 1].attributes = attributes;
-    m_propertyTable->entries()[entryIndex - 1].specificValue = specificValue;
-    m_propertyTable->entries()[entryIndex - 1].index = ++m_propertyTable->lastIndexUsed;
+        createPropertyMap();
 
     unsigned newOffset;
-    if (m_propertyTable->deletedOffsets && !m_propertyTable->deletedOffsets->isEmpty()) {
-        newOffset = m_propertyTable->deletedOffsets->last();
-        m_propertyTable->deletedOffsets->removeLast();
-    } else
-        newOffset = m_propertyTable->keyCount + m_anonymousSlotCount;
-    m_propertyTable->entries()[entryIndex - 1].offset = newOffset;
-    
+
+    if (m_propertyTable->hasDeletedOffset())
+        newOffset = m_propertyTable->getDeletedOffset();
+    else
+        newOffset = m_propertyTable->size() + m_anonymousSlotCount;
     ASSERT(newOffset >= m_anonymousSlotCount);
-    ++m_propertyTable->keyCount;
 
-    if ((m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount) * 2 >= m_propertyTable->size)
-        expandPropertyMapHashTable();
+    m_propertyTable->add(PropertyMapEntry(globalData, this, rep, newOffset, attributes, specificValue));
 
     checkConsistency();
     return newOffset;
 }
 
-bool Structure::hasTransition(StringImpl* rep, unsigned attributes)
-{
-    return transitionTableHasTransition(make_pair(rep, attributes));
-}
-
 size_t Structure::remove(const Identifier& propertyName)
 {
     ASSERT(!propertyName.isNull());
@@ -971,289 +722,119 @@ size_t Structure::remove(const Identifier& propertyName)
     if (!m_propertyTable)
         return notFound;
 
-#if DUMP_PROPERTYMAP_STATS
-    ++numProbes;
-    ++numRemoves;
-#endif
-
-    // Find the thing to remove.
-    unsigned i = rep->existingHash();
-    unsigned k = 0;
-    unsigned entryIndex;
-    StringImpl* key = 0;
-    while (1) {
-        entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-        if (entryIndex == emptyEntryIndex)
-            return notFound;
-
-        key = m_propertyTable->entries()[entryIndex - 1].key;
-        if (rep == key)
-            break;
-
-        if (k == 0) {
-            k = 1 | doubleHash(rep->existingHash());
-#if DUMP_PROPERTYMAP_STATS
-            ++numCollisions;
-#endif
-        }
-
-        i += k;
-
-#if DUMP_PROPERTYMAP_STATS
-        ++numRehashes;
-#endif
-    }
-
-    // Replace this one element with the deleted sentinel. Also clear out
-    // the entry so we can iterate all the entries as needed.
-    m_propertyTable->entryIndices[i & m_propertyTable->sizeMask] = deletedSentinelIndex;
+    PropertyTable::find_iterator position = m_propertyTable->find(rep);
+    if (!position.first)
+        return notFound;
 
-    size_t offset = m_propertyTable->entries()[entryIndex - 1].offset;
+    size_t offset = position.first->offset;
     ASSERT(offset >= m_anonymousSlotCount);
 
-    key->deref();
-    m_propertyTable->entries()[entryIndex - 1].key = 0;
-    m_propertyTable->entries()[entryIndex - 1].attributes = 0;
-    m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
-    m_propertyTable->entries()[entryIndex - 1].offset = 0;
-
-    if (!m_propertyTable->deletedOffsets)
-        m_propertyTable->deletedOffsets = new Vector<unsigned>;
-    m_propertyTable->deletedOffsets->append(offset);
-
-    ASSERT(m_propertyTable->keyCount >= 1);
-    --m_propertyTable->keyCount;
-    ++m_propertyTable->deletedSentinelCount;
-
-    if (m_propertyTable->deletedSentinelCount * 4 >= m_propertyTable->size)
-        rehashPropertyMapHashTable();
+    m_propertyTable->remove(position);
+    m_propertyTable->addDeletedOffset(offset);
 
     checkConsistency();
     return offset;
 }
 
-void Structure::insertIntoPropertyMapHashTable(const PropertyMapEntry& entry)
-{
-    ASSERT(m_propertyTable);
-    ASSERT(entry.offset >= m_anonymousSlotCount);
-    unsigned i = entry.key->existingHash();
-    unsigned k = 0;
-
-#if DUMP_PROPERTYMAP_STATS
-    ++numProbes;
-#endif
-
-    while (1) {
-        unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-        if (entryIndex == emptyEntryIndex)
-            break;
-
-        if (k == 0) {
-            k = 1 | doubleHash(entry.key->existingHash());
-#if DUMP_PROPERTYMAP_STATS
-            ++numCollisions;
-#endif
-        }
-
-        i += k;
-
-#if DUMP_PROPERTYMAP_STATS
-        ++numRehashes;
-#endif
-    }
-
-    unsigned entryIndex = m_propertyTable->keyCount + 2;
-    m_propertyTable->entryIndices[i & m_propertyTable->sizeMask] = entryIndex;
-    m_propertyTable->entries()[entryIndex - 1] = entry;
-
-    ++m_propertyTable->keyCount;
-}
-
-void Structure::createPropertyMapHashTable()
-{
-    ASSERT(sizeForKeyCount(7) == newTableSize);
-    createPropertyMapHashTable(newTableSize);
-}
-
-void Structure::createPropertyMapHashTable(unsigned newTableSize)
+void Structure::createPropertyMap(unsigned capacity)
 {
     ASSERT(!m_propertyTable);
-    ASSERT(isPowerOf2(newTableSize));
 
     checkConsistency();
-
-    m_propertyTable = static_cast<PropertyMapHashTable*>(fastZeroedMalloc(PropertyMapHashTable::allocationSize(newTableSize)));
-    m_propertyTable->size = newTableSize;
-    m_propertyTable->sizeMask = newTableSize - 1;
-
+    m_propertyTable = new PropertyTable(capacity);
     checkConsistency();
 }
 
-void Structure::expandPropertyMapHashTable()
-{
-    ASSERT(m_propertyTable);
-    rehashPropertyMapHashTable(m_propertyTable->size * 2);
-}
-
-void Structure::rehashPropertyMapHashTable()
-{
-    ASSERT(m_propertyTable);
-    ASSERT(m_propertyTable->size);
-    rehashPropertyMapHashTable(m_propertyTable->size);
-}
-
-void Structure::rehashPropertyMapHashTable(unsigned newTableSize)
+void Structure::getPropertyNames(JSGlobalData& globalData, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
-    ASSERT(m_propertyTable);
-    ASSERT(isPowerOf2(newTableSize));
-
-    checkConsistency();
-
-    PropertyMapHashTable* oldTable = m_propertyTable;
+    materializePropertyMapIfNecessary(globalData);
+    if (!m_propertyTable)
+        return;
 
-    m_propertyTable = static_cast<PropertyMapHashTable*>(fastZeroedMalloc(PropertyMapHashTable::allocationSize(newTableSize)));
-    m_propertyTable->size = newTableSize;
-    m_propertyTable->sizeMask = newTableSize - 1;
+    bool knownUnique = !propertyNames.size();
 
-    unsigned lastIndexUsed = 0;
-    unsigned entryCount = oldTable->keyCount + oldTable->deletedSentinelCount;
-    for (unsigned i = 1; i <= entryCount; ++i) {
-        if (oldTable->entries()[i].key) {
-            lastIndexUsed = max(oldTable->entries()[i].index, lastIndexUsed);
-            insertIntoPropertyMapHashTable(oldTable->entries()[i]);
+    PropertyTable::iterator end = m_propertyTable->end();
+    for (PropertyTable::iterator iter = m_propertyTable->begin(); iter != end; ++iter) {
+        ASSERT(m_hasNonEnumerableProperties || !(iter->attributes & DontEnum));
+        if (!(iter->attributes & DontEnum) || (mode == IncludeDontEnumProperties)) {
+            if (knownUnique)
+                propertyNames.addKnownUnique(iter->key);
+            else
+                propertyNames.add(iter->key);
         }
     }
-    m_propertyTable->lastIndexUsed = lastIndexUsed;
-    m_propertyTable->deletedOffsets = oldTable->deletedOffsets;
-
-    fastFree(oldTable);
-
-    checkConsistency();
-}
-
-int comparePropertyMapEntryIndices(const void* a, const void* b)
-{
-    unsigned ia = static_cast<PropertyMapEntry* const*>(a)[0]->index;
-    unsigned ib = static_cast<PropertyMapEntry* const*>(b)[0]->index;
-    if (ia < ib)
-        return -1;
-    if (ia > ib)
-        return +1;
-    return 0;
 }
 
-void Structure::getPropertyNames(PropertyNameArray& propertyNames, EnumerationMode mode)
+void Structure::markChildren(MarkStack& markStack)
 {
-    materializePropertyMapIfNecessary();
-    if (!m_propertyTable)
-        return;
-
-    if (m_propertyTable->keyCount < tinyMapThreshold) {
-        PropertyMapEntry* a[tinyMapThreshold];
-        int i = 0;
-        unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
-        for (unsigned k = 1; k <= entryCount; k++) {
-            ASSERT(m_hasNonEnumerableProperties || !(m_propertyTable->entries()[k].attributes & DontEnum));
-            if (m_propertyTable->entries()[k].key && (!(m_propertyTable->entries()[k].attributes & DontEnum) || (mode == IncludeDontEnumProperties))) {
-                PropertyMapEntry* value = &m_propertyTable->entries()[k];
-                int j;
-                for (j = i - 1; j >= 0 && a[j]->index > value->index; --j)
-                    a[j + 1] = a[j];
-                a[j + 1] = value;
-                ++i;
-            }
-        }
-        if (!propertyNames.size()) {
-            for (int k = 0; k < i; ++k)
-                propertyNames.addKnownUnique(a[k]->key);
-        } else {
-            for (int k = 0; k < i; ++k)
-                propertyNames.add(a[k]->key);
+    JSCell::markChildren(markStack);
+    if (m_prototype)
+        markStack.append(&m_prototype);
+    if (m_cachedPrototypeChain)
+        markStack.append(&m_cachedPrototypeChain);
+    if (m_previous)
+        markStack.append(&m_previous);
+    if (m_specificValueInPrevious)
+        markStack.append(&m_specificValueInPrevious);
+    if (m_enumerationCache)
+        markStack.append(&m_enumerationCache);
+    if (m_propertyTable) {
+        PropertyTable::iterator end = m_propertyTable->end();
+        for (PropertyTable::iterator ptr = m_propertyTable->begin(); ptr != end; ++ptr) {
+            if (ptr->specificValue)
+                markStack.append(&ptr->specificValue);
         }
-
-        return;
-    }
-
-    // Allocate a buffer to use to sort the keys.
-    Vector<PropertyMapEntry*, smallMapThreshold> sortedEnumerables(m_propertyTable->keyCount);
-
-    // Get pointers to the enumerable entries in the buffer.
-    PropertyMapEntry** p = sortedEnumerables.data();
-    unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
-    for (unsigned i = 1; i <= entryCount; i++) {
-        if (m_propertyTable->entries()[i].key && (!(m_propertyTable->entries()[i].attributes & DontEnum) || (mode == IncludeDontEnumProperties)))
-            *p++ = &m_propertyTable->entries()[i];
-    }
-
-    size_t enumerableCount = p - sortedEnumerables.data();
-    // Sort the entries by index.
-    qsort(sortedEnumerables.data(), enumerableCount, sizeof(PropertyMapEntry*), comparePropertyMapEntryIndices);
-    sortedEnumerables.resize(enumerableCount);
-
-    // Put the keys of the sorted entries into the list.
-    if (!propertyNames.size()) {
-        for (size_t i = 0; i < sortedEnumerables.size(); ++i)
-            propertyNames.addKnownUnique(sortedEnumerables[i]->key);
-    } else {
-        for (size_t i = 0; i < sortedEnumerables.size(); ++i)
-            propertyNames.add(sortedEnumerables[i]->key);
     }
 }
 
 #if DO_PROPERTYMAP_CONSTENCY_CHECK
 
-void Structure::checkConsistency()
+void PropertyTable::checkConsistency()
 {
-    if (!m_propertyTable)
-        return;
-
-    ASSERT(m_propertyTable->size >= newTableSize);
-    ASSERT(m_propertyTable->sizeMask);
-    ASSERT(m_propertyTable->size == m_propertyTable->sizeMask + 1);
-    ASSERT(!(m_propertyTable->size & m_propertyTable->sizeMask));
-
-    ASSERT(m_propertyTable->keyCount <= m_propertyTable->size / 2);
-    ASSERT(m_propertyTable->deletedSentinelCount <= m_propertyTable->size / 4);
+    ASSERT(m_indexSize >= PropertyTable::MinimumTableSize);
+    ASSERT(m_indexMask);
+    ASSERT(m_indexSize == m_indexMask + 1);
+    ASSERT(!(m_indexSize & m_indexMask));
 
-    ASSERT(m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount <= m_propertyTable->size / 2);
+    ASSERT(m_keyCount <= m_indexSize / 2);
+    ASSERT(m_keyCount + m_deletedCount <= m_indexSize / 2);
+    ASSERT(m_deletedCount <= m_indexSize / 4);
 
     unsigned indexCount = 0;
     unsigned deletedIndexCount = 0;
-    for (unsigned a = 0; a != m_propertyTable->size; ++a) {
-        unsigned entryIndex = m_propertyTable->entryIndices[a];
-        if (entryIndex == emptyEntryIndex)
+    for (unsigned a = 0; a != m_indexSize; ++a) {
+        unsigned entryIndex = m_index[a];
+        if (entryIndex == PropertyTable::EmptyEntryIndex)
             continue;
-        if (entryIndex == deletedSentinelIndex) {
+        if (entryIndex == deletedEntryIndex()) {
             ++deletedIndexCount;
             continue;
         }
-        ASSERT(entryIndex > deletedSentinelIndex);
-        ASSERT(entryIndex - 1 <= m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount);
+        ASSERT(entryIndex < deletedEntryIndex());
+        ASSERT(entryIndex - 1 <= usedCount());
         ++indexCount;
 
-        for (unsigned b = a + 1; b != m_propertyTable->size; ++b)
-            ASSERT(m_propertyTable->entryIndices[b] != entryIndex);
+        for (unsigned b = a + 1; b != m_indexSize; ++b)
+            ASSERT(m_index[b] != entryIndex);
     }
-    ASSERT(indexCount == m_propertyTable->keyCount);
-    ASSERT(deletedIndexCount == m_propertyTable->deletedSentinelCount);
+    ASSERT(indexCount == m_keyCount);
+    ASSERT(deletedIndexCount == m_deletedCount);
 
-    ASSERT(m_propertyTable->entries()[0].key == 0);
+    ASSERT(!table()[deletedEntryIndex() - 1].key);
 
     unsigned nonEmptyEntryCount = 0;
-    for (unsigned c = 1; c <= m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount; ++c) {
-        ASSERT(m_hasNonEnumerableProperties || !(m_propertyTable->entries()[c].attributes & DontEnum));
-        StringImpl* rep = m_propertyTable->entries()[c].key;
-        ASSERT(m_propertyTable->entries()[c].offset >= m_anonymousSlotCount);
-        if (!rep)
+    for (unsigned c = 0; c < usedCount(); ++c) {
+        StringImpl* rep = table()[c].key;
+        if (rep == PROPERTY_MAP_DELETED_ENTRY_KEY)
             continue;
         ++nonEmptyEntryCount;
         unsigned i = rep->existingHash();
         unsigned k = 0;
         unsigned entryIndex;
         while (1) {
-            entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-            ASSERT(entryIndex != emptyEntryIndex);
-            if (rep == m_propertyTable->entries()[entryIndex - 1].key)
+            entryIndex = m_index[i & m_indexMask];
+            ASSERT(entryIndex != PropertyTable::EmptyEntryIndex);
+            if (rep == table()[entryIndex - 1].key)
                 break;
             if (k == 0)
                 k = 1 | doubleHash(rep->existingHash());
@@ -1262,7 +843,23 @@ void Structure::checkConsistency()
         ASSERT(entryIndex == c + 1);
     }
 
-    ASSERT(nonEmptyEntryCount == m_propertyTable->keyCount);
+    ASSERT(nonEmptyEntryCount == m_keyCount);
+}
+
+void Structure::checkConsistency()
+{
+    if (!m_propertyTable)
+        return;
+
+    if (!m_hasNonEnumerableProperties) {
+        PropertyTable::iterator end = m_propertyTable->end();
+        for (PropertyTable::iterator iter = m_propertyTable->begin(); iter != end; ++iter) {
+            ASSERT(!(iter->attributes & DontEnum));
+            ASSERT(iter->offset >= m_anonymousSlotCount);
+        }
+    }
+
+    m_propertyTable->checkConsistency();
 }
 
 #endif // DO_PROPERTYMAP_CONSTENCY_CHECK
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index 77724ac..fe9ce6b 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -27,67 +27,69 @@
 #define Structure_h
 
 #include "Identifier.h"
+#include "JSCell.h"
 #include "JSType.h"
 #include "JSValue.h"
 #include "PropertyMapHashTable.h"
 #include "PropertyNameArray.h"
 #include "Protect.h"
-#include "StructureChain.h"
 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"
 #include "UString.h"
-#include "WeakGCPtr.h"
+#include "Weak.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
-#ifndef NDEBUG
-#define DUMP_PROPERTYMAP_STATS 0
-#else
-#define DUMP_PROPERTYMAP_STATS 0
-#endif
 
 namespace JSC {
 
     class MarkStack;
     class PropertyNameArray;
     class PropertyNameArrayData;
+    class StructureChain;
+
+    struct ClassInfo;
 
     enum EnumerationMode {
         ExcludeDontEnumProperties,
         IncludeDontEnumProperties
     };
 
-    class Structure : public RefCounted<Structure> {
+    class Structure : public JSCell {
     public:
-        friend class JIT;
         friend class StructureTransitionTable;
-        static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount)
+        static Structure* create(JSGlobalData& globalData, JSValue prototype, const TypeInfo& typeInfo, unsigned anonymousSlotCount, const ClassInfo* classInfo)
         {
-            return adoptRef(new Structure(prototype, typeInfo, anonymousSlotCount));
+            ASSERT(globalData.structureStructure);
+            return new (&globalData) Structure(globalData, prototype, typeInfo, anonymousSlotCount, classInfo);
         }
 
-        static void startIgnoringLeaks();
-        static void stopIgnoringLeaks();
-
         static void dumpStatistics();
 
-        static PassRefPtr<Structure> addPropertyTransition(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
-        static PassRefPtr<Structure> addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
-        static PassRefPtr<Structure> removePropertyTransition(Structure*, const Identifier& propertyName, size_t& offset);
-        static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValue prototype);
-        static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);
-        static PassRefPtr<Structure> getterSetterTransition(Structure*);
-        static PassRefPtr<Structure> toCacheableDictionaryTransition(Structure*);
-        static PassRefPtr<Structure> toUncacheableDictionaryTransition(Structure*);
+        static Structure* addPropertyTransition(JSGlobalData&, Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
+        static Structure* addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
+        static Structure* removePropertyTransition(JSGlobalData&, Structure*, const Identifier& propertyName, size_t& offset);
+        static Structure* changePrototypeTransition(JSGlobalData&, Structure*, JSValue prototype);
+        static Structure* despecifyFunctionTransition(JSGlobalData&, Structure*, const Identifier&);
+        static Structure* getterSetterTransition(JSGlobalData&, Structure*);
+        static Structure* toCacheableDictionaryTransition(JSGlobalData&, Structure*);
+        static Structure* toUncacheableDictionaryTransition(JSGlobalData&, Structure*);
+        static Structure* sealTransition(JSGlobalData&, Structure*);
+        static Structure* freezeTransition(JSGlobalData&, Structure*);
+        static Structure* preventExtensionsTransition(JSGlobalData&, Structure*);
 
-        PassRefPtr<Structure> flattenDictionaryStructure(JSGlobalData&, JSObject*);
+        bool isSealed(JSGlobalData&);
+        bool isFrozen(JSGlobalData&);
+        bool isExtensible() const { return !m_preventExtensions; }
+
+        Structure* flattenDictionaryStructure(JSGlobalData&, JSObject*);
 
         ~Structure();
 
         // These should be used with caution.  
-        size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
-        size_t removePropertyWithoutTransition(const Identifier& propertyName);
-        void setPrototypeWithoutTransition(JSValue prototype) { m_prototype = prototype; }
+        size_t addPropertyWithoutTransition(JSGlobalData&, const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
+        size_t removePropertyWithoutTransition(JSGlobalData&, const Identifier& propertyName);
+        void setPrototypeWithoutTransition(JSGlobalData& globalData, JSValue prototype) { m_prototype.set(globalData, this, prototype); }
         
         bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
         bool isUncacheableDictionary() const { return m_dictionaryKind == UncachedDictionaryKind; }
@@ -95,32 +97,23 @@ namespace JSC {
         const TypeInfo& typeInfo() const { return m_typeInfo; }
 
         JSValue storedPrototype() const { return m_prototype.get(); }
-        DeprecatedPtr<Unknown>* storedPrototypeSlot() { return &m_prototype; }
         JSValue prototypeForLookup(ExecState*) const;
         StructureChain* prototypeChain(ExecState*) const;
+        void markChildren(MarkStack&);
 
         Structure* previousID() const { return m_previous.get(); }
 
         void growPropertyStorageCapacity();
         unsigned propertyStorageCapacity() const { return m_propertyStorageCapacity; }
-        unsigned propertyStorageSize() const { return m_anonymousSlotCount + (m_propertyTable ? m_propertyTable->keyCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : static_cast<unsigned>(m_offset + 1)); }
+        unsigned propertyStorageSize() const { return m_anonymousSlotCount + (m_propertyTable ? m_propertyTable->propertyStorageSize() : static_cast<unsigned>(m_offset + 1)); }
         bool isUsingInlineStorage() const;
 
-        size_t get(const Identifier& propertyName);
-        size_t get(const StringImpl* rep, unsigned& attributes, JSCell*& specificValue);
-        size_t get(const Identifier& propertyName, unsigned& attributes, JSCell*& specificValue)
+        size_t get(JSGlobalData&, const Identifier& propertyName);
+        size_t get(JSGlobalData&, StringImpl* propertyName, unsigned& attributes, JSCell*& specificValue);
+        size_t get(JSGlobalData& globalData, const Identifier& propertyName, unsigned& attributes, JSCell*& specificValue)
         {
             ASSERT(!propertyName.isNull());
-            return get(propertyName.impl(), attributes, specificValue);
-        }
-        bool transitionedFor(const JSCell* specificValue)
-        {
-            return m_specificValueInPrevious == specificValue;
-        }
-        bool hasTransition(StringImpl*, unsigned attributes);
-        bool hasTransition(const Identifier& propertyName, unsigned attributes)
-        {
-            return hasTransition(propertyName.impl(), attributes);
+            return get(globalData, propertyName.impl(), attributes, specificValue);
         }
 
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
@@ -131,48 +124,73 @@ namespace JSC {
         bool hasAnonymousSlots() const { return !!m_anonymousSlotCount; }
         unsigned anonymousSlotCount() const { return m_anonymousSlotCount; }
         
-        bool isEmpty() const { return m_propertyTable ? !m_propertyTable->keyCount : m_offset == noOffset; }
+        bool isEmpty() const { return m_propertyTable ? m_propertyTable->isEmpty() : m_offset == noOffset; }
 
-        void despecifyDictionaryFunction(const Identifier& propertyName);
+        void despecifyDictionaryFunction(JSGlobalData&, const Identifier& propertyName);
         void disableSpecificFunctionTracking() { m_specificFunctionThrashCount = maxSpecificFunctionThrashCount; }
 
-        void setEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
-        void clearEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
+        void setEnumerationCache(JSGlobalData&, JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
         JSPropertyNameIterator* enumerationCache(); // Defined in JSPropertyNameIterator.h.
-        void getPropertyNames(PropertyNameArray&, EnumerationMode mode);
-        
+        void getPropertyNames(JSGlobalData&, PropertyNameArray&, EnumerationMode mode);
+
+        const ClassInfo* classInfo() const { return m_classInfo; }
+
+        static ptrdiff_t prototypeOffset()
+        {
+            return OBJECT_OFFSETOF(Structure, m_prototype);
+        }
+
+        static ptrdiff_t typeInfoFlagsOffset()
+        {
+            return OBJECT_OFFSETOF(Structure, m_typeInfo) + TypeInfo::flagsOffset();
+        }
+
+        static ptrdiff_t typeInfoTypeOffset()
+        {
+            return OBJECT_OFFSETOF(Structure, m_typeInfo) + TypeInfo::typeOffset();
+        }
+
+        static Structure* createStructure(JSGlobalData& globalData)
+        {
+            ASSERT(!globalData.structureStructure);
+            return new (&globalData) Structure(globalData);
+        }
+
     private:
+        Structure(JSGlobalData&, JSValue prototype, const TypeInfo&, unsigned anonymousSlotCount, const ClassInfo*);
+        Structure(JSGlobalData&);
+        Structure(JSGlobalData&, const Structure*);
+
+        static Structure* create(JSGlobalData& globalData, const Structure* structure)
+        {
+            ASSERT(globalData.structureStructure);
+            return new (&globalData) Structure(globalData, structure);
+        }
+
+        static const ClassInfo s_info;
 
-        Structure(JSValue prototype, const TypeInfo&, unsigned anonymousSlotCount);
-        
         typedef enum { 
             NoneDictionaryKind = 0,
             CachedDictionaryKind = 1,
             UncachedDictionaryKind = 2
         } DictionaryKind;
-        static PassRefPtr<Structure> toDictionaryTransition(Structure*, DictionaryKind);
+        static Structure* toDictionaryTransition(JSGlobalData&, Structure*, DictionaryKind);
 
-        size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
+        size_t putSpecificValue(JSGlobalData&, const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
 
-        void expandPropertyMapHashTable();
-        void rehashPropertyMapHashTable();
-        void rehashPropertyMapHashTable(unsigned newTableSize);
-        void createPropertyMapHashTable();
-        void createPropertyMapHashTable(unsigned newTableSize);
-        void insertIntoPropertyMapHashTable(const PropertyMapEntry&);
+        void createPropertyMap(unsigned keyCount = 0);
         void checkConsistency();
 
-        bool despecifyFunction(const Identifier&);
-        void despecifyAllFunctions();
+        bool despecifyFunction(JSGlobalData&, const Identifier&);
+        void despecifyAllFunctions(JSGlobalData&);
 
-        PropertyMapHashTable* copyPropertyTable();
-        void materializePropertyMap();
-        void materializePropertyMapIfNecessary()
+        PropertyTable* copyPropertyTable(JSGlobalData&, Structure* owner);
+        void materializePropertyMap(JSGlobalData&);
+        void materializePropertyMapIfNecessary(JSGlobalData& globalData)
         {
-            if (m_propertyTable || !m_previous)             
-                return;
-            materializePropertyMap();
+            if (!m_propertyTable && m_previous)
+                materializePropertyMap(globalData);
         }
 
         signed char transitionCount() const
@@ -181,24 +199,8 @@ namespace JSC {
             return m_offset == noOffset ? 0 : m_offset + 1;
         }
 
-        typedef std::pair<Structure*, Structure*> Transition;
-        typedef HashMap<StructureTransitionTableHash::Key, Transition, StructureTransitionTableHash, StructureTransitionTableHashTraits> TransitionTable;
-
-        inline bool transitionTableContains(const StructureTransitionTableHash::Key& key, JSCell* specificValue);
-        inline void transitionTableRemove(const StructureTransitionTableHash::Key& key, JSCell* specificValue);
-        inline void transitionTableAdd(const StructureTransitionTableHash::Key& key, Structure* structure, JSCell* specificValue);
-        inline bool transitionTableHasTransition(const StructureTransitionTableHash::Key& key) const;
-        inline Structure* transitionTableGet(const StructureTransitionTableHash::Key& key, JSCell* specificValue) const;
-
-        TransitionTable* transitionTable() const { ASSERT(!m_isUsingSingleSlot); return m_transitions.m_table; }
-        inline void setTransitionTable(TransitionTable* table);
-        Structure* singleTransition() const { ASSERT(m_isUsingSingleSlot); return m_transitions.m_singleTransition; }
-        void setSingleTransition(Structure* structure) { ASSERT(m_isUsingSingleSlot); m_transitions.m_singleTransition = structure; }
-        
         bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
 
-        static const unsigned emptyEntryIndex = 0;
-    
         static const signed char s_maxTransitionLength = 64;
 
         static const signed char noOffset = -1;
@@ -207,22 +209,20 @@ namespace JSC {
 
         TypeInfo m_typeInfo;
 
-        DeprecatedPtr<Unknown> m_prototype;
-        mutable RefPtr<StructureChain> m_cachedPrototypeChain;
+        WriteBarrier<Unknown> m_prototype;
+        mutable WriteBarrier<StructureChain> m_cachedPrototypeChain;
 
-        RefPtr<Structure> m_previous;
+        WriteBarrier<Structure> m_previous;
         RefPtr<StringImpl> m_nameInPrevious;
-        JSCell* m_specificValueInPrevious;
+        WriteBarrier<JSCell> m_specificValueInPrevious;
 
-        // 'm_isUsingSingleSlot' indicates whether we are using the single transition optimisation.
-        union {
-            TransitionTable* m_table;
-            Structure* m_singleTransition;
-        } m_transitions;
+        const ClassInfo* m_classInfo;
 
-        WeakGCPtr<JSPropertyNameIterator> m_enumerationCache;
+        StructureTransitionTable m_transitionTable;
 
-        PropertyMapHashTable* m_propertyTable;
+        WriteBarrier<JSPropertyNameIterator> m_enumerationCache;
+
+        OwnPtr<PropertyTable> m_propertyTable;
 
         uint32_t m_propertyStorageCapacity;
 
@@ -243,53 +243,61 @@ namespace JSC {
 #endif
         unsigned m_specificFunctionThrashCount : 2;
         unsigned m_anonymousSlotCount : 5;
-        unsigned m_isUsingSingleSlot : 1;
+        unsigned m_preventExtensions : 1;
         // 4 free bits
     };
 
-    inline size_t Structure::get(const Identifier& propertyName)
+    inline size_t Structure::get(JSGlobalData& globalData, const Identifier& propertyName)
     {
-        ASSERT(!propertyName.isNull());
-
-        materializePropertyMapIfNecessary();
+        materializePropertyMapIfNecessary(globalData);
         if (!m_propertyTable)
-            return WTF::notFound;
-
-        StringImpl* rep = propertyName.impl();
+            return notFound;
 
-        unsigned i = rep->existingHash();
-
-#if DUMP_PROPERTYMAP_STATS
-        ++numProbes;
-#endif
-
-        unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-        if (entryIndex == emptyEntryIndex)
-            return WTF::notFound;
+        PropertyMapEntry* entry = m_propertyTable->find(propertyName.impl()).first;
+        ASSERT(!entry || entry->offset >= m_anonymousSlotCount);
+        return entry ? entry->offset : notFound;
+    }
 
-        if (rep == m_propertyTable->entries()[entryIndex - 1].key)
-            return m_propertyTable->entries()[entryIndex - 1].offset;
+    inline bool JSCell::isObject() const
+    {
+        return m_structure->typeInfo().type() == ObjectType;
+    }
 
-#if DUMP_PROPERTYMAP_STATS
-        ++numCollisions;
-#endif
+    inline bool JSCell::isString() const
+    {
+        return m_structure->typeInfo().type() == StringType;
+    }
 
-        unsigned k = 1 | WTF::doubleHash(rep->existingHash());
+    inline const ClassInfo* JSCell::classInfo() const
+    {
+        return m_structure->classInfo();
+    }
 
-        while (1) {
-            i += k;
+    inline Structure* JSCell::createDummyStructure(JSGlobalData& globalData)
+    {
+        return Structure::create(globalData, jsNull(), TypeInfo(UnspecifiedType), AnonymousSlotCount, 0);
+    }
 
-#if DUMP_PROPERTYMAP_STATS
-            ++numRehashes;
-#endif
+    inline bool JSValue::needsThisConversion() const
+    {
+        if (UNLIKELY(!isCell()))
+            return true;
+        return asCell()->structure()->typeInfo().needsThisConversion();
+    }
 
-            entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
-            if (entryIndex == emptyEntryIndex)
-                return WTF::notFound;
+    ALWAYS_INLINE void MarkStack::internalAppend(JSCell* cell)
+    {
+        ASSERT(!m_isCheckingForDefaultMarkViolation);
+        ASSERT(cell);
+        if (Heap::testAndSetMarked(cell))
+            return;
+        if (cell->structure()->typeInfo().type() >= CompoundType)
+            m_values.append(cell);
+    }
 
-            if (rep == m_propertyTable->entries()[entryIndex - 1].key)
-                return m_propertyTable->entries()[entryIndex - 1].offset;
-        }
+    inline StructureTransitionTable::Hash::Key StructureTransitionTable::keyForWeakGCMapFinalizer(void*, Structure* structure)
+    {
+        return Hash::Key(structure->m_nameInPrevious.get(), structure->m_attributesInPrevious);
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/StructureChain.cpp b/Source/JavaScriptCore/runtime/StructureChain.cpp
index e4523c3..ad6abff 100644
--- a/Source/JavaScriptCore/runtime/StructureChain.cpp
+++ b/Source/JavaScriptCore/runtime/StructureChain.cpp
@@ -31,19 +31,33 @@
 #include <wtf/RefPtr.h>
 
 namespace JSC {
+    
+ClassInfo StructureChain::s_info = { "StructureChain", 0, 0, 0 };
 
-StructureChain::StructureChain(Structure* head)
+StructureChain::StructureChain(JSGlobalData& globalData, Structure* structure, Structure* head)
+    : JSCell(globalData, structure)
 {
     size_t size = 0;
     for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
         ++size;
     
-    m_vector = adoptArrayPtr(new RefPtr<Structure>[size + 1]);
+    m_vector = adoptArrayPtr(new WriteBarrier<Structure>[size + 1]);
 
     size_t i = 0;
     for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
-        m_vector[i++] = current;
-    m_vector[i] = 0;
+        m_vector[i++].set(globalData, this, current);
+    m_vector[i].clear();
+}
+
+StructureChain::~StructureChain()
+{
+}
+
+void StructureChain::markChildren(MarkStack& markStack)
+{
+    size_t i = 0;
+    while (m_vector[i])
+        markStack.append(&m_vector[i++]);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/StructureChain.h b/Source/JavaScriptCore/runtime/StructureChain.h
index 816b66d..b984be6 100644
--- a/Source/JavaScriptCore/runtime/StructureChain.h
+++ b/Source/JavaScriptCore/runtime/StructureChain.h
@@ -26,6 +26,9 @@
 #ifndef StructureChain_h
 #define StructureChain_h
 
+#include "JSCell.h"
+#include "Structure.h"
+
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -35,17 +38,21 @@ namespace JSC {
 
     class Structure;
 
-    class StructureChain : public RefCounted<StructureChain> {
+    class StructureChain : public JSCell {
         friend class JIT;
 
     public:
-        static PassRefPtr<StructureChain> create(Structure* head) { return adoptRef(new StructureChain(head)); }
-        RefPtr<Structure>* head() { return m_vector.get(); }
+        static StructureChain* create(JSGlobalData& globalData, Structure* head) { return new (&globalData) StructureChain(globalData, globalData.structureChainStructure.get(), head); }
+        WriteBarrier<Structure>* head() { return m_vector.get(); }
+        void markChildren(MarkStack&);
 
-    private:
-        StructureChain(Structure* head);
+        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype) { return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesMarkChildren), 0, &s_info); }
 
-        OwnArrayPtr<RefPtr<Structure> > m_vector;
+    private:
+        StructureChain(JSGlobalData&, Structure*, Structure* head);
+        ~StructureChain();
+        OwnArrayPtr<WriteBarrier<Structure> > m_vector;
+        static ClassInfo s_info;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/StructureTransitionTable.h b/Source/JavaScriptCore/runtime/StructureTransitionTable.h
index 7e9d7ff..adebad2 100644
--- a/Source/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/Source/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -27,17 +27,20 @@
 #define StructureTransitionTable_h
 
 #include "UString.h"
+#include "WeakGCMap.h"
 #include <wtf/HashFunctions.h>
-#include <wtf/HashMap.h>
 #include <wtf/HashTraits.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace JSC {
 
-    class Structure;
+class Structure;
 
-    struct StructureTransitionTableHash {
+class StructureTransitionTable {
+    static const intptr_t UsingSingleSlotFlag = 1;
+
+    struct Hash {
         typedef std::pair<RefPtr<StringImpl>, unsigned> Key;
         static unsigned hash(const Key& p)
         {
@@ -52,7 +55,7 @@ namespace JSC {
         static const bool safeToCompareToEmptyOrDeleted = true;
     };
 
-    struct StructureTransitionTableHashTraits {
+    struct HashTraits {
         typedef WTF::HashTraits<RefPtr<StringImpl> > FirstTraits;
         typedef WTF::GenericHashTraits<unsigned> SecondTraits;
         typedef std::pair<FirstTraits::TraitType, SecondTraits::TraitType > TraitType;
@@ -66,6 +69,105 @@ namespace JSC {
         static bool isDeletedValue(const TraitType& value) { return FirstTraits::isDeletedValue(value.first); }
     };
 
+    struct WeakGCMapFinalizerCallback {
+        static void* finalizerContextFor(Hash::Key)
+        {
+            return 0;
+        }
+
+        static inline Hash::Key keyForFinalizer(void* context, Structure* structure)
+        {
+            return keyForWeakGCMapFinalizer(context, structure);
+        }
+    };
+
+    typedef WeakGCMap<Hash::Key, Structure, WeakGCMapFinalizerCallback, Hash, HashTraits> TransitionMap;
+
+    static Hash::Key keyForWeakGCMapFinalizer(void* context, Structure*);
+
+public:
+    StructureTransitionTable()
+        : m_data(UsingSingleSlotFlag)
+    {
+    }
+
+    ~StructureTransitionTable()
+    {
+        if (!isUsingSingleSlot())
+            delete map();
+        else
+            clearSingleTransition();
+    }
+
+    inline void add(JSGlobalData&, Structure*);
+    inline void remove(Structure*);
+    inline bool contains(StringImpl* rep, unsigned attributes) const;
+    inline Structure* get(StringImpl* rep, unsigned attributes) const;
+
+private:
+    bool isUsingSingleSlot() const
+    {
+        return m_data & UsingSingleSlotFlag;
+    }
+
+    TransitionMap* map() const
+    {
+        ASSERT(!isUsingSingleSlot());
+        return reinterpret_cast<TransitionMap*>(m_data);
+    }
+
+    HandleSlot slot() const
+    {
+        ASSERT(isUsingSingleSlot());
+        return reinterpret_cast<HandleSlot>(m_data & ~UsingSingleSlotFlag);
+    }
+
+    void setMap(TransitionMap* map)
+    {
+        ASSERT(isUsingSingleSlot());
+        
+        if (HandleSlot slot = this->slot())
+            HandleHeap::heapFor(slot)->deallocate(slot);
+
+        // This implicitly clears the flag that indicates we're using a single transition
+        m_data = reinterpret_cast<intptr_t>(map);
+
+        ASSERT(!isUsingSingleSlot());
+    }
+
+    Structure* singleTransition() const
+    {
+        ASSERT(isUsingSingleSlot());
+        if (HandleSlot slot = this->slot()) {
+            if (*slot)
+                return reinterpret_cast<Structure*>(slot->asCell());
+        }
+        return 0;
+    }
+    
+    void clearSingleTransition()
+    {
+        ASSERT(isUsingSingleSlot());
+        if (HandleSlot slot = this->slot())
+            HandleHeap::heapFor(slot)->deallocate(slot);
+    }
+    
+    void setSingleTransition(JSGlobalData& globalData, Structure* structure)
+    {
+        ASSERT(isUsingSingleSlot());
+        HandleSlot slot = this->slot();
+        if (!slot) {
+            slot = globalData.allocateGlobalHandle();
+            HandleHeap::heapFor(slot)->makeWeak(slot, 0, 0);
+            m_data = reinterpret_cast<intptr_t>(slot) | UsingSingleSlotFlag;
+        }
+        HandleHeap::heapFor(slot)->writeBarrier(slot, reinterpret_cast<JSCell*>(structure));
+        *slot = reinterpret_cast<JSCell*>(structure);
+    }
+
+    intptr_t m_data;
+};
+
 } // namespace JSC
 
 #endif // StructureTransitionTable_h
diff --git a/Source/JavaScriptCore/runtime/TimeoutChecker.cpp b/Source/JavaScriptCore/runtime/TimeoutChecker.cpp
index 04d904d..d3867d4 100644
--- a/Source/JavaScriptCore/runtime/TimeoutChecker.cpp
+++ b/Source/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -101,7 +101,7 @@ static inline unsigned getCPUTime()
 
     // use a relative time from first call in order to avoid an overflow
     static double firstTime = currentTime();
-    return (currentTime() - firstTime) * 1000;
+    return static_cast<unsigned> ((currentTime() - firstTime) * 1000);
 #endif
 }
 
diff --git a/Source/JavaScriptCore/runtime/UString.h b/Source/JavaScriptCore/runtime/UString.h
index 8f6c083..b98e7b4 100644
--- a/Source/JavaScriptCore/runtime/UString.h
+++ b/Source/JavaScriptCore/runtime/UString.h
@@ -252,10 +252,7 @@ template<> struct DefaultHash<JSC::UString> {
     typedef JSC::UStringHash Hash;
 };
 
-template <> struct VectorTraits<JSC::UString> : SimpleClassVectorTraits
-{
-    static const bool canInitializeWithMemset = true;
-};
+template <> struct VectorTraits<JSC::UString> : SimpleClassVectorTraits { };
 
 } // namespace WTF
 
diff --git a/Source/JavaScriptCore/runtime/WeakGCMap.h b/Source/JavaScriptCore/runtime/WeakGCMap.h
index 7bf4503..5ad1c62 100644
--- a/Source/JavaScriptCore/runtime/WeakGCMap.h
+++ b/Source/JavaScriptCore/runtime/WeakGCMap.h
@@ -26,110 +26,165 @@
 #ifndef WeakGCMap_h
 #define WeakGCMap_h
 
-#include "Heap.h"
+#include "Handle.h"
+#include "JSGlobalData.h"
 #include <wtf/HashMap.h>
 
 namespace JSC {
 
-class JSCell;
+// A HashMap for GC'd values that removes entries when the associated value
+// dies.
+template <typename KeyType, typename MappedType> struct DefaultWeakGCMapFinalizerCallback {
+    static void* finalizerContextFor(KeyType key)
+    {
+        return reinterpret_cast<void*>(key);
+    }
+
+    static KeyType keyForFinalizer(void* context, typename HandleTypes<MappedType>::ExternalType)
+    {
+        return reinterpret_cast<KeyType>(context);
+    }
+};
 
-// A HashMap whose get() function returns emptyValue() for cells awaiting destruction.
-template<typename KeyType, typename MappedType>
-class WeakGCMap {
+template<typename KeyType, typename MappedType, typename FinalizerCallback = DefaultWeakGCMapFinalizerCallback<KeyType, MappedType>, typename HashArg = typename DefaultHash<KeyType>::Hash, typename KeyTraitsArg = HashTraits<KeyType> >
+class WeakGCMap : private WeakHandleOwner {
     WTF_MAKE_FAST_ALLOCATED;
-    /*
-    Invariants:
-        * A value enters the WeakGCMap marked. (Guaranteed by set().)
-        * A value that becomes unmarked leaves the WeakGCMap before being recycled. (Guaranteed by the value's destructor removing it from the WeakGCMap.)
-        * A value that becomes unmarked leaves the WeakGCMap before becoming marked again. (Guaranteed by all destructors running before the mark phase begins.)
-        * During the mark phase, all values in the WeakGCMap are valid. (Guaranteed by all destructors running before the mark phase begins.)
-    */
+    WTF_MAKE_NONCOPYABLE(WeakGCMap);
+
+    typedef HashMap<KeyType, HandleSlot, HashArg, KeyTraitsArg> MapType;
+    typedef typename HandleTypes<MappedType>::ExternalType ExternalType;
+    typedef typename MapType::iterator map_iterator;
 
 public:
-    typedef typename HashMap<KeyType, DeprecatedPtr<MappedType> >::iterator iterator;
-    typedef typename HashMap<KeyType, DeprecatedPtr<MappedType> >::const_iterator const_iterator;
-    
+
+    struct iterator {
+        friend class WeakGCMap;
+        iterator(map_iterator iter)
+            : m_iterator(iter)
+        {
+        }
+        
+        std::pair<KeyType, ExternalType> get() const { return std::make_pair(m_iterator->first, HandleTypes<MappedType>::getFromSlot(m_iterator->second)); }
+        std::pair<KeyType, HandleSlot> getSlot() const { return *m_iterator; }
+        
+        iterator& operator++() { ++m_iterator; return *this; }
+        
+        // postfix ++ intentionally omitted
+        
+        // Comparison.
+        bool operator==(const iterator& other) const { return m_iterator == other.m_iterator; }
+        bool operator!=(const iterator& other) const { return m_iterator != other.m_iterator; }
+        
+    private:
+        map_iterator m_iterator;
+    };
+
+    WeakGCMap()
+    {
+    }
+
     bool isEmpty() { return m_map.isEmpty(); }
-    void clear() { m_map.clear(); }
+    void clear()
+    {
+        map_iterator end = m_map.end();
+        for (map_iterator ptr = m_map.begin(); ptr != end; ++ptr)
+            HandleHeap::heapFor(ptr->second)->deallocate(ptr->second);
+        m_map.clear();
+    }
 
-    MappedType* get(const KeyType&) const;
-    pair<iterator, bool> set(const KeyType&, MappedType*); 
-    MappedType* take(const KeyType&);
+    bool contains(const KeyType& key) const
+    {
+        return m_map.contains(key);
+    }
 
-    // These unchecked functions provide access to a value even if the value's
-    // mark bit is not set. This is used, among other things, to retrieve values
-    // during the GC mark phase, which begins by clearing all mark bits.
-    
-    size_t uncheckedSize() { return m_map.size(); }
+    iterator find(const KeyType& key)
+    {
+        return m_map.find(key);
+    }
 
-    MappedType* uncheckedGet(const KeyType& key) const { return m_map.get(key).get(); }
-    DeprecatedPtr<MappedType>* uncheckedGetSlot(const KeyType& key)
+    void remove(iterator iter)
     {
-        iterator iter = m_map.find(key);
-        if (iter == m_map.end())
-            return 0;
-        return &iter->second;
+        ASSERT(iter.m_iterator != m_map.end());
+        HandleSlot slot = iter.m_iterator->second;
+        ASSERT(slot);
+        HandleHeap::heapFor(slot)->deallocate(slot);
+        m_map.remove(iter.m_iterator);
     }
-    bool uncheckedRemove(const KeyType&, MappedType*);
 
-    iterator uncheckedBegin() { return m_map.begin(); }
-    iterator uncheckedEnd() { return m_map.end(); }
+    ExternalType get(const KeyType& key) const
+    {
+        return HandleTypes<MappedType>::getFromSlot(m_map.get(key));
+    }
 
-    const_iterator uncheckedBegin() const { return m_map.begin(); }
-    const_iterator uncheckedEnd() const { return m_map.end(); }
+    HandleSlot getSlot(const KeyType& key) const
+    {
+        return m_map.get(key);
+    }
 
-    bool isValid(iterator it) const { return Heap::isMarked(it->second.get()); }
-    bool isValid(const_iterator it) const { return Heap::isMarked(it->second.get()); }
+    pair<iterator, bool> add(JSGlobalData& globalData, const KeyType& key, ExternalType value)
+    {
+        pair<typename MapType::iterator, bool> iter = m_map.add(key, 0);
+        if (iter.second) {
+            HandleSlot slot = globalData.allocateGlobalHandle();
+            iter.first->second = slot;
+            HandleHeap::heapFor(slot)->makeWeak(slot, this, FinalizerCallback::finalizerContextFor(key));
+            HandleHeap::heapFor(slot)->writeBarrier(slot, value);
+            *slot = value;
+        }
+        return iter;
+    }
+    
+    void set(iterator iter, ExternalType value)
+    {
+        HandleSlot slot = iter.m_iterator->second;
+        ASSERT(slot);
+        HandleHeap::heapFor(slot)->writeBarrier(slot, value);
+        *slot = value;
+    }
 
-private:
-    HashMap<KeyType, DeprecatedPtr<MappedType> > m_map;
-};
+    void set(JSGlobalData& globalData, const KeyType& key, ExternalType value)
+    {
+        pair<typename MapType::iterator, bool> iter = m_map.add(key, 0);
+        HandleSlot slot = iter.first->second;
+        if (iter.second) {
+            slot = globalData.allocateGlobalHandle();
+            HandleHeap::heapFor(slot)->makeWeak(slot, this, key);
+            iter.first->second = slot;
+        }
+        HandleHeap::heapFor(slot)->writeBarrier(slot, value);
+        *slot = value;
+    }
 
-template<typename KeyType, typename MappedType>
-inline MappedType* WeakGCMap<KeyType, MappedType>::get(const KeyType& key) const
-{
-    MappedType* result = m_map.get(key).get();
-    if (result == HashTraits<MappedType*>::emptyValue())
-        return result;
-    if (!Heap::isMarked(result))
-        return HashTraits<MappedType*>::emptyValue();
-    return result;
-}
-
-template<typename KeyType, typename MappedType>
-MappedType* WeakGCMap<KeyType, MappedType>::take(const KeyType& key)
-{
-    MappedType* result = m_map.take(key).get();
-    if (result == HashTraits<MappedType*>::emptyValue())
+    ExternalType take(const KeyType& key)
+    {
+        HandleSlot slot = m_map.take(key);
+        if (!slot)
+            return HashTraits<ExternalType>::emptyValue();
+        ExternalType result = HandleTypes<MappedType>::getFromSlot(slot);
+        HandleHeap::heapFor(slot)->deallocate(slot);
         return result;
-    if (!Heap::isMarked(result))
-        return HashTraits<MappedType*>::emptyValue();
-    return result;
-}
-
-template<typename KeyType, typename MappedType>
-pair<typename WeakGCMap<KeyType, MappedType>::iterator, bool> WeakGCMap<KeyType, MappedType>::set(const KeyType& key, MappedType* value)
-{
-    Heap::setMarked(value); // If value is newly allocated, it's not marked, so mark it now.
-    pair<iterator, bool> result = m_map.add(key, value);
-    if (!result.second) { // pre-existing entry
-        result.second = !Heap::isMarked(result.first->second.get());
-        result.first->second = value;
     }
-    return result;
-}
-
-template<typename KeyType, typename MappedType>
-bool WeakGCMap<KeyType, MappedType>::uncheckedRemove(const KeyType& key, MappedType* value)
-{
-    iterator it = m_map.find(key);
-    if (it == m_map.end())
-        return false;
-    if (it->second.get() != value)
-        return false;
-    m_map.remove(it);
-    return true;
-}
+
+    size_t size() { return m_map.size(); }
+
+    iterator begin() { return iterator(m_map.begin()); }
+    iterator end() { return iterator(m_map.end()); }
+    
+    ~WeakGCMap()
+    {
+        clear();
+    }
+    
+private:
+    virtual void finalize(Handle<Unknown> handle, void* context)
+    {
+        HandleSlot slot = m_map.take(FinalizerCallback::keyForFinalizer(context, HandleTypes<MappedType>::getFromSlot(handle.slot())));
+        ASSERT(slot);
+        HandleHeap::heapFor(slot)->deallocate(slot);
+    }
+
+    MapType m_map;
+};
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/WeakGCPtr.h b/Source/JavaScriptCore/runtime/WeakGCPtr.h
deleted file mode 100644
index 4946ee7..0000000
--- a/Source/JavaScriptCore/runtime/WeakGCPtr.h
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WeakGCPtr_h
-#define WeakGCPtr_h
-
-#include "Heap.h"
-#include "GCHandle.h"
-
-namespace JSC {
-
-// A smart pointer whose get() function returns 0 for cells awaiting destruction.
-template <typename T> class WeakGCPtr {
-    WTF_MAKE_NONCOPYABLE(WeakGCPtr);
-public:
-    WeakGCPtr()
-        : m_ptr(0)
-    {
-    }
-
-    WeakGCPtr(T* ptr) { assign(ptr); }
-
-    ~WeakGCPtr()
-    {
-        if (m_ptr)
-            m_ptr->pool()->free(m_ptr);
-    }
-
-    T* get() const
-    {
-        if (m_ptr && m_ptr->isValidPtr())
-            return static_cast<T*>(m_ptr->get());
-        return 0;
-    }
-    
-    bool clear(JSCell* p)
-    {
-        if (!m_ptr || m_ptr->get() != p)
-            return false;
-
-        m_ptr->pool()->free(m_ptr);
-        m_ptr = 0;
-        return true;
-    }
-
-    T& operator*() const { return *get(); }
-    T* operator->() const { return get(); }
-    
-    bool operator!() const { return !get(); }
-
-    // This conversion operator allows implicit conversion to bool but not to other integer types.
-#if COMPILER(WINSCW)
-    operator bool() const { return m_ptr; }
-#else
-    typedef WeakGCHandle* WeakGCPtr::*UnspecifiedBoolType;
-    operator UnspecifiedBoolType() const { return get() ? &WeakGCPtr::m_ptr : 0; }
-#endif
-
-    WeakGCPtr& operator=(T*);
-
-#if !ASSERT_DISABLED
-    bool hasDeadObject() const { return !!m_ptr; }
-#endif
-
-private:
-    void assign(JSCell* ptr)
-    {
-        ASSERT(ptr);
-        if (m_ptr)
-            m_ptr->set(ptr);
-        else
-            m_ptr = Heap::heap(ptr)->addWeakGCHandle(ptr);
-    }
-
-    WeakGCHandle* m_ptr;
-};
-
-template <typename T> inline WeakGCPtr<T>& WeakGCPtr<T>::operator=(T* optr)
-{
-    assign(optr);
-    return *this;
-}
-
-template <typename T, typename U> inline bool operator==(const WeakGCPtr<T>& a, const WeakGCPtr<U>& b)
-{ 
-    return a.get() == b.get(); 
-}
-
-template <typename T, typename U> inline bool operator==(const WeakGCPtr<T>& a, U* b)
-{ 
-    return a.get() == b; 
-}
-
-template <typename T, typename U> inline bool operator==(T* a, const WeakGCPtr<U>& b) 
-{
-    return a == b.get(); 
-}
-
-template <typename T, typename U> inline bool operator!=(const WeakGCPtr<T>& a, const WeakGCPtr<U>& b)
-{ 
-    return a.get() != b.get(); 
-}
-
-template <typename T, typename U> inline bool operator!=(const WeakGCPtr<T>& a, U* b)
-{
-    return a.get() != b; 
-}
-
-template <typename T, typename U> inline bool operator!=(T* a, const WeakGCPtr<U>& b)
-{ 
-    return a != b.get(); 
-}
-
-template <typename T, typename U> inline WeakGCPtr<T> static_pointer_cast(const WeakGCPtr<U>& p)
-{ 
-    return WeakGCPtr<T>(static_cast<T*>(p.get())); 
-}
-
-template <typename T, typename U> inline WeakGCPtr<T> const_pointer_cast(const WeakGCPtr<U>& p)
-{ 
-    return WeakGCPtr<T>(const_cast<T*>(p.get())); 
-}
-
-template <typename T> inline T* get(const WeakGCPtr<T>& p)
-{
-    return p.get();
-}
-
-} // namespace JSC
-
-#endif // WeakGCPtr_h
diff --git a/Source/JavaScriptCore/runtime/WriteBarrier.h b/Source/JavaScriptCore/runtime/WriteBarrier.h
index 64150ed..32cb968 100644
--- a/Source/JavaScriptCore/runtime/WriteBarrier.h
+++ b/Source/JavaScriptCore/runtime/WriteBarrier.h
@@ -32,62 +32,59 @@ namespace JSC {
 class JSCell;
 class JSGlobalData;
 
-typedef enum { } Unknown;
-
-template <class T> class DeprecatedPtr {
-public:
-    DeprecatedPtr() : m_cell(0) { }
-    DeprecatedPtr(T* cell) : m_cell(reinterpret_cast<JSCell*>(cell)) { }
-    T* get() const { return reinterpret_cast<T*>(m_cell); }
-    T* operator*() const { return static_cast<T*>(m_cell); }
-    T* operator->() const { return static_cast<T*>(m_cell); }
-    
-    JSCell** slot() { return &m_cell; }
-    
-    typedef T* (DeprecatedPtr::*UnspecifiedBoolType);
-    operator UnspecifiedBoolType*() const { return m_cell ? reinterpret_cast<UnspecifiedBoolType*>(1) : 0; }
-
-    bool operator!() const { return !m_cell; }
+inline void writeBarrier(JSGlobalData&, const JSCell*, JSValue)
+{
+}
 
-protected:
-    JSCell* m_cell;
-};
+inline void writeBarrier(JSGlobalData&, const JSCell*, JSCell*)
+{
+}
 
-template <> class DeprecatedPtr<Unknown> {
-public:
-    DeprecatedPtr() { }
-    DeprecatedPtr(JSValue value) : m_value(value) { }
-    DeprecatedPtr(JSCell* value) : m_value(value) { }
-    const JSValue& get() const { return m_value; }
-    const JSValue* operator*() const { return &m_value; }
-    const JSValue* operator->() const { return &m_value; }
-    
-    JSValue* slot() { return &m_value; }
-    
-    typedef JSValue (DeprecatedPtr::*UnspecifiedBoolType);
-    operator UnspecifiedBoolType*() const { return m_value ? reinterpret_cast<UnspecifiedBoolType*>(1) : 0; }
-    bool operator!() const { return !m_value; }
-    
-private:
-    JSValue m_value;
-};
+typedef enum { } Unknown;
+typedef JSValue* HandleSlot;
 
-template <typename T> struct WriteBarrierCheck {
+template <typename T> struct JSValueChecker {
     static const bool IsJSValue = false;
 };
 
-template <> struct WriteBarrierCheck<JSValue> {
+template <> struct JSValueChecker<JSValue> {
     static const bool IsJSValue = true;
 };
 
+// We have a separate base class with no constructors for use in Unions.
 template <typename T> class WriteBarrierBase {
 public:
-    COMPILE_ASSERT(!WriteBarrierCheck<T>::IsJSValue, WriteBarrier_JSValue_is_invalid__use_unknown);
-    void set(JSGlobalData&, const JSCell*, T* value) { this->m_cell = reinterpret_cast<JSCell*>(value); }
+    COMPILE_ASSERT(!JSValueChecker<T>::IsJSValue, WriteBarrier_JSValue_is_invalid__use_unknown);
+    void set(JSGlobalData& globalData, const JSCell* owner, T* value)
+    {
+        this->m_cell = reinterpret_cast<JSCell*>(value);
+        writeBarrier(globalData, owner, this->m_cell);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie(owner));
+        ASSERT(!isZombie(m_cell));
+#endif
+    }
     
-    T* get() const { return reinterpret_cast<T*>(m_cell); }
-    T* operator*() const { return static_cast<T*>(m_cell); }
-    T* operator->() const { return static_cast<T*>(m_cell); }
+    T* get() const
+    {
+        return reinterpret_cast<T*>(m_cell);
+    }
+
+    T* operator*() const
+    {
+        ASSERT(m_cell);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie(m_cell));
+#endif
+        return static_cast<T*>(m_cell);
+    }
+
+    T* operator->() const
+    {
+        ASSERT(m_cell);
+        return static_cast<T*>(m_cell);
+    }
+
     void clear() { m_cell = 0; }
     
     JSCell** slot() { return &m_cell; }
@@ -97,30 +94,46 @@ public:
     
     bool operator!() const { return !m_cell; }
 
-    void setWithoutWriteBarrier(T* value) { this->m_cell = reinterpret_cast<JSCell*>(value); }
+    void setWithoutWriteBarrier(T* value)
+    {
+        this->m_cell = reinterpret_cast<JSCell*>(value);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!m_cell || !isZombie(m_cell));
+#endif
+    }
 
-protected:
+private:
     JSCell* m_cell;
 };
 
-template <typename T> class WriteBarrier : public WriteBarrierBase<T> {
+template <> class WriteBarrierBase<Unknown> {
 public:
-    WriteBarrier() { this->m_cell = 0; }
-    WriteBarrier(JSGlobalData& globalData, const JSCell* owner, T* value)
+    void set(JSGlobalData& globalData, const JSCell* owner, JSValue value)
     {
-        this->set(globalData, owner, value);
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!isZombie(owner));
+        ASSERT(!value.isZombie());
+#endif
+        m_value = JSValue::encode(value);
+        writeBarrier(globalData, owner, value);
+    }
+    void setWithoutWriteBarrier(JSValue value)
+    {
+#if ENABLE(JSC_ZOMBIES)
+        ASSERT(!value.isZombie());
+#endif
+        m_value = JSValue::encode(value);
     }
 
-};
-
-template <> class WriteBarrierBase<Unknown> {
-public:
-    void set(JSGlobalData&, const JSCell*, JSValue value) { m_value = JSValue::encode(value); }
-    void setWithoutWriteBarrier(JSValue value) { m_value = JSValue::encode(value); }
-    JSValue get() const { return JSValue::decode(m_value); }
+    JSValue get() const
+    {
+        return JSValue::decode(m_value);
+    }
     void clear() { m_value = JSValue::encode(JSValue()); }
     void setUndefined() { m_value = JSValue::encode(jsUndefined()); }
     bool isNumber() const { return get().isNumber(); }
+    bool isObject() const { return get().isObject(); }
+    bool isNull() const { return get().isNull(); }
     bool isGetterSetter() const { return get().isGetterSetter(); }
     
     JSValue* slot()
@@ -137,29 +150,41 @@ public:
     operator UnspecifiedBoolType*() const { return get() ? reinterpret_cast<UnspecifiedBoolType*>(1) : 0; }
     bool operator!() const { return !get(); } 
     
-protected:
+private:
     EncodedJSValue m_value;
 };
 
+template <typename T> class WriteBarrier : public WriteBarrierBase<T> {
+public:
+    WriteBarrier()
+    {
+        this->setWithoutWriteBarrier(0);
+    }
+
+    WriteBarrier(JSGlobalData& globalData, const JSCell* owner, T* value)
+    {
+        this->set(globalData, owner, value);
+    }
+};
+
 template <> class WriteBarrier<Unknown> : public WriteBarrierBase<Unknown> {
 public:
-    WriteBarrier() { m_value = JSValue::encode(JSValue()); }
+    WriteBarrier()
+    {
+        this->setWithoutWriteBarrier(JSValue());
+    }
+
     WriteBarrier(JSGlobalData& globalData, const JSCell* owner, JSValue value)
     {
         this->set(globalData, owner, value);
     }
 };
 
-template <typename U, typename V> inline bool operator==(const DeprecatedPtr<U>& lhs, const DeprecatedPtr<V>& rhs)
-{
-    return lhs.get() == rhs.get();
-}
-
 template <typename U, typename V> inline bool operator==(const WriteBarrierBase<U>& lhs, const WriteBarrierBase<V>& rhs)
 {
     return lhs.get() == rhs.get();
 }
 
-}
+} // namespace JSC
 
 #endif // WriteBarrier_h
diff --git a/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input.js b/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input.js
index 01c145c..26db14c 100644
--- a/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input.js
+++ b/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input.js
@@ -50,40 +50,40 @@
 	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /\\d+/.exec('2345')",
 	                                    String(["2345"]), String(/\d+/.exec('2345')));
 
-    // RegExp.input = "abcd12357efg"; /\d+/.exec()
+    // RegExp.input = "abcd12357efg"; /\d+/.exec(RegExp.input)
     RegExp.input = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /\\d+/.exec()",
-	                                    String(["12357"]), String(/\d+/.exec()));
+	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /\\d+/.exec(RegExp.input)",
+	                                    String(["12357"]), String(/\d+/.exec(RegExp.input)));
 
-    // RegExp.input = "abcd12357efg"; /[h-z]+/.exec()
+    // RegExp.input = "abcd12357efg"; /[h-z]+/.exec(RegExp.input)
     RegExp.input = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /[h-z]+/.exec()",
-	                                    null, /[h-z]+/.exec());
+	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /[h-z]+/.exec(RegExp.input)",
+	                                    null, /[h-z]+/.exec(RegExp.input));
 
     // RegExp.input = "abcd12357efg"; /\d+/.test('2345')
     RegExp.input = "abcd12357efg";
 	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /\\d+/.test('2345')",
 	                                    true, /\d+/.test('2345'));
 
-    // RegExp.input = "abcd12357efg"; /\d+/.test()
+    // RegExp.input = "abcd12357efg"; /\d+/.test(RegExp.input)
     RegExp.input = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /\\d+/.test()",
-	                                    true, /\d+/.test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /\\d+/.test(RegExp.input)",
+	                                    true, /\d+/.test(RegExp.input));
 
-    // RegExp.input = "abcd12357efg"; (new RegExp('d+')).test()
+    // RegExp.input = "abcd12357efg"; (new RegExp('d+')).test(RegExp.input)
     RegExp.input = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; (new RegExp('d+')).test()",
-	                                    true, (new RegExp('d+')).test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; (new RegExp('d+')).test(RegExp.input)",
+	                                    true, (new RegExp('d+')).test(RegExp.input));
 
-    // RegExp.input = "abcd12357efg"; /[h-z]+/.test()
+    // RegExp.input = "abcd12357efg"; /[h-z]+/.test(RegExp.input)
     RegExp.input = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /[h-z]+/.test()",
-	                                    false, /[h-z]+/.test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; /[h-z]+/.test(RegExp.input)",
+	                                    false, /[h-z]+/.test(RegExp.input));
 
-    // RegExp.input = "abcd12357efg"; (new RegExp('[h-z]+')).test()
+    // RegExp.input = "abcd12357efg"; (new RegExp('[h-z]+')).test(RegExp.input)
     RegExp.input = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; (new RegExp('[h-z]+')).test()",
-	                                    false, (new RegExp('[h-z]+')).test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp.input = 'abcd12357efg'; (new RegExp('[h-z]+')).test(RegExp.input)",
+	                                    false, (new RegExp('[h-z]+')).test(RegExp.input));
 
 	function test()
 	{
diff --git a/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input_as_array.js b/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input_as_array.js
index a1ed113..9afdb14 100644
--- a/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input_as_array.js
+++ b/Source/JavaScriptCore/tests/mozilla/js1_2/regexp/RegExp_input_as_array.js
@@ -50,40 +50,40 @@
 	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /\\d+/.exec('2345')",
 	                                    String(["2345"]), String(/\d+/.exec('2345')));
 
-    // RegExp['$_'] = "abcd12357efg"; /\d+/.exec()
+    // RegExp['$_'] = "abcd12357efg"; /\d+/.exec(RegExp.input)
     RegExp['$_'] = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /\\d+/.exec()",
-	                                    String(["12357"]), String(/\d+/.exec()));
+	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /\\d+/.exec(RegExp.input)",
+	                                    String(["12357"]), String(/\d+/.exec(RegExp.input)));
 
-    // RegExp['$_'] = "abcd12357efg"; /[h-z]+/.exec()
+    // RegExp['$_'] = "abcd12357efg"; /[h-z]+/.exec(RegExp.input)
     RegExp['$_'] = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /[h-z]+/.exec()",
-	                                    null, /[h-z]+/.exec());
+	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /[h-z]+/.exec(RegExp.input)",
+	                                    null, /[h-z]+/.exec(RegExp.input));
 
     // RegExp['$_'] = "abcd12357efg"; /\d+/.test('2345')
     RegExp['$_'] = "abcd12357efg";
 	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /\\d+/.test('2345')",
 	                                    true, /\d+/.test('2345'));
 
-    // RegExp['$_'] = "abcd12357efg"; /\d+/.test()
+    // RegExp['$_'] = "abcd12357efg"; /\d+/.test(RegExp.input)
     RegExp['$_'] = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /\\d+/.test()",
-	                                    true, /\d+/.test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /\\d+/.test(RegExp.input)",
+	                                    true, /\d+/.test(RegExp.input));
 
-    // RegExp['$_'] = "abcd12357efg"; /[h-z]+/.test()
+    // RegExp['$_'] = "abcd12357efg"; /[h-z]+/.test(RegExp.input)
     RegExp['$_'] = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /[h-z]+/.test()",
-	                                    false, /[h-z]+/.test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; /[h-z]+/.test(RegExp.input)",
+	                                    false, /[h-z]+/.test(RegExp.input));
 
-    // RegExp['$_'] = "abcd12357efg"; (new RegExp('\d+')).test()
+    // RegExp['$_'] = "abcd12357efg"; (new RegExp('\d+')).test(RegExp.input)
     RegExp['$_'] = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; (new RegExp('\d+')).test()",
-	                                    true, (new RegExp('\d+')).test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; (new RegExp('\d+')).test(RegExp.input)",
+	                                    true, (new RegExp('\d+')).test(RegExp.input));
 
-    // RegExp['$_'] = "abcd12357efg"; (new RegExp('[h-z]+')).test()
+    // RegExp['$_'] = "abcd12357efg"; (new RegExp('[h-z]+')).test(RegExp.input)
     RegExp['$_'] = "abcd12357efg";
-	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; (new RegExp('[h-z]+')).test()",
-	                                    false, (new RegExp('[h-z]+')).test());
+	testcases[count++] = new TestCase ( SECTION, "RegExp['$_'] = 'abcd12357efg'; (new RegExp('[h-z]+')).test(RegExp.input)",
+	                                    false, (new RegExp('[h-z]+')).test(RegExp.input));
 
 	function test()
 	{
diff --git a/Source/JavaScriptCore/wscript b/Source/JavaScriptCore/wscript
index 8e27304..88d3b68 100644
--- a/Source/JavaScriptCore/wscript
+++ b/Source/JavaScriptCore/wscript
@@ -38,8 +38,8 @@ jscore_excludes.extend(get_excludes(jscore_dir, ['*None.cpp']))
 
 if build_port == "wx":
     if building_on_win32:
-        jscore_excludes += ['MarkStackPosix.cpp', 'ThreadingPthreads.cpp']
-        sources += ['runtime/MarkStackWin.cpp']
+        jscore_excludes += ['MarkStackPosix.cpp', 'OSAllocatorPosix.cpp', 'ThreadingPthreads.cpp']
+        sources += ['heap/MarkStackWin.cpp']
     else:
         jscore_excludes.append('JSStringRefBSTR.cpp')
         jscore_excludes.extend(get_excludes(jscore_dir, ['*Win.cpp']))
diff --git a/Source/JavaScriptCore/runtime/JSNumberCell.cpp b/Source/JavaScriptCore/wtf/Alignment.h
index 6fa6b2a..2541e01 100644
--- a/Source/JavaScriptCore/runtime/JSNumberCell.cpp
+++ b/Source/JavaScriptCore/wtf/Alignment.h
@@ -1,7 +1,5 @@
 /*
- *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
- *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2004, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -20,19 +18,19 @@
  *
  */
 
-#include "config.h"
-#include "JSNumberCell.h"
+#ifndef WTF_Alignment_h
+#define WTF_Alignment_h
 
-// Keep our exported symbols lists happy.
-namespace JSC {
+#include <wtf/Platform.h>
 
-JSValue jsNumberCell(ExecState*, double);
-
-JSValue jsNumberCell(ExecState*, double)
-{
-    ASSERT_NOT_REACHED();
-    return JSValue();
-}
-
-} // namespace JSC
+#if COMPILER(GCC) || COMPILER(MINGW) || COMPILER(RVCT) || COMPILER(WINSCW)
+    #define WTF_ALIGN_OF(type) __alignof__(type)
+    #define WTF_ALIGNED(variable_type, variable, n) variable_type variable __attribute__((__aligned__(n)))
+#elif COMPILER(MSVC)
+    #define WTF_ALIGN_OF(type) __alignof(type)
+    #define WTF_ALIGNED(variable_type, variable, n) __declspec(align(n)) variable_type variable
+#else
+    #error WTF_ALIGN macros need alignment control.
+#endif
 
+#endif // WTF_Alignment_h
diff --git a/Source/JavaScriptCore/wtf/Assertions.cpp b/Source/JavaScriptCore/wtf/Assertions.cpp
index cdde180..930368c 100644
--- a/Source/JavaScriptCore/wtf/Assertions.cpp
+++ b/Source/JavaScriptCore/wtf/Assertions.cpp
@@ -24,6 +24,12 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+// The vprintf_stderr_common function triggers this error in the Mac build.
+// Feel free to remove this pragma if this file builds on Mac.
+// According to http://gcc.gnu.org/onlinedocs/gcc-4.2.1/gcc/Diagnostic-Pragmas.html#Diagnostic-Pragmas
+// we need to place this directive before any data or functions are defined.
+#pragma GCC diagnostic ignored "-Wmissing-format-attribute"
+
 #include "config.h"
 #include "Assertions.h"
 
@@ -209,7 +215,7 @@ void WTFReportArgumentAssertionFailure(const char* file, int line, const char* f
 
 void WTFReportBacktrace()
 {
-#if PLATFORM(MAC) && !defined(NDEBUG)
+#if PLATFORM(MAC)
     static const int maxFrames = 32;
     void* samples[maxFrames];
     int frames = backtrace(samples, maxFrames);
@@ -225,12 +231,12 @@ void WTFReportBacktrace()
             // Assume c++ & try to demangle the name.
             char* demangledName = abi::__cxa_demangle(mangledName, 0, 0, 0);
             if (demangledName) {
-                fprintf(stderr, " -> %s\n", demangledName);
+                fprintf(stderr, "%-3d %s\n", i, demangledName);
                 free(demangledName);
             } else
-                fprintf(stderr, " -> %s\n", mangledName);
+                fprintf(stderr, "%-3d %s\n", i, mangledName);
         } else
-            fprintf(stderr, " -> %p\n", pointer);
+            fprintf(stderr, "%-3d %p\n", i, pointer);
     }
 #endif
 }
diff --git a/Source/JavaScriptCore/wtf/Assertions.h b/Source/JavaScriptCore/wtf/Assertions.h
index 13ece31..72f8d36 100644
--- a/Source/JavaScriptCore/wtf/Assertions.h
+++ b/Source/JavaScriptCore/wtf/Assertions.h
@@ -73,6 +73,10 @@
 #define HAVE_VARIADIC_MACRO 1
 #endif
 
+#ifndef BACKTRACE_DISABLED
+#define BACKTRACE_DISABLED ASSERTIONS_DISABLED_DEFAULT
+#endif
+
 #ifndef ASSERT_DISABLED
 #define ASSERT_DISABLED ASSERTIONS_DISABLED_DEFAULT
 #endif
@@ -142,14 +146,14 @@ typedef struct {
     WTFLogChannelState state;
 } WTFLogChannel;
 
-void WTFReportAssertionFailure(const char* file, int line, const char* function, const char* assertion);
-void WTFReportAssertionFailureWithMessage(const char* file, int line, const char* function, const char* assertion, const char* format, ...) WTF_ATTRIBUTE_PRINTF(5, 6);
-void WTFReportArgumentAssertionFailure(const char* file, int line, const char* function, const char* argName, const char* assertion);
-void WTFReportBacktrace();
-void WTFReportFatalError(const char* file, int line, const char* function, const char* format, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
-void WTFReportError(const char* file, int line, const char* function, const char* format, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
-void WTFLog(WTFLogChannel* channel, const char* format, ...) WTF_ATTRIBUTE_PRINTF(2, 3);
-void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChannel* channel, const char* format, ...) WTF_ATTRIBUTE_PRINTF(5, 6);
+WTF_EXPORT_PRIVATE void WTFReportAssertionFailure(const char* file, int line, const char* function, const char* assertion);
+WTF_EXPORT_PRIVATE void WTFReportAssertionFailureWithMessage(const char* file, int line, const char* function, const char* assertion, const char* format, ...) WTF_ATTRIBUTE_PRINTF(5, 6);
+WTF_EXPORT_PRIVATE void WTFReportArgumentAssertionFailure(const char* file, int line, const char* function, const char* argName, const char* assertion);
+WTF_EXPORT_PRIVATE void WTFReportBacktrace();
+WTF_EXPORT_PRIVATE void WTFReportFatalError(const char* file, int line, const char* function, const char* format, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
+WTF_EXPORT_PRIVATE void WTFReportError(const char* file, int line, const char* function, const char* format, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
+WTF_EXPORT_PRIVATE void WTFLog(WTFLogChannel*, const char* format, ...) WTF_ATTRIBUTE_PRINTF(2, 3);
+WTF_EXPORT_PRIVATE void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChannel*, const char* format, ...) WTF_ATTRIBUTE_PRINTF(5, 6);
 
 #ifdef __cplusplus
 }
@@ -188,10 +192,17 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 
   Print a backtrace to the same location as ASSERT messages.
 */
-#ifndef BACKTRACE
+
+#if BACKTRACE_DISABLED
+
+#define BACKTRACE() ((void)0)
+
+#else
+
 #define BACKTRACE() do { \
     WTFReportBacktrace(); \
 } while(false)
+
 #endif
 
 /* ASSERT, ASSERT_NOT_REACHED, ASSERT_UNUSED
diff --git a/Source/JavaScriptCore/wtf/Atomics.h b/Source/JavaScriptCore/wtf/Atomics.h
index 1d190a3..1ebd487 100644
--- a/Source/JavaScriptCore/wtf/Atomics.h
+++ b/Source/JavaScriptCore/wtf/Atomics.h
@@ -78,7 +78,7 @@
 namespace WTF {
 
 #if OS(WINDOWS)
-#define WTF_USE_LOCKFREE_THREADSAFESHARED 1
+#define WTF_USE_LOCKFREE_THREADSAFEREFCOUNTED 1
 
 #if COMPILER(MINGW) || COMPILER(MSVC7_OR_LOWER) || OS(WINCE)
 inline int atomicIncrement(int* addend) { return InterlockedIncrement(reinterpret_cast<long*>(addend)); }
@@ -89,7 +89,7 @@ inline int atomicDecrement(int volatile* addend) { return InterlockedDecrement(r
 #endif
 
 #elif OS(DARWIN)
-#define WTF_USE_LOCKFREE_THREADSAFESHARED 1
+#define WTF_USE_LOCKFREE_THREADSAFEREFCOUNTED 1
 
 inline int atomicIncrement(int volatile* addend) { return OSAtomicIncrement32Barrier(const_cast<int*>(addend)); }
 inline int atomicDecrement(int volatile* addend) { return OSAtomicDecrement32Barrier(const_cast<int*>(addend)); }
@@ -100,7 +100,7 @@ inline int atomicIncrement(int volatile* addend) { return android_atomic_inc(add
 inline int atomicDecrement(int volatile* addend) { return android_atomic_dec(addend); }
 
 #elif COMPILER(GCC) && !CPU(SPARC64) && !OS(SYMBIAN) // sizeof(_Atomic_word) != sizeof(int) on sparc64 gcc
-#define WTF_USE_LOCKFREE_THREADSAFESHARED 1
+#define WTF_USE_LOCKFREE_THREADSAFEREFCOUNTED 1
 
 inline int atomicIncrement(int volatile* addend) { return __gnu_cxx::__exchange_and_add(addend, 1) + 1; }
 inline int atomicDecrement(int volatile* addend) { return __gnu_cxx::__exchange_and_add(addend, -1) - 1; }
@@ -109,7 +109,7 @@ inline int atomicDecrement(int volatile* addend) { return __gnu_cxx::__exchange_
 
 } // namespace WTF
 
-#if USE(LOCKFREE_THREADSAFESHARED)
+#if USE(LOCKFREE_THREADSAFEREFCOUNTED)
 using WTF::atomicDecrement;
 using WTF::atomicIncrement;
 #endif
diff --git a/Source/JavaScriptCore/wtf/Bitmap.h b/Source/JavaScriptCore/wtf/Bitmap.h
index b046b61..9ee7f4a 100644
--- a/Source/JavaScriptCore/wtf/Bitmap.h
+++ b/Source/JavaScriptCore/wtf/Bitmap.h
@@ -40,6 +40,7 @@ public:
     size_t nextPossiblyUnset(size_t) const;
     void clear(size_t);
     void clearAll();
+    int64_t findRunOfZeros(size_t) const;
     size_t count(size_t = 0) const;
     size_t isEmpty() const;
     size_t isFull() const;
@@ -107,6 +108,26 @@ inline size_t Bitmap<size>::nextPossiblyUnset(size_t start) const
 }
 
 template<size_t size>
+inline int64_t Bitmap<size>::findRunOfZeros(size_t runLength) const
+{
+    if (!runLength) 
+        runLength = 1; 
+     
+    for (size_t i = 0; i <= (size - runLength) ; i++) {
+        bool found = true; 
+        for (size_t j = i; j <= (i + runLength - 1) ; j++) { 
+            if (get(j)) {
+                found = false; 
+                break;
+            }
+        }
+        if (found)  
+            return i; 
+    }
+    return -1;
+}
+
+template<size_t size>
 inline size_t Bitmap<size>::count(size_t start) const
 {
     size_t result = 0;
diff --git a/Source/JavaScriptCore/wtf/BlockStack.h b/Source/JavaScriptCore/wtf/BlockStack.h
new file mode 100644
index 0000000..a4d7425
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/BlockStack.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BlockStack_h
+#define BlockStack_h
+
+#include <wtf/Assertions.h>
+#include <wtf/Vector.h>
+
+namespace WTF {
+
+template <typename T> class BlockStack {
+public:
+    static const size_t blockSize = 4096;
+    static const size_t blockLength = blockSize / sizeof(T);
+
+    BlockStack();
+    ~BlockStack();
+
+    T* grow();
+    void shrink(T*);
+
+    const Vector<T*>& blocks();
+
+private:
+    Vector<T*> m_blocks;
+    T* m_spareBlock; // Used to avoid thrash at block boundaries.
+};
+
+template <typename T> BlockStack<T>::BlockStack()
+    : m_spareBlock(0)
+{
+}
+
+template <typename T> BlockStack<T>::~BlockStack()
+{
+    if (m_spareBlock)
+        free(m_spareBlock);
+    for (size_t i = 0; i < m_blocks.size(); ++i)
+        free(m_blocks[i]);
+}
+
+template <typename T> inline const Vector<T*>& BlockStack<T>::blocks()
+{
+    return m_blocks;
+}
+
+template <typename T> T* BlockStack<T>::grow()
+{
+    T* block = m_spareBlock ? m_spareBlock : static_cast<T*>(malloc(blockSize));
+    m_spareBlock = 0;
+
+    m_blocks.append(block);
+    return block;
+}
+
+template <typename T> void BlockStack<T>::shrink(T* newEnd)
+{
+    ASSERT(newEnd != m_blocks.last() + blockLength);
+    m_spareBlock = m_blocks.last();
+    m_blocks.removeLast();
+
+    while (m_blocks.last() + blockLength != newEnd) {
+        free(m_blocks.last());
+        m_blocks.removeLast();
+    }
+}
+
+}
+
+using WTF::BlockStack;
+
+#endif
diff --git a/Source/JavaScriptCore/wtf/CMakeLists.txt b/Source/JavaScriptCore/wtf/CMakeLists.txt
index f85bf02..97aad2d 100644
--- a/Source/JavaScriptCore/wtf/CMakeLists.txt
+++ b/Source/JavaScriptCore/wtf/CMakeLists.txt
@@ -1,6 +1,7 @@
 SET(WTF_HEADERS
     ASCIICType.h
     AVLTree.h
+    Alignment.h
     AlwaysInline.h
     Assertions.h
     Atomics.h
@@ -16,6 +17,8 @@ SET(WTF_HEADERS
     Decoder.h
     Deque.h
     DisallowCType.h
+    DoublyLinkedList.h
+    DynamicAnnotations.h
     Encoder.h
     FastAllocBase.h
     FastMalloc.h
@@ -29,6 +32,7 @@ SET(WTF_HEADERS
     HashSet.h
     HashTable.h
     HashTraits.h
+    HexNumber.h
     ListHashSet.h
     ListRefPtr.h
     Locker.h
@@ -64,6 +68,7 @@ SET(WTF_HEADERS
     RefPtrHashMap.h
     RetainPtr.h
     SegmentedVector.h
+    SHA1.h
     StackBounds.h
     StaticConstructors.h
     StdLibExtras.h
@@ -74,7 +79,7 @@ SET(WTF_HEADERS
     TCSpinLock.h
     TCSystemAlloc.h
     ThreadIdentifierDataPthreads.h
-    ThreadSafeShared.h
+    ThreadSafeRefCounted.h
     ThreadSpecific.h
     Threading.h
     ThreadingPrimitives.h
@@ -108,6 +113,7 @@ SET(WTF_SOURCES
     CryptographicallyRandomNumber.cpp
     CurrentTime.cpp
     DecimalNumber.cpp
+    DynamicAnnotations.cpp
     FastMalloc.cpp
     HashTable.cpp
     MainThread.cpp
@@ -115,6 +121,7 @@ SET(WTF_SOURCES
     OSRandomSource.cpp
     RandomNumber.cpp
     RefCountedLeakCounter.cpp
+    SHA1.cpp
     StackBounds.cpp
     StringExtras.cpp
     Threading.cpp
diff --git a/Source/JavaScriptCore/wtf/CrossThreadRefCounted.h b/Source/JavaScriptCore/wtf/CrossThreadRefCounted.h
index 8b65977..9d093ee 100644
--- a/Source/JavaScriptCore/wtf/CrossThreadRefCounted.h
+++ b/Source/JavaScriptCore/wtf/CrossThreadRefCounted.h
@@ -38,10 +38,10 @@
 
 namespace WTF {
 
-    // Used to allowing sharing data across classes and threads (like ThreadedSafeShared).
+    // Used to allowing sharing data across classes and threads (like ThreadSafeRefCounted).
     //
-    // Why not just use ThreadSafeShared?
-    // ThreadSafeShared can have a significant perf impact when used in low level classes
+    // Why not just use ThreadSafeRefCounted?
+    // ThreadSafeRefCounted can have a significant perf impact when used in low level classes
     // (like UString) that get ref/deref'ed a lot. This class has the benefit of doing fast ref
     // counts like RefPtr whenever possible, but it has the downside that you need to copy it
     // to use it on another thread.
@@ -72,7 +72,7 @@ namespace WTF {
         }
 
     private:
-        CrossThreadRefCounted(T* data, ThreadSafeSharedBase* threadedCounter)
+        CrossThreadRefCounted(T* data, ThreadSafeRefCountedBase* threadedCounter)
             : m_threadSafeRefCounter(threadedCounter)
             , m_data(data)
 #ifndef NDEBUG
@@ -97,7 +97,7 @@ namespace WTF {
 #endif
 
         RefCountedBase m_refCounter;
-        ThreadSafeSharedBase* m_threadSafeRefCounter;
+        ThreadSafeRefCountedBase* m_threadSafeRefCounter;
         T* m_data;
 #ifndef NDEBUG
         ThreadIdentifier m_threadId;
@@ -154,7 +154,7 @@ namespace WTF {
         if (m_threadSafeRefCounter)
             m_threadSafeRefCounter->ref();
         else
-            m_threadSafeRefCounter = new ThreadSafeSharedBase(2);
+            m_threadSafeRefCounter = new ThreadSafeRefCountedBase(2);
 
         return adoptRef(new CrossThreadRefCounted<T>(m_data, m_threadSafeRefCounter));
     }
diff --git a/Source/JavaScriptCore/wtf/CurrentTime.cpp b/Source/JavaScriptCore/wtf/CurrentTime.cpp
index 56724cb..4205227 100644
--- a/Source/JavaScriptCore/wtf/CurrentTime.cpp
+++ b/Source/JavaScriptCore/wtf/CurrentTime.cpp
@@ -35,7 +35,7 @@
 
 #if OS(WINDOWS)
 
-// Windows is first since we want to use hires timers, despite PLATFORM(CF)
+// Windows is first since we want to use hires timers, despite USE(CF)
 // being defined.
 // If defined, WIN32_LEAN_AND_MEAN disables timeBeginPeriod/timeEndPeriod.
 #undef WIN32_LEAN_AND_MEAN
diff --git a/Source/JavaScriptCore/wtf/DateMath.cpp b/Source/JavaScriptCore/wtf/DateMath.cpp
index 8873352..70c0cf4 100644
--- a/Source/JavaScriptCore/wtf/DateMath.cpp
+++ b/Source/JavaScriptCore/wtf/DateMath.cpp
@@ -75,7 +75,13 @@
 #include "Assertions.h"
 #include "ASCIICType.h"
 #include "CurrentTime.h"
+#if USE(JSC)
+#include "JSObject.h"
+#endif
 #include "MathExtras.h"
+#if USE(JSC)
+#include "ScopeChain.h"
+#endif
 #include "StdLibExtras.h"
 #include "StringExtras.h"
 
@@ -920,6 +926,16 @@ static double parseDateFromNullTerminatedCharacters(const char* dateString, bool
             }
         }
     }
+    
+    // The year may be after the time but before the time zone, but don't
+    // confuse a time zone specificed as an offset from UTC (e.g. +0100) with a
+    // four-digit year.
+    if (year <= 0 && *dateString != '+' && *dateString != '-') {
+       if (!parseLong(dateString, &newPosStr, 10, &year))
+          year = 0;
+       dateString = newPosStr;
+       skipSpacesAndComments(dateString);
+    }
 
     // Don't fail if the time zone is missing. 
     // Some websites omit the time zone (4275206).
diff --git a/Source/JavaScriptCore/wtf/Deque.h b/Source/JavaScriptCore/wtf/Deque.h
index 1b16afc..8ae46e9 100644
--- a/Source/JavaScriptCore/wtf/Deque.h
+++ b/Source/JavaScriptCore/wtf/Deque.h
@@ -37,27 +37,27 @@
 
 namespace WTF {
 
-    template<typename T> class DequeIteratorBase;
-    template<typename T> class DequeIterator;
-    template<typename T> class DequeConstIterator;
-    template<typename T> class DequeReverseIterator;
-    template<typename T> class DequeConstReverseIterator;
+    template<typename T, size_t inlineCapacity> class DequeIteratorBase;
+    template<typename T, size_t inlineCapacity> class DequeIterator;
+    template<typename T, size_t inlineCapacity> class DequeConstIterator;
+    template<typename T, size_t inlineCapacity> class DequeReverseIterator;
+    template<typename T, size_t inlineCapacity> class DequeConstReverseIterator;
 
-    template<typename T>
+    template<typename T, size_t inlineCapacity = 0>
     class Deque {
         WTF_MAKE_FAST_ALLOCATED;
     public:
-        typedef DequeIterator<T> iterator;
-        typedef DequeConstIterator<T> const_iterator;
-        typedef DequeReverseIterator<T> reverse_iterator;
-        typedef DequeConstReverseIterator<T> const_reverse_iterator;
+        typedef DequeIterator<T, inlineCapacity> iterator;
+        typedef DequeConstIterator<T, inlineCapacity> const_iterator;
+        typedef DequeReverseIterator<T, inlineCapacity> reverse_iterator;
+        typedef DequeConstReverseIterator<T, inlineCapacity> const_reverse_iterator;
 
         Deque();
-        Deque(const Deque<T>&);
-        Deque& operator=(const Deque<T>&);
+        Deque(const Deque<T, inlineCapacity>&);
+        Deque& operator=(const Deque<T, inlineCapacity>&);
         ~Deque();
 
-        void swap(Deque<T>&);
+        void swap(Deque<T, inlineCapacity>&);
 
         size_t size() const { return m_start <= m_end ? m_end - m_start : m_end + m_buffer.capacity() - m_start; }
         bool isEmpty() const { return m_start == m_end; }
@@ -87,11 +87,11 @@ namespace WTF {
         iterator findIf(Predicate&);
 
     private:
-        friend class DequeIteratorBase<T>;
+        friend class DequeIteratorBase<T, inlineCapacity>;
 
-        typedef VectorBuffer<T, 0> Buffer;
+        typedef VectorBuffer<T, inlineCapacity> Buffer;
         typedef VectorTypeOperations<T> TypeOperations;
-        typedef DequeIteratorBase<T> IteratorBase;
+        typedef DequeIteratorBase<T, inlineCapacity> IteratorBase;
 
         void remove(size_t position);
         void invalidateIterators();
@@ -109,14 +109,14 @@ namespace WTF {
 #endif
     };
 
-    template<typename T>
+    template<typename T, size_t inlineCapacity = 0>
     class DequeIteratorBase {
     private:
-        typedef DequeIteratorBase<T> Base;
+        typedef DequeIteratorBase<T, inlineCapacity> Base;
 
     protected:
         DequeIteratorBase();
-        DequeIteratorBase(const Deque<T>*, size_t);
+        DequeIteratorBase(const Deque<T, inlineCapacity>*, size_t);
         DequeIteratorBase(const Base&);
         Base& operator=(const Base&);
         ~DequeIteratorBase();
@@ -137,10 +137,10 @@ namespace WTF {
         void checkValidity() const;
         void checkValidity(const Base&) const;
 
-        Deque<T>* m_deque;
+        Deque<T, inlineCapacity>* m_deque;
         size_t m_index;
 
-        friend class Deque<T>;
+        friend class Deque<T, inlineCapacity>;
 
 #ifndef NDEBUG
         mutable DequeIteratorBase* m_next;
@@ -148,14 +148,14 @@ namespace WTF {
 #endif
     };
 
-    template<typename T>
-    class DequeIterator : public DequeIteratorBase<T> {
+    template<typename T, size_t inlineCapacity = 0>
+    class DequeIterator : public DequeIteratorBase<T, inlineCapacity> {
     private:
-        typedef DequeIteratorBase<T> Base;
-        typedef DequeIterator<T> Iterator;
+        typedef DequeIteratorBase<T, inlineCapacity> Base;
+        typedef DequeIterator<T, inlineCapacity> Iterator;
 
     public:
-        DequeIterator(Deque<T>* deque, size_t index) : Base(deque, index) { }
+        DequeIterator(Deque<T, inlineCapacity>* deque, size_t index) : Base(deque, index) { }
 
         DequeIterator(const Iterator& other) : Base(other) { }
         DequeIterator& operator=(const Iterator& other) { Base::assign(other); return *this; }
@@ -172,15 +172,15 @@ namespace WTF {
         // postfix -- intentionally omitted
     };
 
-    template<typename T>
-    class DequeConstIterator : public DequeIteratorBase<T> {
+    template<typename T, size_t inlineCapacity = 0>
+    class DequeConstIterator : public DequeIteratorBase<T, inlineCapacity> {
     private:
-        typedef DequeIteratorBase<T> Base;
-        typedef DequeConstIterator<T> Iterator;
-        typedef DequeIterator<T> NonConstIterator;
+        typedef DequeIteratorBase<T, inlineCapacity> Base;
+        typedef DequeConstIterator<T, inlineCapacity> Iterator;
+        typedef DequeIterator<T, inlineCapacity> NonConstIterator;
 
     public:
-        DequeConstIterator(const Deque<T>* deque, size_t index) : Base(deque, index) { }
+        DequeConstIterator(const Deque<T, inlineCapacity>* deque, size_t index) : Base(deque, index) { }
 
         DequeConstIterator(const Iterator& other) : Base(other) { }
         DequeConstIterator(const NonConstIterator& other) : Base(other) { }
@@ -199,14 +199,14 @@ namespace WTF {
         // postfix -- intentionally omitted
     };
 
-    template<typename T>
-    class DequeReverseIterator : public DequeIteratorBase<T> {
+    template<typename T, size_t inlineCapacity = 0>
+    class DequeReverseIterator : public DequeIteratorBase<T, inlineCapacity> {
     private:
-        typedef DequeIteratorBase<T> Base;
-        typedef DequeReverseIterator<T> Iterator;
+        typedef DequeIteratorBase<T, inlineCapacity> Base;
+        typedef DequeReverseIterator<T, inlineCapacity> Iterator;
 
     public:
-        DequeReverseIterator(const Deque<T>* deque, size_t index) : Base(deque, index) { }
+        DequeReverseIterator(const Deque<T, inlineCapacity>* deque, size_t index) : Base(deque, index) { }
 
         DequeReverseIterator(const Iterator& other) : Base(other) { }
         DequeReverseIterator& operator=(const Iterator& other) { Base::assign(other); return *this; }
@@ -223,15 +223,15 @@ namespace WTF {
         // postfix -- intentionally omitted
     };
 
-    template<typename T>
-    class DequeConstReverseIterator : public DequeIteratorBase<T> {
+    template<typename T, size_t inlineCapacity = 0>
+    class DequeConstReverseIterator : public DequeIteratorBase<T, inlineCapacity> {
     private:
-        typedef DequeIteratorBase<T> Base;
-        typedef DequeConstReverseIterator<T> Iterator;
-        typedef DequeReverseIterator<T> NonConstIterator;
+        typedef DequeIteratorBase<T, inlineCapacity> Base;
+        typedef DequeConstReverseIterator<T, inlineCapacity> Iterator;
+        typedef DequeReverseIterator<T, inlineCapacity> NonConstIterator;
 
     public:
-        DequeConstReverseIterator(const Deque<T>* deque, size_t index) : Base(deque, index) { }
+        DequeConstReverseIterator(const Deque<T, inlineCapacity>* deque, size_t index) : Base(deque, index) { }
 
         DequeConstReverseIterator(const Iterator& other) : Base(other) { }
         DequeConstReverseIterator(const NonConstIterator& other) : Base(other) { }
@@ -251,13 +251,17 @@ namespace WTF {
     };
 
 #ifdef NDEBUG
-    template<typename T> inline void Deque<T>::checkValidity() const { }
-    template<typename T> inline void Deque<T>::checkIndexValidity(size_t) const { }
-    template<typename T> inline void Deque<T>::invalidateIterators() { }
+    template<typename T, size_t inlineCapacity> inline void Deque<T, inlineCapacity>::checkValidity() const { }
+    template<typename T, size_t inlineCapacity> inline void Deque<T, inlineCapacity>::checkIndexValidity(size_t) const { }
+    template<typename T, size_t inlineCapacity> inline void Deque<T, inlineCapacity>::invalidateIterators() { }
 #else
-    template<typename T>
-    void Deque<T>::checkValidity() const
+    template<typename T, size_t inlineCapacity>
+    void Deque<T, inlineCapacity>::checkValidity() const
     {
+        // In this implementation a capacity of 1 would confuse append() and
+        // other places that assume the index after capacity - 1 is 0.
+        ASSERT(m_buffer.capacity() != 1);
+
         if (!m_buffer.capacity()) {
             ASSERT(!m_start);
             ASSERT(!m_end);
@@ -267,8 +271,8 @@ namespace WTF {
         }
     }
 
-    template<typename T>
-    void Deque<T>::checkIndexValidity(size_t index) const
+    template<typename T, size_t inlineCapacity>
+    void Deque<T, inlineCapacity>::checkIndexValidity(size_t index) const
     {
         ASSERT(index <= m_buffer.capacity());
         if (m_start <= m_end) {
@@ -279,8 +283,8 @@ namespace WTF {
         }
     }
 
-    template<typename T>
-    void Deque<T>::invalidateIterators()
+    template<typename T, size_t inlineCapacity>
+    void Deque<T, inlineCapacity>::invalidateIterators()
     {
         IteratorBase* next;
         for (IteratorBase* p = m_iterators; p; p = next) {
@@ -293,8 +297,8 @@ namespace WTF {
     }
 #endif
 
-    template<typename T>
-    inline Deque<T>::Deque()
+    template<typename T, size_t inlineCapacity>
+    inline Deque<T, inlineCapacity>::Deque()
         : m_start(0)
         , m_end(0)
 #ifndef NDEBUG
@@ -304,8 +308,8 @@ namespace WTF {
         checkValidity();
     }
 
-    template<typename T>
-    inline Deque<T>::Deque(const Deque<T>& other)
+    template<typename T, size_t inlineCapacity>
+    inline Deque<T, inlineCapacity>::Deque(const Deque<T, inlineCapacity>& other)
         : m_start(other.m_start)
         , m_end(other.m_end)
         , m_buffer(other.m_buffer.capacity())
@@ -322,25 +326,27 @@ namespace WTF {
         }
     }
 
-    template<typename T>
-    void deleteAllValues(const Deque<T>& collection)
+    template<typename T, size_t inlineCapacity>
+    void deleteAllValues(const Deque<T, inlineCapacity>& collection)
     {
-        typedef typename Deque<T>::const_iterator iterator;
+        typedef typename Deque<T, inlineCapacity>::const_iterator iterator;
         iterator end = collection.end();
         for (iterator it = collection.begin(); it != end; ++it)
             delete *it;
     }
 
-    template<typename T>
-    inline Deque<T>& Deque<T>::operator=(const Deque<T>& other)
+    template<typename T, size_t inlineCapacity>
+    inline Deque<T, inlineCapacity>& Deque<T, inlineCapacity>::operator=(const Deque<T, inlineCapacity>& other)
     {
+        // FIXME: This is inefficient if we're using an inline buffer and T is
+        // expensive to copy since it will copy the buffer twice instead of once.
         Deque<T> copy(other);
         swap(copy);
         return *this;
     }
 
-    template<typename T>
-    inline void Deque<T>::destroyAll()
+    template<typename T, size_t inlineCapacity>
+    inline void Deque<T, inlineCapacity>::destroyAll()
     {
         if (m_start <= m_end)
             TypeOperations::destruct(m_buffer.buffer() + m_start, m_buffer.buffer() + m_end);
@@ -350,16 +356,16 @@ namespace WTF {
         }
     }
 
-    template<typename T>
-    inline Deque<T>::~Deque()
+    template<typename T, size_t inlineCapacity>
+    inline Deque<T, inlineCapacity>::~Deque()
     {
         checkValidity();
         invalidateIterators();
         destroyAll();
     }
 
-    template<typename T>
-    inline void Deque<T>::swap(Deque<T>& other)
+    template<typename T, size_t inlineCapacity>
+    inline void Deque<T, inlineCapacity>::swap(Deque<T, inlineCapacity>& other)
     {
         checkValidity();
         other.checkValidity();
@@ -371,8 +377,8 @@ namespace WTF {
         other.checkValidity();
     }
 
-    template<typename T>
-    inline void Deque<T>::clear()
+    template<typename T, size_t inlineCapacity>
+    inline void Deque<T, inlineCapacity>::clear()
     {
         checkValidity();
         invalidateIterators();
@@ -382,9 +388,9 @@ namespace WTF {
         checkValidity();
     }
 
-    template<typename T>
+    template<typename T, size_t inlineCapacity>
     template<typename Predicate>
-    inline DequeIterator<T> Deque<T>::findIf(Predicate& predicate)
+    inline DequeIterator<T, inlineCapacity> Deque<T, inlineCapacity>::findIf(Predicate& predicate)
     {
         iterator end_iterator = end();
         for (iterator it = begin(); it != end_iterator; ++it) {
@@ -394,8 +400,8 @@ namespace WTF {
         return end_iterator;
     }
 
-    template<typename T>
-    inline void Deque<T>::expandCapacityIfNeeded()
+    template<typename T, size_t inlineCapacity>
+    inline void Deque<T, inlineCapacity>::expandCapacityIfNeeded()
     {
         if (m_start) {
             if (m_end + 1 != m_start)
@@ -409,8 +415,8 @@ namespace WTF {
         expandCapacity();
     }
 
-    template<typename T>
-    void Deque<T>::expandCapacity()
+    template<typename T, size_t inlineCapacity>
+    void Deque<T, inlineCapacity>::expandCapacity()
     {
         checkValidity();
         size_t oldCapacity = m_buffer.capacity();
@@ -429,16 +435,16 @@ namespace WTF {
         checkValidity();
     }
 
-    template<typename T>
-    inline T Deque<T>::takeFirst()
+    template<typename T, size_t inlineCapacity>
+    inline T Deque<T, inlineCapacity>::takeFirst()
     {
         T oldFirst = first();
         removeFirst();
         return oldFirst;
     }
 
-    template<typename T> template<typename U>
-    inline void Deque<T>::append(const U& value)
+    template<typename T, size_t inlineCapacity> template<typename U>
+    inline void Deque<T, inlineCapacity>::append(const U& value)
     {
         checkValidity();
         expandCapacityIfNeeded();
@@ -450,8 +456,8 @@ namespace WTF {
         checkValidity();
     }
 
-    template<typename T> template<typename U>
-    inline void Deque<T>::prepend(const U& value)
+    template<typename T, size_t inlineCapacity> template<typename U>
+    inline void Deque<T, inlineCapacity>::prepend(const U& value)
     {
         checkValidity();
         expandCapacityIfNeeded();
@@ -463,8 +469,8 @@ namespace WTF {
         checkValidity();
     }
 
-    template<typename T>
-    inline void Deque<T>::removeFirst()
+    template<typename T, size_t inlineCapacity>
+    inline void Deque<T, inlineCapacity>::removeFirst()
     {
         checkValidity();
         invalidateIterators();
@@ -477,22 +483,22 @@ namespace WTF {
         checkValidity();
     }
 
-    template<typename T>
-    inline void Deque<T>::remove(iterator& it)
+    template<typename T, size_t inlineCapacity>
+    inline void Deque<T, inlineCapacity>::remove(iterator& it)
     {
         it.checkValidity();
         remove(it.m_index);
     }
 
-    template<typename T>
-    inline void Deque<T>::remove(const_iterator& it)
+    template<typename T, size_t inlineCapacity>
+    inline void Deque<T, inlineCapacity>::remove(const_iterator& it)
     {
         it.checkValidity();
         remove(it.m_index);
     }
 
-    template<typename T>
-    inline void Deque<T>::remove(size_t position)
+    template<typename T, size_t inlineCapacity>
+    inline void Deque<T, inlineCapacity>::remove(size_t position)
     {
         if (position == m_end)
             return;
@@ -515,28 +521,28 @@ namespace WTF {
     }
 
 #ifdef NDEBUG
-    template<typename T> inline void DequeIteratorBase<T>::checkValidity() const { }
-    template<typename T> inline void DequeIteratorBase<T>::checkValidity(const DequeIteratorBase<T>&) const { }
-    template<typename T> inline void DequeIteratorBase<T>::addToIteratorsList() { }
-    template<typename T> inline void DequeIteratorBase<T>::removeFromIteratorsList() { }
+    template<typename T, size_t inlineCapacity> inline void DequeIteratorBase<T, inlineCapacity>::checkValidity() const { }
+    template<typename T, size_t inlineCapacity> inline void DequeIteratorBase<T, inlineCapacity>::checkValidity(const DequeIteratorBase<T, inlineCapacity>&) const { }
+    template<typename T, size_t inlineCapacity> inline void DequeIteratorBase<T, inlineCapacity>::addToIteratorsList() { }
+    template<typename T, size_t inlineCapacity> inline void DequeIteratorBase<T, inlineCapacity>::removeFromIteratorsList() { }
 #else
-    template<typename T>
-    void DequeIteratorBase<T>::checkValidity() const
+    template<typename T, size_t inlineCapacity>
+    void DequeIteratorBase<T, inlineCapacity>::checkValidity() const
     {
         ASSERT(m_deque);
         m_deque->checkIndexValidity(m_index);
     }
 
-    template<typename T>
-    void DequeIteratorBase<T>::checkValidity(const Base& other) const
+    template<typename T, size_t inlineCapacity>
+    void DequeIteratorBase<T, inlineCapacity>::checkValidity(const Base& other) const
     {
         checkValidity();
         other.checkValidity();
         ASSERT(m_deque == other.m_deque);
     }
 
-    template<typename T>
-    void DequeIteratorBase<T>::addToIteratorsList()
+    template<typename T, size_t inlineCapacity>
+    void DequeIteratorBase<T, inlineCapacity>::addToIteratorsList()
     {
         if (!m_deque)
             m_next = 0;
@@ -549,8 +555,8 @@ namespace WTF {
         m_previous = 0;
     }
 
-    template<typename T>
-    void DequeIteratorBase<T>::removeFromIteratorsList()
+    template<typename T, size_t inlineCapacity>
+    void DequeIteratorBase<T, inlineCapacity>::removeFromIteratorsList()
     {
         if (!m_deque) {
             ASSERT(!m_next);
@@ -574,23 +580,23 @@ namespace WTF {
     }
 #endif
 
-    template<typename T>
-    inline DequeIteratorBase<T>::DequeIteratorBase()
+    template<typename T, size_t inlineCapacity>
+    inline DequeIteratorBase<T, inlineCapacity>::DequeIteratorBase()
         : m_deque(0)
     {
     }
 
-    template<typename T>
-    inline DequeIteratorBase<T>::DequeIteratorBase(const Deque<T>* deque, size_t index)
-        : m_deque(const_cast<Deque<T>*>(deque))
+    template<typename T, size_t inlineCapacity>
+    inline DequeIteratorBase<T, inlineCapacity>::DequeIteratorBase(const Deque<T, inlineCapacity>* deque, size_t index)
+        : m_deque(const_cast<Deque<T, inlineCapacity>*>(deque))
         , m_index(index)
     {
         addToIteratorsList();
         checkValidity();
     }
 
-    template<typename T>
-    inline DequeIteratorBase<T>::DequeIteratorBase(const Base& other)
+    template<typename T, size_t inlineCapacity>
+    inline DequeIteratorBase<T, inlineCapacity>::DequeIteratorBase(const Base& other)
         : m_deque(other.m_deque)
         , m_index(other.m_index)
     {
@@ -598,8 +604,8 @@ namespace WTF {
         checkValidity();
     }
 
-    template<typename T>
-    inline DequeIteratorBase<T>& DequeIteratorBase<T>::operator=(const Base& other)
+    template<typename T, size_t inlineCapacity>
+    inline DequeIteratorBase<T, inlineCapacity>& DequeIteratorBase<T, inlineCapacity>::operator=(const Base& other)
     {
         checkValidity();
         other.checkValidity();
@@ -612,8 +618,8 @@ namespace WTF {
         return *this;
     }
 
-    template<typename T>
-    inline DequeIteratorBase<T>::~DequeIteratorBase()
+    template<typename T, size_t inlineCapacity>
+    inline DequeIteratorBase<T, inlineCapacity>::~DequeIteratorBase()
     {
 #ifndef NDEBUG
         removeFromIteratorsList();
@@ -621,15 +627,15 @@ namespace WTF {
 #endif
     }
 
-    template<typename T>
-    inline bool DequeIteratorBase<T>::isEqual(const Base& other) const
+    template<typename T, size_t inlineCapacity>
+    inline bool DequeIteratorBase<T, inlineCapacity>::isEqual(const Base& other) const
     {
         checkValidity(other);
         return m_index == other.m_index;
     }
 
-    template<typename T>
-    inline void DequeIteratorBase<T>::increment()
+    template<typename T, size_t inlineCapacity>
+    inline void DequeIteratorBase<T, inlineCapacity>::increment()
     {
         checkValidity();
         ASSERT(m_index != m_deque->m_end);
@@ -641,8 +647,8 @@ namespace WTF {
         checkValidity();
     }
 
-    template<typename T>
-    inline void DequeIteratorBase<T>::decrement()
+    template<typename T, size_t inlineCapacity>
+    inline void DequeIteratorBase<T, inlineCapacity>::decrement()
     {
         checkValidity();
         ASSERT(m_index != m_deque->m_start);
@@ -654,16 +660,16 @@ namespace WTF {
         checkValidity();
     }
 
-    template<typename T>
-    inline T* DequeIteratorBase<T>::after() const
+    template<typename T, size_t inlineCapacity>
+    inline T* DequeIteratorBase<T, inlineCapacity>::after() const
     {
         checkValidity();
         ASSERT(m_index != m_deque->m_end);
         return &m_deque->m_buffer.buffer()[m_index];
     }
 
-    template<typename T>
-    inline T* DequeIteratorBase<T>::before() const
+    template<typename T, size_t inlineCapacity>
+    inline T* DequeIteratorBase<T, inlineCapacity>::before() const
     {
         checkValidity();
         ASSERT(m_index != m_deque->m_start);
diff --git a/Source/JavaScriptCore/wtf/DoublyLinkedList.h b/Source/JavaScriptCore/wtf/DoublyLinkedList.h
new file mode 100644
index 0000000..9351263
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/DoublyLinkedList.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DoublyLinkedList_h
+#define DoublyLinkedList_h
+
+namespace WTF {
+
+template <typename Node> class DoublyLinkedList {
+public:
+    DoublyLinkedList();
+    
+    bool isEmpty();
+
+    Node* head();
+
+    void append(Node*);
+    void remove(Node*);
+
+private:
+    Node* m_head;
+    Node* m_tail;
+};
+
+template <typename Node> inline DoublyLinkedList<Node>::DoublyLinkedList()
+    : m_head(0)
+    , m_tail(0)
+{
+}
+
+template <typename Node> inline bool DoublyLinkedList<Node>::isEmpty()
+{
+    return !m_head;
+}
+
+template <typename Node> inline Node* DoublyLinkedList<Node>::head()
+{
+    return m_head;
+}
+
+template <typename Node> inline void DoublyLinkedList<Node>::append(Node* node)
+{
+    if (!m_tail) {
+        ASSERT(!m_head);
+        m_head = node;
+        m_tail = node;
+        node->setPrev(0);
+        node->setNext(0);
+        return;
+    }
+
+    ASSERT(m_head);
+    m_tail->setNext(node);
+    node->setPrev(m_tail);
+    node->setNext(0);
+    m_tail = node;
+}
+
+template <typename Node> inline void DoublyLinkedList<Node>::remove(Node* node)
+{
+    if (node->prev()) {
+        ASSERT(node != m_head);
+        node->prev()->setNext(node->next());
+    } else {
+        ASSERT(node == m_head);
+        m_head = node->next();
+    }
+
+    if (node->next()) {
+        ASSERT(node != m_tail);
+        node->next()->setPrev(node->prev());
+    } else {
+        ASSERT(node == m_tail);
+        m_tail = node->prev();
+    }
+}
+
+} // namespace WTF
+
+using WTF::DoublyLinkedList;
+
+#endif
diff --git a/Source/JavaScriptCore/wtf/DynamicAnnotations.cpp b/Source/JavaScriptCore/wtf/DynamicAnnotations.cpp
new file mode 100644
index 0000000..b7d4b41
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/DynamicAnnotations.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "DynamicAnnotations.h"
+
+#if USE(DYNAMIC_ANNOTATIONS)
+void WTFAnnotateBenignRaceSized(const char*, int, const volatile void*, long, const char*) { }
+void WTFAnnotateHappensBefore(const char*, int, const volatile void*) { }
+void WTFAnnotateHappensAfter(const char*, int, const volatile void*) { }
+#endif // USE(DYNAMIC_ANNOTATIONS)
diff --git a/Source/JavaScriptCore/wtf/DynamicAnnotations.h b/Source/JavaScriptCore/wtf/DynamicAnnotations.h
new file mode 100644
index 0000000..38acce3
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/DynamicAnnotations.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WTF_DynamicAnnotations_h
+#define WTF_DynamicAnnotations_h
+
+/* This file defines dynamic annotations for use with dynamic analysis
+ * tool such as ThreadSanitizer, Valgrind, etc.
+ *
+ * Dynamic annotation is a source code annotation that affects
+ * the generated code (that is, the annotation is not a comment).
+ * Each such annotation is attached to a particular
+ * instruction and/or to a particular object (address) in the program.
+ *
+ * By using dynamic annotations a developer can give more details to the dynamic
+ * analysis tool to improve its precision.
+ *
+ * In C/C++ program the annotations are represented as C macros.
+ * With the default build flags, these macros are empty, hence don't affect
+ * performance of a compiled binary.
+ * If dynamic annotations are enabled, they just call no-op functions.
+ * The dynamic analysis tools can intercept these functions and replace them
+ * with their own implementations.
+ *
+ * See http://code.google.com/p/data-race-test/wiki/DynamicAnnotations for more information.
+ */
+
+#if USE(DYNAMIC_ANNOTATIONS)
+/* Tell data race detector that we're not interested in reports on the given address range. */
+#define WTF_ANNOTATE_BENIGN_RACE_SIZED(address, size, description) WTFAnnotateBenignRaceSized(__FILE__, __LINE__, address, size, description)
+#define WTF_ANNOTATE_BENIGN_RACE(pointer, description) WTFAnnotateBenignRaceSized(__FILE__, __LINE__, pointer, sizeof(*(pointer)), description)
+
+/* Annotations for user-defined synchronization mechanisms.
+ * These annotations can be used to define happens-before arcs in user-defined
+ * synchronization mechanisms: the race detector will infer an arc from
+ * the former to the latter when they share the same argument pointer.
+ *
+ * The most common case requiring annotations is atomic reference counting:
+ * bool deref() {
+ *     ANNOTATE_HAPPENS_BEFORE(&m_refCount);
+ *     if (!atomicDecrement(&m_refCount)) {
+ *         // m_refCount is now 0
+ *         ANNOTATE_HAPPENS_AFTER(&m_refCount);
+ *         // "return true; happens-after each atomicDecrement of m_refCount"
+ *         return true;
+ *     }
+ *     return false;
+ * }
+ */
+#define WTF_ANNOTATE_HAPPENS_BEFORE(address) WTFAnnotateHappensBefore(__FILE__, __LINE__, address)
+#define WTF_ANNOTATE_HAPPENS_AFTER(address) WTFAnnotateHappensAfter(__FILE__, __LINE__, address)
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+/* Don't use these directly, use the above macros instead. */
+void WTFAnnotateBenignRaceSized(const char* file, int line, const volatile void* memory, long size, const char* description);
+void WTFAnnotateHappensBefore(const char* file, int line, const volatile void* address);
+void WTFAnnotateHappensAfter(const char* file, int line, const volatile void* address);
+#ifdef __cplusplus
+} // extern "C"
+#endif
+
+#else // USE(DYNAMIC_ANNOTATIONS)
+/* These macros are empty when dynamic annotations are not enabled so you can
+ * use them without affecting the performance of release binaries. */
+#define WTF_ANNOTATE_BENIGN_RACE_SIZED(address, size, description)
+#define WTF_ANNOTATE_BENIGN_RACE(pointer, description)
+#define WTF_ANNOTATE_HAPPENS_BEFORE(address)
+#define WTF_ANNOTATE_HAPPENS_AFTER(address)
+#endif // USE(DYNAMIC_ANNOTATIONS)
+
+#endif // WTF_DynamicAnnotations_h
diff --git a/Source/JavaScriptCore/runtime/MarkStack.cpp b/Source/JavaScriptCore/wtf/ExportMacros.h
index a350c35..3fadd37 100644
--- a/Source/JavaScriptCore/runtime/MarkStack.cpp
+++ b/Source/JavaScriptCore/wtf/ExportMacros.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,10 +10,10 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -21,20 +21,26 @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ * This file handles shared library symbol export decorations. It is recommended
+ * that all WebKit projects use these definitions so that symbol exports work
+ * properly on all platforms and compilers that WebKit builds under.
  */
 
-#include "config.h"
-#include "MarkStack.h"
-
-namespace JSC {
+#ifndef ExportMacros_h
+#define ExportMacros_h
 
-size_t MarkStack::s_pageSize = 0;
+#include "Platform.h"
 
-void MarkStack::compact()
-{
-    ASSERT(s_pageSize);
-    m_values.shrinkAllocation(s_pageSize);
-    m_markSets.shrinkAllocation(s_pageSize);
-}
+#if !PLATFORM(CHROMIUM) && OS(WINDOWS) && !COMPILER(GCC)
+#define WTF_EXPORT __declspec(dllexport)
+#define WTF_IMPORT __declspec(dllimport)
+#elif defined(__GNUC__) && !defined(__CC_ARM) && !defined(__ARMCC__)
+#define WTF_EXPORT __attribute__((visibility("default")))
+#define WTF_IMPORT WTF_EXPORT
+#else
+#define WTF_EXPORT
+#define WTF_IMPORT
+#endif
 
-}
+#endif /* ExportMacros_h */
diff --git a/Source/JavaScriptCore/wtf/FastMalloc.cpp b/Source/JavaScriptCore/wtf/FastMalloc.cpp
index 29e9a1a..95a9aff 100644
--- a/Source/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/Source/JavaScriptCore/wtf/FastMalloc.cpp
@@ -245,7 +245,8 @@ void* fastMalloc(size_t n)
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
     TryMallocReturnValue returnValue = tryFastMalloc(n);
     void* result;
-    returnValue.getValue(result);
+    if (!returnValue.getValue(result))
+        CRASH();
 #else
     void* result = malloc(n);
 #endif
@@ -293,7 +294,8 @@ void* fastCalloc(size_t n_elements, size_t element_size)
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
     TryMallocReturnValue returnValue = tryFastCalloc(n_elements, element_size);
     void* result;
-    returnValue.getValue(result);
+    if (!returnValue.getValue(result))
+        CRASH();
 #else
     void* result = calloc(n_elements, element_size);
 #endif
@@ -362,7 +364,8 @@ void* fastRealloc(void* p, size_t n)
 #if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
     TryMallocReturnValue returnValue = tryFastRealloc(p, n);
     void* result;
-    returnValue.getValue(result);
+    if (!returnValue.getValue(result))
+        CRASH();
 #else
     void* result = realloc(p, n);
 #endif
@@ -1615,10 +1618,10 @@ void TCMalloc_PageHeap::initializeScavenger()
 
 void* TCMalloc_PageHeap::runScavengerThread(void* context)
 {
-  static_cast<TCMalloc_PageHeap*>(context)->scavengerThread();
-#if COMPILER(MSVC)
-  // Without this, Visual Studio will complain that this method does not return a value.
-  return 0;
+    static_cast<TCMalloc_PageHeap*>(context)->scavengerThread();
+#if (COMPILER(MSVC) || COMPILER(SUNCC))
+    // Without this, Visual Studio and Sun Studio will complain that this method does not return a value.
+    return 0;
 #endif
 }
 
diff --git a/Source/JavaScriptCore/wtf/HashTable.h b/Source/JavaScriptCore/wtf/HashTable.h
index 1c4ae6d..c2bc49b 100644
--- a/Source/JavaScriptCore/wtf/HashTable.h
+++ b/Source/JavaScriptCore/wtf/HashTable.h
@@ -259,19 +259,21 @@ namespace WTF {
 
     using std::swap;
 
-#if !COMPILER(MSVC)
-    // Visual C++ has a swap for pairs defined.
+    // Work around MSVC's standard library, whose swap for pairs does not swap by component.
+    template<typename T> inline void hashTableSwap(T& a, T& b)
+    {
+        swap(a, b);
+    }
 
-    // swap pairs by component, in case of pair members that specialize swap
-    template<typename T, typename U> inline void swap(pair<T, U>& a, pair<T, U>& b)
+    // Swap pairs by component, in case of pair members that specialize swap.
+    template<typename T, typename U> inline void hashTableSwap(pair<T, U>& a, pair<T, U>& b)
     {
         swap(a.first, b.first);
         swap(a.second, b.second);
     }
-#endif
 
     template<typename T, bool useSwap> struct Mover;
-    template<typename T> struct Mover<T, true> { static void move(T& from, T& to) { swap(from, to); } };
+    template<typename T> struct Mover<T, true> { static void move(T& from, T& to) { hashTableSwap(from, to); } };
     template<typename T> struct Mover<T, false> { static void move(T& from, T& to) { to = from; } };
 
     template<typename Key, typename Value, typename HashFunctions> class IdentityHashTranslator {
diff --git a/Source/JavaScriptCore/wtf/HashTraits.h b/Source/JavaScriptCore/wtf/HashTraits.h
index c8d40f7..fba5afe 100644
--- a/Source/JavaScriptCore/wtf/HashTraits.h
+++ b/Source/JavaScriptCore/wtf/HashTraits.h
@@ -81,12 +81,14 @@ namespace WTF {
         static bool isDeletedValue(P* value) { return value == reinterpret_cast<P*>(-1); }
     };
 
-    template<typename P> struct HashTraits<RefPtr<P> > : GenericHashTraits<RefPtr<P> > {
+    template<typename T> struct SimpleClassHashTraits : GenericHashTraits<T> {
         static const bool emptyValueIsZero = true;
-        static void constructDeletedValue(RefPtr<P>& slot) { new (&slot) RefPtr<P>(HashTableDeletedValue); }
-        static bool isDeletedValue(const RefPtr<P>& value) { return value.isHashTableDeletedValue(); }
+        static void constructDeletedValue(T& slot) { new (&slot) T(HashTableDeletedValue); }
+        static bool isDeletedValue(const T& value) { return value.isHashTableDeletedValue(); }
     };
 
+    template<typename P> struct HashTraits<RefPtr<P> > : SimpleClassHashTraits<RefPtr<P> > { };
+
     // special traits for pairs, helpful for their use in HashMap implementation
 
     template<typename FirstTraitsArg, typename SecondTraitsArg>
diff --git a/Source/JavaScriptCore/wtf/HexNumber.h b/Source/JavaScriptCore/wtf/HexNumber.h
new file mode 100644
index 0000000..8fd6032
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/HexNumber.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef HexNumber_h
+#define HexNumber_h
+
+#include <wtf/text/StringConcatenate.h>
+
+namespace WTF {
+
+enum HexConversionMode {
+    Lowercase,
+    Uppercase
+};
+
+namespace Internal {
+
+static const char* hexDigitsForMode(HexConversionMode mode)
+{
+    static const char lowerHexDigits[17] = "0123456789abcdef";
+    static const char upperHexDigits[17] = "0123456789ABCDEF";
+    return mode == Lowercase ? lowerHexDigits : upperHexDigits;
+}
+
+}; // namespace Internal
+
+template<typename T>
+inline void appendByteAsHex(unsigned char byte, T& destination, HexConversionMode mode = Uppercase)
+{
+    const char* hexDigits = Internal::hexDigitsForMode(mode);
+    destination.append(hexDigits[byte >> 4]);
+    destination.append(hexDigits[byte & 0xF]);
+}
+
+template<typename T>
+inline void placeByteAsHexCompressIfPossible(unsigned char byte, T& destination, unsigned& index, HexConversionMode mode = Uppercase)
+{
+    const char* hexDigits = Internal::hexDigitsForMode(mode);
+    if (byte >= 0x10)
+        destination[index++] = hexDigits[byte >> 4];
+    destination[index++] = hexDigits[byte & 0xF];
+}
+
+template<typename T>
+inline void placeByteAsHex(unsigned char byte, T& destination, HexConversionMode mode = Uppercase)
+{
+    const char* hexDigits = Internal::hexDigitsForMode(mode);
+    *destination++ = hexDigits[byte >> 4];
+    *destination++ = hexDigits[byte & 0xF];
+}
+
+template<typename T>
+inline void appendUnsignedAsHex(unsigned number, T& destination, HexConversionMode mode = Uppercase)
+{
+    const char* hexDigits = Internal::hexDigitsForMode(mode);
+    Vector<UChar, 8> result;
+    do {
+        result.prepend(hexDigits[number % 16]);
+        number >>= 4;
+    } while (number > 0);
+
+    destination.append(result.data(), result.size());
+}
+
+// Same as appendUnsignedAsHex, but using exactly 'desiredDigits' for the conversion.
+template<typename T>
+inline void appendUnsignedAsHexFixedSize(unsigned number, T& destination, unsigned desiredDigits, HexConversionMode mode = Uppercase)
+{
+    ASSERT(desiredDigits);
+
+    const char* hexDigits = Internal::hexDigitsForMode(mode);
+    Vector<UChar, 8> result;
+    do {
+        result.prepend(hexDigits[number % 16]);
+        number >>= 4;
+    } while (result.size() < desiredDigits);
+
+    ASSERT(result.size() == desiredDigits);
+    destination.append(result.data(), result.size());
+}
+
+} // namespace WTF
+
+using WTF::appendByteAsHex;
+using WTF::appendUnsignedAsHex;
+using WTF::appendUnsignedAsHexFixedSize;
+using WTF::placeByteAsHex;
+using WTF::placeByteAsHexCompressIfPossible;
+using WTF::Lowercase;
+
+#endif // HexNumber_h
diff --git a/Source/JavaScriptCore/wtf/ListHashSet.h b/Source/JavaScriptCore/wtf/ListHashSet.h
index e916ef2..b0d0e43 100644
--- a/Source/JavaScriptCore/wtf/ListHashSet.h
+++ b/Source/JavaScriptCore/wtf/ListHashSet.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, Benjamin Poulain <ikipou@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -90,10 +91,24 @@ namespace WTF {
         const_iterator begin() const;
         const_iterator end() const;
 
+        ValueType& first();
+        const ValueType& first() const;
+
+        ValueType& last();
+        const ValueType& last() const;
+        void removeLast();
+
         iterator find(const ValueType&);
         const_iterator find(const ValueType&) const;
         bool contains(const ValueType&) const;
 
+        // An alternate version of find() that finds the object by hashing and comparing
+        // with some other type, to avoid the cost of type conversion.
+        // The HashTranslator interface is defined in HashSet.
+        template<typename T, typename HashTranslator> iterator find(const T&);
+        template<typename T, typename HashTranslator> const_iterator find(const T&) const;
+        template<typename T, typename HashTranslator> bool contains(const T&) const;
+
         // the return value is a pair of an iterator to the new value's location, 
         // and a bool that is true if an new entry was added
         pair<iterator, bool> add(const ValueType&);
@@ -442,6 +457,42 @@ namespace WTF {
     }
 
     template<typename T, size_t inlineCapacity, typename U>
+    inline T& ListHashSet<T, inlineCapacity, U>::first()
+    {
+        ASSERT(!isEmpty());
+        return m_head->m_value;
+    }
+
+    template<typename T, size_t inlineCapacity, typename U>
+    inline const T& ListHashSet<T, inlineCapacity, U>::first() const
+    {
+        ASSERT(!isEmpty());
+        return m_head->m_value;
+    }
+
+    template<typename T, size_t inlineCapacity, typename U>
+    inline T& ListHashSet<T, inlineCapacity, U>::last()
+    {
+        ASSERT(!isEmpty());
+        return m_tail->m_value;
+    }
+
+    template<typename T, size_t inlineCapacity, typename U>
+    inline const T& ListHashSet<T, inlineCapacity, U>::last() const
+    {
+        ASSERT(!isEmpty());
+        return m_tail->m_value;
+    }
+
+    template<typename T, size_t inlineCapacity, typename U>
+    inline void ListHashSet<T, inlineCapacity, U>::removeLast()
+    {
+        ASSERT(!isEmpty());
+        m_impl.remove(m_tail);
+        unlinkAndDelete(m_tail);
+    }
+
+    template<typename T, size_t inlineCapacity, typename U>
     inline typename ListHashSet<T, inlineCapacity, U>::iterator ListHashSet<T, inlineCapacity, U>::find(const ValueType& value)
     {
         typedef ListHashSetTranslator<ValueType, inlineCapacity, HashFunctions> Translator;
@@ -461,6 +512,45 @@ namespace WTF {
         return makeConstIterator(*it);
     }
 
+    template<typename ValueType, size_t inlineCapacity, typename T, typename Translator>
+    struct ListHashSetTranslatorAdapter {
+    private:
+        typedef ListHashSetNode<ValueType, inlineCapacity> Node;
+    public:
+        static unsigned hash(const T& key) { return Translator::hash(key); }
+        static bool equal(Node* const& a, const T& b) { return Translator::equal(a->m_value, b); }
+    };
+
+    template<typename ValueType, size_t inlineCapacity, typename U>
+    template<typename T, typename HashTranslator>
+    inline typename ListHashSet<ValueType, inlineCapacity, U>::iterator ListHashSet<ValueType, inlineCapacity, U>::find(const T& value)
+    {
+        typedef ListHashSetTranslatorAdapter<ValueType, inlineCapacity, T, HashTranslator> Adapter;
+        ImplTypeConstIterator it = m_impl.template find<T, Adapter>(value);
+        if (it == m_impl.end())
+            return end();
+        return makeIterator(*it);
+    }
+
+    template<typename ValueType, size_t inlineCapacity, typename U>
+    template<typename T, typename HashTranslator>
+    inline typename ListHashSet<ValueType, inlineCapacity, U>::const_iterator ListHashSet<ValueType, inlineCapacity, U>::find(const T& value) const
+    {
+        typedef ListHashSetTranslatorAdapter<ValueType, inlineCapacity, T, HashTranslator> Adapter;
+        ImplTypeConstIterator it = m_impl.template find<T, Adapter>(value);
+        if (it == m_impl.end())
+            return end();
+        return makeConstIterator(*it);
+    }
+
+    template<typename ValueType, size_t inlineCapacity, typename U>
+    template<typename T, typename HashTranslator>
+    inline bool ListHashSet<ValueType, inlineCapacity, U>::contains(const T& value) const
+    {
+        typedef ListHashSetTranslatorAdapter<ValueType, inlineCapacity, T, HashTranslator> Adapter;
+        return m_impl.template contains<T, Adapter>(value);
+    }
+
     template<typename T, size_t inlineCapacity, typename U>
     inline bool ListHashSet<T, inlineCapacity, U>::contains(const ValueType& value) const
     {
diff --git a/Source/JavaScriptCore/wtf/MD5.cpp b/Source/JavaScriptCore/wtf/MD5.cpp
index c926a7b..07bbadd 100644
--- a/Source/JavaScriptCore/wtf/MD5.cpp
+++ b/Source/JavaScriptCore/wtf/MD5.cpp
@@ -203,6 +203,7 @@ static void MD5Transform(uint32_t buf[4], const uint32_t in[16])
 
 MD5::MD5()
 {
+    // FIXME: Move unit tests somewhere outside the constructor. See bug 55853.
     testMD5();
     m_buf[0] = 0x67452301;
     m_buf[1] = 0xefcdab89;
diff --git a/Source/JavaScriptCore/wtf/MathExtras.h b/Source/JavaScriptCore/wtf/MathExtras.h
index ec27f5f..fac187c 100644
--- a/Source/JavaScriptCore/wtf/MathExtras.h
+++ b/Source/JavaScriptCore/wtf/MathExtras.h
@@ -90,7 +90,7 @@ inline bool isfinite(double x) { return finite(x) && !isnand(x); }
 inline bool isinf(double x) { return !finite(x) && !isnand(x); }
 #endif
 #ifndef signbit
-inline bool signbit(double x) { return x < 0.0; } // FIXME: Wrong for negative 0.
+inline bool signbit(double x) { return copysign(1.0, x) < 0; }
 #endif
 
 #endif
@@ -106,7 +106,7 @@ inline bool signbit(double x) { struct ieee_double *p = (struct ieee_double *)&x
 
 #endif
 
-#if COMPILER(MSVC) || COMPILER(RVCT)
+#if COMPILER(MSVC) || (COMPILER(RVCT) && !(RVCT_VERSION_AT_LEAST(3, 0, 0, 0)))
 
 // We must not do 'num + 0.5' or 'num - 0.5' because they can cause precision loss.
 static double round(double num)
@@ -233,7 +233,12 @@ inline int clampToPositiveInteger(float d)
     return static_cast<int>(std::max<float>(std::min(d, maxIntAsFloat), 0));
 }
 
-#if !COMPILER(MSVC) && !COMPILER(WINSCW) && !(COMPILER(RVCT) && (OS(SYMBIAN) || PLATFORM(BREWMP)))
+inline int clampToInteger(unsigned value)
+{
+    return static_cast<int>(std::min(value, static_cast<unsigned>(std::numeric_limits<int>::max())));
+}
+
+#if !COMPILER(MSVC) && !(COMPILER(RVCT) && PLATFORM(BREWMP)) && !OS(SOLARIS) && !OS(SYMBIAN)
 using std::isfinite;
 using std::isinf;
 using std::isnan;
diff --git a/Source/JavaScriptCore/wtf/MessageQueue.h b/Source/JavaScriptCore/wtf/MessageQueue.h
index 7c18a0c..2b774fb 100644
--- a/Source/JavaScriptCore/wtf/MessageQueue.h
+++ b/Source/JavaScriptCore/wtf/MessageQueue.h
@@ -41,7 +41,7 @@ namespace WTF {
     enum MessageQueueWaitResult {
         MessageQueueTerminated,       // Queue was destroyed while waiting for message.
         MessageQueueTimeout,          // Timeout was specified and it expired.
-        MessageQueueMessageReceived,  // A message was successfully received and returned.
+        MessageQueueMessageReceived   // A message was successfully received and returned.
     };
 
     // The queue takes ownership of messages and transfer it to the new owner
diff --git a/Source/JavaScriptCore/wtf/OSAllocator.h b/Source/JavaScriptCore/wtf/OSAllocator.h
index 577a6b8..3fd4cef 100644
--- a/Source/JavaScriptCore/wtf/OSAllocator.h
+++ b/Source/JavaScriptCore/wtf/OSAllocator.h
@@ -77,9 +77,10 @@ inline void* OSAllocator::reserveAndCommit(size_t reserveSize, size_t commitSize
 inline void OSAllocator::decommitAndRelease(void* releaseBase, size_t releaseSize, void* decommitBase, size_t decommitSize)
 {
     ASSERT(decommitBase >= releaseBase && (static_cast<char*>(decommitBase) + decommitSize) <= (static_cast<char*>(releaseBase) + releaseSize));
-#if OS(WINCE)
+#if OS(WINCE) || OS(SYMBIAN)
     // On most platforms we can actually skip this final decommit; releasing the VM will
     // implicitly decommit any physical memory in the region. This is not true on WINCE.
+    // On Symbian, this makes implementation simpler and better aligned with the RChunk API
     decommit(decommitBase, decommitSize);
 #else
     UNUSED_PARAM(decommitBase);
diff --git a/Source/JavaScriptCore/wtf/OSAllocatorSymbian.cpp b/Source/JavaScriptCore/wtf/OSAllocatorSymbian.cpp
index e746fde..c63e609 100644
--- a/Source/JavaScriptCore/wtf/OSAllocatorSymbian.cpp
+++ b/Source/JavaScriptCore/wtf/OSAllocatorSymbian.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies). All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,31 +27,176 @@
 #include "config.h"
 #include "OSAllocator.h"
 
-#include <wtf/FastMalloc.h>
+#include "PageAllocatorSymbian.h"
 
 namespace WTF {
 
-void* OSAllocator::reserveUncommitted(size_t bytes, Usage, bool, bool)
+// Array to store code chunks used by JIT engine(s)
+static RPointerArray<SymbianChunk> codeChunksContainer;
+
+// The singleton data allocator (non code)
+static PageAllocatorSymbian dataAllocator;
+
+_LIT(KErrorStringInternalConsistency, "OSAllocator:ConsistencyError");
+_LIT(KErrorStringChunkCreation, "OSAllocator:ChunkInitError");
+_LIT(KErrorStringPageSize, "OSAllocator:WrongPageSize");
+
+// Makes a new code chunk for a JIT engine with everything in committed state
+static void* allocateCodeChunk(size_t bytes) 
+{
+    RChunk c; 
+    TInt error = c.CreateLocalCode(bytes, bytes);
+    __ASSERT_ALWAYS(error == KErrNone, User::Panic(KErrorStringChunkCreation, error));
+   
+    codeChunksContainer.Append(new SymbianChunk(c.Handle())); 
+    return static_cast<void*>(c.Base()); 
+}
+   
+// Frees the _entire_ code chunk in which this address resides. 
+static bool deallocateCodeChunk(void* address) 
+{     
+    bool found = false; 
+    for (int i = 0; i < codeChunksContainer.Count(); i++) { 
+        SymbianChunk* p = codeChunksContainer[i];
+        if (p && p->contains(address)) { 
+            codeChunksContainer.Remove(i);
+            delete p;
+            found = true;
+        }
+    }
+    return found; 
+}
+
+// Return the (singleton) object that manages all non-code VM operations
+static PageAllocatorSymbian* dataAllocatorInstance() 
 {
-    return fastMalloc(bytes);
+    return &dataAllocator; 
 }
 
-void* OSAllocator::reserveAndCommit(size_t bytes, Usage, bool, bool)
+// Reserve memory and return the base address of the region
+void* OSAllocator::reserveUncommitted(size_t reservationSize, Usage usage, bool , bool executable) 
 {
-    return fastMalloc(bytes);
+    void* base = 0; 
+    if (executable) 
+        base = allocateCodeChunk(reservationSize);
+    else
+        base = dataAllocatorInstance()->reserve(reservationSize);
+    return base; 
 }
 
-void OSAllocator::commit(void*, size_t, bool, bool)
+// Inverse operation of reserveUncommitted()
+void OSAllocator::releaseDecommitted(void* parkedBase, size_t bytes) 
 {
+    if (dataAllocatorInstance()->contains(parkedBase)) 
+        dataAllocatorInstance()->release(parkedBase, bytes);
+
+    // NOOP for code chunks (JIT) because we released them in decommit()
 }
 
-void OSAllocator::decommit(void*, size_t)
+// Commit what was previously reserved via reserveUncommitted()
+void OSAllocator::commit(void* address, size_t bytes, bool, bool executable) 
 {
+    // For code chunks, we commit (early) in reserveUncommitted(), so NOOP
+    // For data regions, do real work
+    if (!executable) 
+        dataAllocatorInstance()->commit(address, bytes);
+}
+
+void OSAllocator::decommit(void* address, size_t bytes) 
+{ 
+    if (dataAllocatorInstance()->contains(address))
+        dataAllocatorInstance()->decommit(address, bytes);
+    else
+        deallocateCodeChunk(address); // for code chunk, decommit AND release    
+}
+    
+void* OSAllocator::reserveAndCommit(size_t bytes, Usage usage, bool writable, bool executable)
+{ 
+    void* base = reserveUncommitted(bytes, usage, writable, executable);
+    commit(base, bytes, writable, executable);
+    return base;
+}
+
+
+// The PageAllocatorSymbian class helps map OSAllocator calls for reserve/commit/decommit
+// to a single large Symbian chunk. Only works with multiples of page size, and as a corollary 
+// all addresses accepted or returned by it are also page-sized aligned. 
+// Design notes: 
+// - We initialize a chunk up-front with a large reservation size
+// - The entire reservation reserve is logically divided into pageSized blocks (4K on Symbian) 
+// - The map maintains 1 bit for each of the 4K-sized region in our address space
+// - OSAllocator::reserveUncommitted() requests lead to 1 or more bits being set in map 
+//   to indicate internally reserved state. The VM address corresponding to the first bit is returned. 
+// - OSAllocator::commit() actually calls RChunk.commit() and commits *all or part* of the region 
+//   reserved via reserveUncommitted() previously. 
+// - OSAllocator::decommit() calls RChunk.decommit() 
+// - OSAllocator::releaseDecommitted() unparks all the bits in the map, but trusts that a previously
+//   call to decommit() would have returned the memory to the OS 
+PageAllocatorSymbian::PageAllocatorSymbian()
+{        
+    __ASSERT_ALWAYS(m_pageSize == WTF::pageSize(), User::Panic(KErrorStringPageSize, m_pageSize));
+    
+    RChunk chunk;
+    TInt error = chunk.CreateDisconnectedLocal(0, 0, TInt(largeReservationSize));
+    __ASSERT_ALWAYS(error == KErrNone, User::Panic(KErrorStringChunkCreation, error));
+    
+    m_chunk = new SymbianChunk(chunk.Handle()); // takes ownership of chunk
+}
+
+PageAllocatorSymbian::~PageAllocatorSymbian() 
+{
+    delete m_chunk;
+}
+
+// Reserves a region internally in the bitmap
+void* PageAllocatorSymbian::reserve(size_t bytes) 
+{ 
+    // Find first available region
+    const size_t nPages = bytes / m_pageSize;
+    const int64_t startIdx = m_map.findRunOfZeros(nPages);
+
+    // Pseudo OOM
+    if (startIdx < 0)
+        return 0;
+    
+    for (size_t i = startIdx; i < startIdx + nPages ; i++)
+        m_map.set(i);
+    
+    return static_cast<void*>( m_chunk->m_base + (TUint)(m_pageSize * startIdx) ); 
+}
+
+// Reverses the effects of a reserve() call
+void PageAllocatorSymbian::release(void* address, size_t bytes)
+{
+    const size_t startIdx = (static_cast<char*>(address) - m_chunk->m_base) / m_pageSize;
+    const size_t nPages = bytes / m_pageSize;
+    for (size_t i = startIdx; i < startIdx + nPages ; i++)
+        m_map.clear(i);
+}
+
+// Actually commit memory from the OS, after a previous call to reserve()
+bool PageAllocatorSymbian::commit(void* address, size_t bytes) 
+{ 
+    // sanity check that bits were previously set
+    const size_t idx = (static_cast<char*>(address) - m_chunk->m_base) / m_pageSize;
+    const size_t nPages = bytes / m_pageSize;
+    __ASSERT_ALWAYS(m_map.get(idx), User::Panic(KErrorStringInternalConsistency, idx));
+    __ASSERT_ALWAYS(m_map.get(idx+nPages-1), User::Panic(KErrorStringInternalConsistency, idx+nPages-1));
+    
+    TInt error = m_chunk->Commit(static_cast<char*>(address) - m_chunk->m_base, bytes);
+    return (error == KErrNone);
+}
+
+// Inverse operation of commit(), a release() should follow later
+bool PageAllocatorSymbian::decommit(void* address, size_t bytes) 
+{ 
+    TInt error = m_chunk->Decommit(static_cast<char*>(address) - m_chunk->m_base, bytes);
+    return (error == KErrNone); 
 }
 
-void OSAllocator::releaseDecommitted(void* address, size_t)
+bool PageAllocatorSymbian::contains(const void* address) const
 {
-    fastFree(address);
+    return m_chunk->contains(address);     
 }
 
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/OSRandomSource.cpp b/Source/JavaScriptCore/wtf/OSRandomSource.cpp
index 0c1416a..7d86f6f 100644
--- a/Source/JavaScriptCore/wtf/OSRandomSource.cpp
+++ b/Source/JavaScriptCore/wtf/OSRandomSource.cpp
@@ -29,6 +29,10 @@
 #include <stdint.h>
 #include <stdlib.h>
 
+#if OS(SYMBIAN)
+#include <e32math.h>
+#endif
+
 #if OS(UNIX)
 #include <fcntl.h>
 #include <unistd.h>
@@ -44,7 +48,19 @@ namespace WTF {
 #if USE(OS_RANDOMNESS)
 void cryptographicallyRandomValuesFromOS(unsigned char* buffer, size_t length)
 {
-#if OS(UNIX)
+#if OS(SYMBIAN)
+    TInt random;
+    while (length > sizeof(random)) {
+        random = Math::Random();
+        memcpy(buffer, &random, sizeof(random));
+        length -= sizeof(random);
+        buffer += sizeof(random);
+    }
+    if (length > 0) {
+        random = Math::Random();
+        memcpy(buffer, &random, length);
+    }
+#elif OS(UNIX)
     int fd = open("/dev/urandom", O_RDONLY, 0);
     if (fd < 0)
         CRASH(); // We need /dev/urandom for this API to work...
diff --git a/Source/JavaScriptCore/wtf/OwnArrayPtr.h b/Source/JavaScriptCore/wtf/OwnArrayPtr.h
index 6b7c8da..2828698 100644
--- a/Source/JavaScriptCore/wtf/OwnArrayPtr.h
+++ b/Source/JavaScriptCore/wtf/OwnArrayPtr.h
@@ -111,6 +111,16 @@ template<typename T> inline typename OwnArrayPtr<T>::PtrType OwnArrayPtr<T>::lea
     return ptr;
 }
 
+#ifdef LOOSE_OWN_ARRAY_PTR
+template<typename T> inline void OwnArrayPtr<T>::set(PtrType ptr)
+{
+    ASSERT(!ptr || m_ptr != ptr);
+    PtrType oldPtr = m_ptr;
+    m_ptr = ptr;
+    deleteOwnedArrayPtr(oldPtr);
+}
+#endif
+
 template<typename T> inline OwnArrayPtr<T>& OwnArrayPtr<T>::operator=(const PassOwnArrayPtr<T>& o)
 {
     PtrType ptr = m_ptr;
diff --git a/Source/JavaScriptCore/wtf/PageAllocatorSymbian.h b/Source/JavaScriptCore/wtf/PageAllocatorSymbian.h
new file mode 100644
index 0000000..eba5b03
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/PageAllocatorSymbian.h
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PageAllocatorSymbian_h
+#define PageAllocatorSymbian_h
+
+#include <e32std.h>
+#include <wtf/Bitmap.h>
+
+namespace WTF { 
+
+size_t pageSize();
+
+// Convenience wrapper around an RChunk
+class SymbianChunk : public RChunk {
+   
+public:   
+    SymbianChunk(TInt handle) 
+    {
+        SetHandle(handle);
+        // prevent kernel calls by caching these
+        m_base = reinterpret_cast<char*>(Base()); 
+        m_maxSize = MaxSize();
+    }
+    
+    ~SymbianChunk() 
+    { 
+        Decommit(0, m_maxSize);
+        Close();
+    }
+     
+    // checks if address is in chunk's virtual address space
+    bool contains(const void* address) const 
+    {
+        return (static_cast<const char*>(address) >= m_base && static_cast<const char*>(address) < (m_base + m_maxSize));  
+    }
+    
+    char* m_base; 
+    size_t m_maxSize; 
+    
+};
+
+// Size of the large up-front reservation
+#if defined(__WINS__) 
+// Emulator has limited virtual address space
+const size_t largeReservationSize = 96*1024*1024;
+#else
+// HW has plenty of virtual addresses
+const size_t largeReservationSize = 256*1024*1024;
+#endif
+
+class PageAllocatorSymbian { 
+
+public:     
+    PageAllocatorSymbian();
+    ~PageAllocatorSymbian();
+    
+    void* reserve(size_t);
+    void release(void*, size_t);
+    bool commit(void*, size_t);
+    bool decommit(void*, size_t);
+    
+    bool contains(const void*) const; 
+    
+private:     
+    static const size_t m_pageSize = 4096; 
+    SymbianChunk* m_chunk; 
+    Bitmap<largeReservationSize / m_pageSize> m_map;
+    
+};
+
+} // namespace WTF
+
+#endif // PageAllocatorSymbian_h
+
diff --git a/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h b/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h
index e1aa61e..3f30924 100644
--- a/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h
+++ b/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h
@@ -30,9 +30,6 @@
 #include "NullPtr.h"
 #include "TypeTraits.h"
 
-// Remove this once we make all WebKit code compatible with stricter rules about PassOwnArrayPtr.
-#define LOOSE_PASS_OWN_ARRAY_PTR
-
 namespace WTF {
 
 template<typename T> class OwnArrayPtr;
@@ -46,6 +43,10 @@ public:
 
     PassOwnArrayPtr() : m_ptr(0) { }
 
+#if !defined(LOOSE_PASS_OWN_PTR) || !HAVE(NULLPTR)
+    PassOwnArrayPtr(std::nullptr_t) : m_ptr(0) { }
+#endif
+
     // It somewhat breaks the type system to allow transfer of ownership out of
     // a const PassOwnArrayPtr. However, it makes it much easier to work with PassOwnArrayPtr
     // temporaries, and we don't have a need to use real const PassOwnArrayPtrs anyway.
diff --git a/Source/JavaScriptCore/wtf/Platform.h b/Source/JavaScriptCore/wtf/Platform.h
index 98eee7f..43b234a 100644
--- a/Source/JavaScriptCore/wtf/Platform.h
+++ b/Source/JavaScriptCore/wtf/Platform.h
@@ -114,6 +114,11 @@
 #define WTF_COMPILER_INTEL 1
 #endif
 
+/* COMPILER(SUNCC) */
+#if defined(__SUNPRO_CC) || defined(__SUNPRO_C)
+#define WTF_COMPILER_SUNCC 1
+#endif
+
 /* ==== CPU() - the target CPU architecture ==== */
 
 /* This also defines CPU(BIG_ENDIAN) or CPU(MIDDLE_ENDIAN) or neither, as appropriate. */
@@ -347,9 +352,15 @@
 #  error "Cannot use both of WTF_CPU_ARM_TRADITIONAL and WTF_CPU_ARM_THUMB2 platforms"
 #endif /* !defined(WTF_CPU_ARM_TRADITIONAL) && !defined(WTF_CPU_ARM_THUMB2) */
 
-#endif /* ARM */
+#if defined(__ARM_NEON__) && !defined(WTF_CPU_ARM_NEON)
+#define WTF_CPU_ARM_NEON 1
+#endif
 
+#endif /* ARM */
 
+#if CPU(ARM) || CPU(MIPS)
+#define WTF_CPU_NEEDS_ALIGNED_ACCESS 1
+#endif
 
 /* ==== OS() - underlying operating system; only to be used for mandated low-level services like 
    virtual memory, not to choose a GUI toolkit ==== */
@@ -399,7 +410,7 @@
 #endif
 
 /* OS(FREEBSD) - FreeBSD */
-#ifdef __FreeBSD__
+#if defined(__FreeBSD__) || defined(__DragonFly__)
 #define WTF_OS_FREEBSD 1
 #endif
 
@@ -528,37 +539,33 @@
 
 /* Graphics engines */
 
-/* PLATFORM(CG) and PLATFORM(CI) */
+/* USE(CG) and PLATFORM(CI) */
 #if PLATFORM(MAC) || PLATFORM(IOS)
-#define WTF_PLATFORM_CG 1
-#endif
-#if PLATFORM(MAC) && !PLATFORM(IOS)
-#define WTF_PLATFORM_CI 1
+#define WTF_USE_CG 1
 #endif
-#if PLATFORM(MAC) || PLATFORM(IOS) || (PLATFORM(WIN) && PLATFORM(CG))
-#define WTF_PLATFORM_CA 1
+#if PLATFORM(MAC) || PLATFORM(IOS) || (PLATFORM(WIN) && USE(CG))
+#define WTF_USE_CA 1
 #endif
 
-/* PLATFORM(SKIA) for Win/Linux, CG/CI for Mac */
+/* USE(SKIA) for Win/Linux, CG for Mac */
 #if PLATFORM(CHROMIUM)
 #if OS(DARWIN)
-#define WTF_PLATFORM_CG 1
-#define WTF_PLATFORM_CI 1
+#define WTF_USE_CG 1
 #define WTF_USE_ATSUI 1
 #define WTF_USE_CORE_TEXT 1
 #define WTF_USE_ICCJPEG 1
 #else
-#define WTF_PLATFORM_SKIA 1
+#define WTF_USE_SKIA 1
 #define WTF_USE_CHROMIUM_NET 1
 #endif
 #endif
 
 #if PLATFORM(BREWMP)
-#define WTF_PLATFORM_SKIA 1
+#define WTF_USE_SKIA 1
 #endif
 
 #if PLATFORM(GTK)
-#define WTF_PLATFORM_CAIRO 1
+#define WTF_USE_CAIRO 1
 #endif
 
 
@@ -567,7 +574,11 @@
 #define WTF_USE_MERSENNE_TWISTER_19937 1
 #endif
 
-#if (PLATFORM(IOS) || PLATFORM(MAC) || PLATFORM(WIN) || (PLATFORM(QT) && OS(DARWIN) && !ENABLE(SINGLE_THREADED))) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
+#if PLATFORM(QT) && OS(UNIX) && !OS(SYMBIAN) && !OS(DARWIN)
+#define WTF_USE_PTHREAD_BASED_QT 1
+#endif
+
+#if (PLATFORM(GTK) || PLATFORM(IOS) || PLATFORM(MAC) || PLATFORM(WIN) || (PLATFORM(QT) && (OS(DARWIN) || USE(PTHREAD_BASED_QT)) && !ENABLE(SINGLE_THREADED))) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
 #define ENABLE_JSC_MULTIPLE_THREADS 1
 #endif
 
@@ -615,7 +626,7 @@
 #if !defined(ENABLE_DASHBOARD_SUPPORT)
 #define ENABLE_DASHBOARD_SUPPORT 1
 #endif
-#define WTF_PLATFORM_CF 1
+#define WTF_USE_CF 1
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
 #define HAVE_READLINE 1
@@ -629,15 +640,10 @@
 #define ENABLE_FULLSCREEN_API 1
 #endif
 
-#if PLATFORM(MAC)
-#define WTF_USE_CARBON_SECURE_INPUT_MODE 1
-#endif
-
 #if PLATFORM(CHROMIUM) && OS(DARWIN)
-#define WTF_PLATFORM_CF 1
+#define WTF_USE_CF 1
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
-#define WTF_USE_CARBON_SECURE_INPUT_MODE 1
 #endif
 
 #if PLATFORM(BREWMP)
@@ -645,7 +651,7 @@
 #endif
 
 #if PLATFORM(QT) && OS(DARWIN)
-#define WTF_PLATFORM_CF 1
+#define WTF_USE_CF 1
 #endif
 
 #if OS(DARWIN) && !defined(BUILDING_ON_TIGER) && !PLATFORM(GTK) && !PLATFORM(QT)
@@ -655,6 +661,7 @@
 #if PLATFORM(IOS)
 #define ENABLE_CONTEXT_MENUS 0
 #define ENABLE_DRAG_SUPPORT 0
+#define ENABLE_DATA_TRANSFER_ITEMS 0
 #define ENABLE_FTPDIR 1
 #define ENABLE_GEOLOCATION 1
 #define ENABLE_ICONDATABASE 0
@@ -664,7 +671,7 @@
 #define ENABLE_ORIENTATION_EVENTS 1
 #define ENABLE_REPAINT_THROTTLING 1
 #define HAVE_READLINE 1
-#define WTF_PLATFORM_CF 1
+#define WTF_USE_CF 1
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
 #define ENABLE_WEB_ARCHIVE 1
@@ -672,7 +679,7 @@
 
 #if PLATFORM(ANDROID)
 #define WTF_USE_PTHREADS 1
-#define WTF_PLATFORM_SKIA 1
+#define WTF_USE_SKIA 1
 #define USE_SYSTEM_MALLOC 1
 #define ENABLE_JAVA_BRIDGE 1
 #define LOG_DISABLED 1
@@ -688,10 +695,19 @@
 #endif
 
 #if PLATFORM(WIN) && !OS(WINCE)
-#define WTF_PLATFORM_CF 1
+#define WTF_USE_CF 1
 #define WTF_USE_PTHREADS 0
 #endif
 
+#if PLATFORM(WIN) && !OS(WINCE) && !PLATFORM(CHROMIUM) && !defined(WIN_CAIRO)
+#define WTF_USE_CFNETWORK 1
+#endif
+
+#if USE(CFNETWORK) || PLATFORM(MAC)
+#define WTF_USE_CFURLCACHE 1
+#define WTF_USE_CFURLSTORAGESESSIONS 1
+#endif
+
 #if PLATFORM(WIN) && !OS(WINCE) && !PLATFORM(CHROMIUM) && !PLATFORM(QT)
 #define ENABLE_WEB_ARCHIVE 1
 #endif
@@ -700,7 +716,7 @@
 #define ENABLE_ASSEMBLER 1
 #define ENABLE_GLOBAL_FASTMALLOC_NEW 0
 #if OS(DARWIN)
-#define WTF_PLATFORM_CF 1
+#define WTF_USE_CF 1
 #ifndef BUILDING_ON_TIGER
 #define WTF_USE_CORE_TEXT 1
 #define ENABLE_WEB_ARCHIVE 1
@@ -769,6 +785,7 @@
 #define HAVE_SYS_PARAM_H 1
 #define HAVE_SYS_TIME_H 1
 #define HAVE_SYS_TIMEB_H 1
+#define WTF_USE_ACCELERATE 1
 
 #if !defined(TARGETING_TIGER) && !defined(TARGETING_LEOPARD)
 
@@ -891,6 +908,10 @@
 #define ENABLE_DRAG_SUPPORT 1
 #endif
 
+#if !defined(ENABLE_DATA_TRANSFER_ITEMS)
+#define ENABLE_DATA_TRANSFER_ITEMS 0
+#endif
+
 #if !defined(ENABLE_DASHBOARD_SUPPORT)
 #define ENABLE_DASHBOARD_SUPPORT 0
 #endif
@@ -947,6 +968,10 @@
 #define ENABLE_GEOLOCATION 0
 #endif
 
+#if !defined(ENABLE_GESTURE_RECOGNIZER)
+#define ENABLE_GESTURE_RECOGNIZER 0
+#endif
+
 #if !defined(ENABLE_NOTIFICATIONS)
 #define ENABLE_NOTIFICATIONS 0
 #endif
@@ -1006,6 +1031,13 @@
 #define ENABLE_JIT 1
 #endif
 
+/* Currently only implemented for JSVALUE64, only tested on PLATFORM(MAC) */
+#if ENABLE(JIT) && USE(JSVALUE64) && PLATFORM(MAC)
+#define ENABLE_DFG_JIT 1
+/* Enabled with restrictions to circumvent known performance regressions. */
+#define ENABLE_DFG_JIT_RESTRICTIONS 1
+#endif
+
 /* Ensure that either the JIT or the interpreter has been enabled. */
 #if !defined(ENABLE_INTERPRETER) && !ENABLE(JIT)
 #define ENABLE_INTERPRETER 1
@@ -1014,6 +1046,14 @@
 #error You have to have at least one execution model enabled to build JSC
 #endif
 
+#if CPU(SH4) && PLATFORM(QT)
+#define ENABLE_JIT 1
+#define ENABLE_YARR 1
+#define ENABLE_YARR_JIT 1
+#define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
+#define ENABLE_ASSEMBLER 1
+#endif
+
 /* Configure the JIT */
 #if ENABLE(JIT)
     #if CPU(ARM)
@@ -1129,6 +1169,10 @@
 #define WTF_USE_PROTECTION_SPACE_AUTH_CALLBACK 1
 #endif
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#define WTF_USE_AVFOUNDATION 1
+#endif
+
 #if COMPILER(GCC)
 #define WARN_UNUSED_RETURN __attribute__ ((warn_unused_result))
 #else
@@ -1168,4 +1212,14 @@
 #include "GTypedefs.h"
 #endif
 
+/* FIXME: This define won't be needed once #27551 is fully landed. However, 
+   since most ports try to support sub-project independence, adding new headers
+   to WTF causes many ports to break, and so this way we can address the build
+   breakages one port at a time. */
+#define WTF_USE_EXPORT_MACROS 0
+
+#if PLATFORM(QT) || PLATFORM(GTK)
+#define WTF_USE_UNIX_DOMAIN_SOCKETS 1
+#endif
+
 #endif /* WTF_Platform_h */
diff --git a/Source/JavaScriptCore/wtf/RandomNumber.cpp b/Source/JavaScriptCore/wtf/RandomNumber.cpp
index 1574324..5b06243 100644
--- a/Source/JavaScriptCore/wtf/RandomNumber.cpp
+++ b/Source/JavaScriptCore/wtf/RandomNumber.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 #include "RandomNumber.h"
 
+#include "CryptographicallyRandomNumber.h"
 #include "RandomNumberSeed.h"
 
 #include <limits>
@@ -52,6 +53,14 @@ namespace WTF {
 
 double randomNumber()
 {
+#if USE(OS_RANDOMNESS)
+    uint32_t bits = cryptographicallyRandomNumber();
+    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
+#else
+    // Without OS_RANDOMNESS, we fall back to other random number generators
+    // that might not be cryptographically secure. Ideally, most ports would
+    // define USE(OS_RANDOMNESS).
+
 #if !ENABLE(JSC_MULTIPLE_THREADS)
     static bool s_initialized = false;
     if (!s_initialized) {
@@ -59,46 +68,16 @@ double randomNumber()
         s_initialized = true;
     }
 #endif
-    
-#if COMPILER(MSVC) && defined(_CRT_RAND_S)
-    uint32_t bits;
-    rand_s(&bits);
-    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
-#elif OS(DARWIN)
-    uint32_t bits = arc4random();
-    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
-#elif OS(UNIX)
-    uint32_t part1 = random() & (RAND_MAX - 1);
-    uint32_t part2 = random() & (RAND_MAX - 1);
-    // random only provides 31 bits
-    uint64_t fullRandom = part1;
-    fullRandom <<= 31;
-    fullRandom |= part2;
 
-    // Mask off the low 53bits
-    fullRandom &= (1LL << 53) - 1;
-    return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
-#elif USE(MERSENNE_TWISTER_19937)
+#if USE(MERSENNE_TWISTER_19937)
     return genrand_res53();
-#elif OS(WINDOWS)
-    uint32_t part1 = rand() & (RAND_MAX - 1);
-    uint32_t part2 = rand() & (RAND_MAX - 1);
-    uint32_t part3 = rand() & (RAND_MAX - 1);
-    uint32_t part4 = rand() & (RAND_MAX - 1);
-    // rand only provides 15 bits on Win32
-    uint64_t fullRandom = part1;
-    fullRandom <<= 15;
-    fullRandom |= part2;
-    fullRandom <<= 15;
-    fullRandom |= part3;
-    fullRandom <<= 15;
-    fullRandom |= part4;
-
-    // Mask off the low 53bits
-    fullRandom &= (1LL << 53) - 1;
-    return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
 #elif PLATFORM(BREWMP)
     uint32_t bits;
+    // Is this a cryptographically strong source of random numbers? If so, we
+    // should move this into OSRandomSource.
+    // http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp851.pdf
+    // is slightly unclear on this point, although it seems to imply that it is
+    // secure.
     RefPtr<ISource> randomSource = createRefPtrInstance<ISource>(AEECLSID_RANDOM);
     ISOURCE_Read(randomSource.get(), reinterpret_cast<char*>(&bits), 4);
 
@@ -118,6 +97,7 @@ double randomNumber()
     fullRandom &= (1LL << 53) - 1;
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
 #endif
+#endif
 }
 
 }
diff --git a/Source/JavaScriptCore/wtf/RefCounted.h b/Source/JavaScriptCore/wtf/RefCounted.h
index da178b2..12b670e 100644
--- a/Source/JavaScriptCore/wtf/RefCounted.h
+++ b/Source/JavaScriptCore/wtf/RefCounted.h
@@ -59,6 +59,12 @@ public:
 #endif
     }
 
+    // Helper for generating JIT code. Please do not use for non-JIT purposes.
+    const int* addressOfCount() const
+    {
+        return &m_refCount;
+    }
+
 protected:
     RefCountedBase()
         : m_refCount(1)
@@ -93,12 +99,6 @@ protected:
         return false;
     }
 
-    // Helper for generating JIT code. Please do not use for non-JIT purposes.
-    int* addressOfCount()
-    {
-        return &m_refCount;
-    }
-
 #ifndef NDEBUG
     bool deletionHasBegun() const
     {
diff --git a/Source/JavaScriptCore/wtf/RetainPtr.h b/Source/JavaScriptCore/wtf/RetainPtr.h
index fa7c163..a716390 100644
--- a/Source/JavaScriptCore/wtf/RetainPtr.h
+++ b/Source/JavaScriptCore/wtf/RetainPtr.h
@@ -25,7 +25,10 @@
 #include "NullPtr.h"
 #include "TypeTraits.h"
 #include <algorithm>
+
+#if USE(CF)
 #include <CoreFoundation/CoreFoundation.h>
+#endif
 
 #ifdef __OBJC__
 #import <Foundation/Foundation.h>
@@ -231,11 +234,7 @@ namespace WTF {
         return a != b.get(); 
     }
     
-    template<typename P> struct HashTraits<RetainPtr<P> > : GenericHashTraits<RetainPtr<P> > {
-        static const bool emptyValueIsZero = true;
-        static void constructDeletedValue(RetainPtr<P>& slot) { new (&slot) RetainPtr<P>(HashTableDeletedValue); }
-        static bool isDeletedValue(const RetainPtr<P>& value) { return value == reinterpret_cast<P*>(-1); }
-    };
+    template<typename P> struct HashTraits<RetainPtr<P> > : SimpleClassHashTraits<RetainPtr<P> > { };
     
     template<typename P> struct PtrHash<RetainPtr<P> > : PtrHash<P*> {
         using PtrHash<P*>::hash;
diff --git a/Source/JavaScriptCore/wtf/SHA1.cpp b/Source/JavaScriptCore/wtf/SHA1.cpp
new file mode 100644
index 0000000..e76f6ac
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/SHA1.cpp
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// A straightforward SHA-1 implementation based on RFC 3174.
+// http://www.ietf.org/rfc/rfc3174.txt
+// The names of functions and variables (such as "a", "b", and "f") follow notations in RFC 3174.
+
+#include "config.h"
+#include "SHA1.h"
+
+#include "Assertions.h"
+#ifndef NDEBUG
+#include "StringExtras.h"
+#include "text/CString.h"
+#endif
+
+namespace WTF {
+
+#ifdef NDEBUG
+static inline void testSHA1() { }
+#else
+static bool isTestSHA1Done;
+
+static void expectSHA1(CString input, int repeat, CString expected)
+{
+    SHA1 sha1;
+    for (int i = 0; i < repeat; ++i)
+        sha1.addBytes(reinterpret_cast<const uint8_t*>(input.data()), input.length());
+    Vector<uint8_t, 20> digest;
+    sha1.computeHash(digest);
+    char* buffer = 0;
+    CString actual = CString::newUninitialized(40, buffer);
+    for (size_t i = 0; i < 20; ++i) {
+        snprintf(buffer, 3, "%02X", digest.at(i));
+        buffer += 2;
+    }
+    ASSERT_WITH_MESSAGE(actual == expected, "input: %s, repeat: %d, actual: %s, expected: %s", input.data(), repeat, actual.data(), expected.data());
+}
+
+static void testSHA1()
+{
+    if (isTestSHA1Done)
+        return;
+    isTestSHA1Done = true;
+
+    // Examples taken from sample code in RFC 3174.
+    expectSHA1("abc", 1, "A9993E364706816ABA3E25717850C26C9CD0D89D");
+    expectSHA1("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", 1, "84983E441C3BD26EBAAE4AA1F95129E5E54670F1");
+    expectSHA1("a", 1000000, "34AA973CD4C4DAA4F61EEB2BDBAD27316534016F");
+    expectSHA1("0123456701234567012345670123456701234567012345670123456701234567", 10, "DEA356A2CDDD90C7A7ECEDC5EBB563934F460452");
+}
+#endif
+
+static inline uint32_t f(int t, uint32_t b, uint32_t c, uint32_t d)
+{
+    ASSERT(t >= 0 && t < 80);
+    if (t < 20)
+        return (b & c) | ((~b) & d);
+    if (t < 40)
+        return b ^ c ^ d;
+    if (t < 60)
+        return (b & c) | (b & d) | (c & d);
+    return b ^ c ^ d;
+}
+
+static inline uint32_t k(int t)
+{
+    ASSERT(t >= 0 && t < 80);
+    if (t < 20)
+        return 0x5a827999;
+    if (t < 40)
+        return 0x6ed9eba1;
+    if (t < 60)
+        return 0x8f1bbcdc;
+    return 0xca62c1d6;
+}
+
+static inline uint32_t rotateLeft(int n, uint32_t x)
+{
+    ASSERT(n >= 0 && n < 32);
+    return (x << n) | (x >> (32 - n));
+}
+
+SHA1::SHA1()
+{
+    // FIXME: Move unit tests somewhere outside the constructor. See bug 55853.
+    testSHA1();
+    reset();
+}
+
+void SHA1::addBytes(const uint8_t* input, size_t length)
+{
+    while (length--) {
+        ASSERT(m_cursor < 64);
+        m_buffer[m_cursor++] = *input++;
+        ++m_totalBytes;
+        if (m_cursor == 64)
+            processBlock();
+    }
+}
+
+void SHA1::computeHash(Vector<uint8_t, 20>& digest)
+{
+    finalize();
+
+    digest.clear();
+    digest.resize(20);
+    for (size_t i = 0; i < 5; ++i) {
+        // Treat hashValue as a big-endian value.
+        uint32_t hashValue = m_hash[i];
+        for (int j = 0; j < 4; ++j) {
+            digest[4 * i + (3 - j)] = hashValue & 0xFF;
+            hashValue >>= 8;
+        }
+    }
+
+    reset();
+}
+
+void SHA1::finalize()
+{
+    ASSERT(m_cursor < 64);
+    m_buffer[m_cursor++] = 0x80;
+    if (m_cursor > 56) {
+        // Pad out to next block.
+        while (m_cursor < 64)
+            m_buffer[m_cursor++] = 0x00;
+        processBlock();
+    }
+
+    for (size_t i = m_cursor; i < 56; ++i)
+        m_buffer[i] = 0x00;
+
+    // Write the length as a big-endian 64-bit value.
+    uint64_t bits = m_totalBytes * 8;
+    for (int i = 0; i < 8; ++i) {
+        m_buffer[56 + (7 - i)] = bits & 0xFF;
+        bits >>= 8;
+    }
+    m_cursor = 64;
+    processBlock();
+}
+
+void SHA1::processBlock()
+{
+    ASSERT(m_cursor == 64);
+
+    uint32_t w[80] = { 0 };
+    for (int t = 0; t < 16; ++t)
+        w[t] = (m_buffer[t * 4] << 24) | (m_buffer[t * 4 + 1] << 16) | (m_buffer[t * 4 + 2] << 8) | m_buffer[t * 4 + 3];
+    for (int t = 16; t < 80; ++t)
+        w[t] = rotateLeft(1, w[t - 3] ^ w[t - 8] ^ w[t - 14] ^ w[t - 16]);
+
+    uint32_t a = m_hash[0];
+    uint32_t b = m_hash[1];
+    uint32_t c = m_hash[2];
+    uint32_t d = m_hash[3];
+    uint32_t e = m_hash[4];
+
+    for (int t = 0; t < 80; ++t) {
+        uint32_t temp = rotateLeft(5, a) + f(t, b, c, d) + e + w[t] + k(t);
+        e = d;
+        d = c;
+        c = rotateLeft(30, b);
+        b = a;
+        a = temp;
+    }
+
+    m_hash[0] += a;
+    m_hash[1] += b;
+    m_hash[2] += c;
+    m_hash[3] += d;
+    m_hash[4] += e;
+
+    m_cursor = 0;
+}
+
+void SHA1::reset()
+{
+    m_cursor = 0;
+    m_totalBytes = 0;
+    m_hash[0] = 0x67452301;
+    m_hash[1] = 0xefcdab89;
+    m_hash[2] = 0x98badcfe;
+    m_hash[3] = 0x10325476;
+    m_hash[4] = 0xc3d2e1f0;
+
+    // Clear the buffer after use in case it's sensitive.
+    memset(m_buffer, 0, sizeof(m_buffer));
+}
+
+} // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/SHA1.h b/Source/JavaScriptCore/wtf/SHA1.h
new file mode 100644
index 0000000..dad6dc8
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/SHA1.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WTF_SHA1_h
+#define WTF_SHA1_h
+
+#include <wtf/Vector.h>
+
+namespace WTF {
+
+class SHA1 {
+public:
+    SHA1();
+
+    void addBytes(const Vector<uint8_t>& input)
+    {
+        addBytes(input.data(), input.size());
+    }
+    void addBytes(const uint8_t* input, size_t length);
+
+    // computeHash has a side effect of resetting the state of the object.
+    void computeHash(Vector<uint8_t, 20>&);
+
+private:
+    void finalize();
+    void processBlock();
+    void reset();
+
+    uint8_t m_buffer[64];
+    size_t m_cursor; // Number of bytes filled in m_buffer (0-64).
+    uint64_t m_totalBytes; // Number of bytes added so far.
+    uint32_t m_hash[5];
+};
+
+} // namespace WTF
+
+using WTF::SHA1;
+
+#endif // WTF_SHA1_h
diff --git a/Source/JavaScriptCore/wtf/SentinelLinkedList.h b/Source/JavaScriptCore/wtf/SentinelLinkedList.h
new file mode 100644
index 0000000..610d2d2
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/SentinelLinkedList.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+//    A SentinelLinkedList is a linked list with dummy head and tail sentinels,
+//    which allow for branch-less insertion and removal, and removal without a
+//    pointer to the list.
+//    
+//    Requires: Node is a concrete class with:
+//        Node(SentinelTag);
+//        void setPrev(Node*);
+//        Node* prev();
+//        void setNext(Node*);
+//        Node* next();
+
+#ifndef SentinelLinkedList_h
+#define SentinelLinkedList_h
+
+namespace WTF {
+
+enum SentinelTag { Sentinel };
+
+template <typename Node> class SentinelLinkedList {
+public:
+    typedef Node* iterator;
+
+    SentinelLinkedList();
+
+    void push(Node*);
+    static void remove(Node*);
+
+    iterator begin();
+    iterator end();
+
+private:
+    Node m_headSentinel;
+    Node m_tailSentinel;
+};
+
+template <typename Node> inline SentinelLinkedList<Node>::SentinelLinkedList()
+    : m_headSentinel(Sentinel)
+    , m_tailSentinel(Sentinel)
+{
+    m_headSentinel.setNext(&m_tailSentinel);
+    m_headSentinel.setPrev(0);
+
+    m_tailSentinel.setPrev(&m_headSentinel);
+    m_tailSentinel.setNext(0);
+}
+
+template <typename Node> inline typename SentinelLinkedList<Node>::iterator SentinelLinkedList<Node>::begin()
+{
+    return m_headSentinel.next();
+}
+
+template <typename Node> inline typename SentinelLinkedList<Node>::iterator SentinelLinkedList<Node>::end()
+{
+    return &m_tailSentinel;
+}
+
+template <typename Node> inline void SentinelLinkedList<Node>::push(Node* node)
+{
+    ASSERT(node);
+    Node* prev = &m_headSentinel;
+    Node* next = m_headSentinel.next();
+
+    node->setPrev(prev);
+    node->setNext(next);
+
+    prev->setNext(node);
+    next->setPrev(node);
+}
+
+template <typename Node> inline void SentinelLinkedList<Node>::remove(Node* node)
+{
+    Node* prev = node->prev();
+    Node* next = node->next();
+
+    prev->setNext(next);
+    next->setPrev(prev);
+}
+
+}
+
+using WTF::SentinelLinkedList;
+
+#endif
+
diff --git a/Source/JavaScriptCore/wtf/SinglyLinkedList.h b/Source/JavaScriptCore/wtf/SinglyLinkedList.h
new file mode 100644
index 0000000..c00bf36
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/SinglyLinkedList.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SinglyLinkedList_h
+#define SinglyLinkedList_h
+
+namespace WTF {
+
+template <typename Node> class SinglyLinkedList {
+public:
+    SinglyLinkedList();
+    
+    bool isEmpty();
+
+    void push(Node*);
+    Node* pop();
+
+private:
+    Node* m_head;
+};
+
+template <typename Node> inline SinglyLinkedList<Node>::SinglyLinkedList()
+    : m_head(0)
+{
+}
+
+template <typename Node> inline bool SinglyLinkedList<Node>::isEmpty()
+{
+    return !m_head;
+}
+
+template <typename Node> inline void SinglyLinkedList<Node>::push(Node* node)
+{
+    ASSERT(node);
+    node->setNext(m_head);
+    m_head = node;
+}
+
+template <typename Node> inline Node* SinglyLinkedList<Node>::pop()
+{
+    Node* tmp = m_head;
+    m_head = m_head->next();
+    return tmp;
+}
+
+}
+
+using WTF::SinglyLinkedList;
+
+#endif
diff --git a/Source/JavaScriptCore/wtf/StdLibExtras.h b/Source/JavaScriptCore/wtf/StdLibExtras.h
index 4bb0076..a8582e9 100644
--- a/Source/JavaScriptCore/wtf/StdLibExtras.h
+++ b/Source/JavaScriptCore/wtf/StdLibExtras.h
@@ -114,6 +114,54 @@ inline size_t bitCount(unsigned bits)
 template<typename T, size_t Size> char (&ArrayLengthHelperFunction(T (&)[Size]))[Size];
 #define WTF_ARRAY_LENGTH(array) sizeof(::WTF::ArrayLengthHelperFunction(array))
 
+// Efficient implementation that takes advantage of powers of two.
+template<size_t divisor> inline size_t roundUpToMultipleOf(size_t x)
+{
+    COMPILE_ASSERT(divisor && !(divisor & (divisor - 1)), divisor_is_a_power_of_two);
+
+    size_t remainderMask = divisor - 1;
+    return (x + remainderMask) & ~remainderMask;
+}
+
+// Binary search algorithm, calls extractKey on pre-sorted elements in array,
+// compares result with key (KeyTypes should be comparable with '--', '<', '>').
+// Optimized for cases where the array contains the key, checked by assertions.
+template<typename ArrayType, typename KeyType, KeyType(*extractKey)(ArrayType*)>
+inline ArrayType* binarySearch(ArrayType* array, size_t size, KeyType key)
+{
+    // The array must contain at least one element (pre-condition, array does conatin key).
+    // If the array only contains one element, no need to do the comparison.
+    while (size > 1) {
+        // Pick an element to check, half way through the array, and read the value.
+        int pos = (size - 1) >> 1;
+        KeyType val = extractKey(&array[pos]);
+        
+        // If the key matches, success!
+        if (val == key)
+            return &array[pos];
+        // The item we are looking for is smaller than the item being check; reduce the value of 'size',
+        // chopping off the right hand half of the array.
+        else if (key < val)
+            size = pos;
+        // Discard all values in the left hand half of the array, up to and including the item at pos.
+        else {
+            size -= (pos + 1);
+            array += (pos + 1);
+        }
+
+        // 'size' should never reach zero.
+        ASSERT(size);
+    }
+    
+    // If we reach this point we've chopped down to one element, no need to check it matches
+    ASSERT(size == 1);
+    ASSERT(key == extractKey(&array[0]));
+    return &array[0];
+}
+
 } // namespace WTF
 
+using WTF::binarySearch;
+using WTF::bitwise_cast;
+
 #endif // WTF_StdLibExtras_h
diff --git a/Source/JavaScriptCore/wtf/StringHasher.h b/Source/JavaScriptCore/wtf/StringHasher.h
index a84b2c4..5a2c36c 100644
--- a/Source/JavaScriptCore/wtf/StringHasher.h
+++ b/Source/JavaScriptCore/wtf/StringHasher.h
@@ -88,7 +88,7 @@ public:
         return result;
     }
 
-    template<typename T, UChar Converter(T)> static inline unsigned createHash(const T* data, unsigned length)
+    template<typename T, UChar Converter(T)> static inline unsigned computeHash(const T* data, unsigned length)
     {
         StringHasher hasher;
         bool rem = length & 1;
@@ -105,7 +105,7 @@ public:
         return hasher.hash();
     }
 
-    template<typename T, UChar Converter(T)> static inline unsigned createHash(const T* data)
+    template<typename T, UChar Converter(T)> static inline unsigned computeHash(const T* data)
     {
         StringHasher hasher;
 
@@ -125,26 +125,26 @@ public:
         return hasher.hash();
     }
 
-    template<typename T> static inline unsigned createHash(const T* data, unsigned length)
+    template<typename T> static inline unsigned computeHash(const T* data, unsigned length)
     {
-        return createHash<T, defaultCoverter>(data, length);
+        return computeHash<T, defaultCoverter>(data, length);
     }
 
-    template<typename T> static inline unsigned createHash(const T* data)
+    template<typename T> static inline unsigned computeHash(const T* data)
     {
-        return createHash<T, defaultCoverter>(data);
+        return computeHash<T, defaultCoverter>(data);
     }
 
-    template<size_t length> static inline unsigned createBlobHash(const void* data)
+    template<size_t length> static inline unsigned hashMemory(const void* data)
     {
         COMPILE_ASSERT(!(length % 4), length_must_be_a_multible_of_four);
-        return createHash<UChar>(static_cast<const UChar*>(data), length / sizeof(UChar));
+        return computeHash<UChar>(static_cast<const UChar*>(data), length / sizeof(UChar));
     }
 
-    static inline unsigned createBlobHash(const void* data, unsigned size)
+    static inline unsigned hashMemory(const void* data, unsigned size)
     {
         ASSERT(!(size % 2));
-        return createHash<UChar>(static_cast<const UChar*>(data), size / sizeof(UChar));
+        return computeHash<UChar>(static_cast<const UChar*>(data), size / sizeof(UChar));
     }
 
 private:
@@ -173,4 +173,6 @@ private:
 
 } // namespace WTF
 
+using WTF::StringHasher;
+
 #endif // WTF_StringHasher_h
diff --git a/Source/JavaScriptCore/wtf/ThreadSafeShared.h b/Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h
index a6a1cf2..ca11db3 100644
--- a/Source/JavaScriptCore/wtf/ThreadSafeShared.h
+++ b/Source/JavaScriptCore/wtf/ThreadSafeRefCounted.h
@@ -56,27 +56,29 @@
  * DEALINGS IN THE SOFTWARE.
  */
 
-#ifndef ThreadSafeShared_h
-#define ThreadSafeShared_h
+#ifndef ThreadSafeRefCounted_h
+#define ThreadSafeRefCounted_h
 
 #include "Platform.h"
 
 #include <wtf/Atomics.h>
+#include <wtf/DynamicAnnotations.h>
 #include <wtf/ThreadingPrimitives.h>
 
 namespace WTF {
 
-class ThreadSafeSharedBase {
-    WTF_MAKE_NONCOPYABLE(ThreadSafeSharedBase); WTF_MAKE_FAST_ALLOCATED;
+class ThreadSafeRefCountedBase {
+    WTF_MAKE_NONCOPYABLE(ThreadSafeRefCountedBase);
+    WTF_MAKE_FAST_ALLOCATED;
 public:
-    ThreadSafeSharedBase(int initialRefCount = 1)
+    ThreadSafeRefCountedBase(int initialRefCount = 1)
         : m_refCount(initialRefCount)
     {
     }
 
     void ref()
     {
-#if USE(LOCKFREE_THREADSAFESHARED)
+#if USE(LOCKFREE_THREADSAFEREFCOUNTED)
         atomicIncrement(&m_refCount);
 #else
         MutexLocker locker(m_mutex);
@@ -91,7 +93,7 @@ public:
 
     int refCount() const
     {
-#if !USE(LOCKFREE_THREADSAFESHARED)
+#if !USE(LOCKFREE_THREADSAFEREFCOUNTED)
         MutexLocker locker(m_mutex);
 #endif
         return static_cast<int const volatile &>(m_refCount);
@@ -101,9 +103,12 @@ protected:
     // Returns whether the pointer should be freed or not.
     bool derefBase()
     {
-#if USE(LOCKFREE_THREADSAFESHARED)
-        if (atomicDecrement(&m_refCount) <= 0)
+#if USE(LOCKFREE_THREADSAFEREFCOUNTED)
+        WTF_ANNOTATE_HAPPENS_BEFORE(&m_refCount);
+        if (atomicDecrement(&m_refCount) <= 0) {
+            WTF_ANNOTATE_HAPPENS_AFTER(&m_refCount);
             return true;
+        }
 #else
         int refCount;
         {
@@ -122,12 +127,12 @@ private:
     friend class CrossThreadRefCounted;
 
     int m_refCount;
-#if !USE(LOCKFREE_THREADSAFESHARED)
+#if !USE(LOCKFREE_THREADSAFEREFCOUNTED)
     mutable Mutex m_mutex;
 #endif
 };
 
-template<class T> class ThreadSafeShared : public ThreadSafeSharedBase {
+template<class T> class ThreadSafeRefCounted : public ThreadSafeRefCountedBase {
 public:
     void deref()
     {
@@ -136,13 +141,13 @@ public:
     }
 
 protected:
-    ThreadSafeShared()
+    ThreadSafeRefCounted()
     {
     }
 };
 
 } // namespace WTF
 
-using WTF::ThreadSafeShared;
+using WTF::ThreadSafeRefCounted;
 
-#endif // ThreadSafeShared_h
+#endif // ThreadSafeRefCounted_h
diff --git a/Source/JavaScriptCore/wtf/Threading.h b/Source/JavaScriptCore/wtf/Threading.h
index 044365f..b6f8c24 100644
--- a/Source/JavaScriptCore/wtf/Threading.h
+++ b/Source/JavaScriptCore/wtf/Threading.h
@@ -67,7 +67,7 @@
 #include <wtf/Locker.h>
 #include <wtf/MainThread.h>
 #include <wtf/Noncopyable.h>
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 #include <wtf/ThreadingPrimitives.h>
 
 // For portability, we do not use thread-safe statics natively supported by some compilers (e.g. gcc).
diff --git a/Source/JavaScriptCore/wtf/ThreadingPthreads.cpp b/Source/JavaScriptCore/wtf/ThreadingPthreads.cpp
index aa63f33..0ffcfe2 100644
--- a/Source/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/Source/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -55,6 +55,10 @@
 #include <wtf/PassOwnPtr.h>
 #endif
 
+#if OS(MAC_OS_X) && !defined(BUILDING_ON_LEOPARD)
+#include <objc/objc-auto.h>
+#endif
+
 namespace WTF {
 
 typedef HashMap<ThreadIdentifier, pthread_t> ThreadMap;
@@ -190,6 +194,12 @@ void initializeCurrentThreadInternal(const char* threadName)
     UNUSED_PARAM(threadName);
 #endif
 
+#if OS(MAC_OS_X) && !defined(BUILDING_ON_LEOPARD)
+    // All threads that potentially use APIs above the BSD layer must be registered with the Objective-C
+    // garbage collector in case API implementations use garbage-collected memory.
+    objc_registerThreadWithCollector();
+#endif
+
     ThreadIdentifier id = identifierByPthreadHandle(pthread_self());
     ASSERT(id);
     ThreadIdentifierData::initialize(id);
diff --git a/Source/JavaScriptCore/wtf/ThreadingWin.cpp b/Source/JavaScriptCore/wtf/ThreadingWin.cpp
index 4ca290f..c452205 100644
--- a/Source/JavaScriptCore/wtf/ThreadingWin.cpp
+++ b/Source/JavaScriptCore/wtf/ThreadingWin.cpp
@@ -332,6 +332,7 @@ bool PlatformCondition::timedWait(PlatformMutex& mutex, DWORD durationMillisecon
     res = ReleaseSemaphore(m_blockLock, 1, 0);
     ASSERT(res);
 
+    --mutex.m_recursionCount;
     LeaveCriticalSection(&mutex.m_internalMutex);
 
     // Main wait - use timeout.
@@ -365,6 +366,7 @@ bool PlatformCondition::timedWait(PlatformMutex& mutex, DWORD durationMillisecon
     }
 
     EnterCriticalSection (&mutex.m_internalMutex);
+    ++mutex.m_recursionCount;
 
     return !timedOut;
 }
diff --git a/Source/JavaScriptCore/wtf/Vector.h b/Source/JavaScriptCore/wtf/Vector.h
index 6d8dd4c..03c03d5 100644
--- a/Source/JavaScriptCore/wtf/Vector.h
+++ b/Source/JavaScriptCore/wtf/Vector.h
@@ -29,6 +29,7 @@
 #include "VectorTraits.h"
 #include <limits>
 #include <utility>
+#include <wtf/Alignment.h>
 
 #if PLATFORM(QT)
 #include <QDataStream>
@@ -39,17 +40,6 @@ namespace WTF {
     using std::min;
     using std::max;
 
-    // WTF_ALIGN_OF / WTF_ALIGNED
-    #if COMPILER(GCC) || COMPILER(MINGW) || COMPILER(RVCT) || COMPILER(WINSCW)
-        #define WTF_ALIGN_OF(type) __alignof__(type)
-        #define WTF_ALIGNED(variable_type, variable, n) variable_type variable __attribute__((__aligned__(n)))
-    #elif COMPILER(MSVC)
-        #define WTF_ALIGN_OF(type) __alignof(type)
-        #define WTF_ALIGNED(variable_type, variable, n) __declspec(align(n)) variable_type variable
-    #else
-        #error WTF_ALIGN macros need alignment control.
-    #endif
-
     #if COMPILER(GCC) && !COMPILER(INTEL) && (((__GNUC__ * 100) + __GNUC_MINOR__) >= 303)
         typedef char __attribute__((__may_alias__)) AlignedBufferChar; 
     #else
@@ -129,7 +119,11 @@ namespace WTF {
         {
             while (src != srcEnd) {
                 new (dst) T(*src);
+#if COMPILER(SUNCC) && __SUNPRO_CC <= 0x590
+                const_cast<T*>(src)->~T(); // Work around obscure SunCC 12 compiler bug.
+#else
                 src->~T();
+#endif
                 ++dst;
                 ++src;
             }
@@ -282,6 +276,7 @@ namespace WTF {
     public:
         void allocateBuffer(size_t newCapacity)
         {
+            ASSERT(newCapacity);
             m_capacity = newCapacity;
             if (newCapacity > std::numeric_limits<size_t>::max() / sizeof(T))
                 CRASH();
@@ -290,6 +285,7 @@ namespace WTF {
 
         bool tryAllocateBuffer(size_t newCapacity)
         {
+            ASSERT(newCapacity);
             if (newCapacity > std::numeric_limits<size_t>::max() / sizeof(T))
                 return false;
 
@@ -360,7 +356,10 @@ namespace WTF {
 
         VectorBuffer(size_t capacity)
         {
-            allocateBuffer(capacity);
+            // Calling malloc(0) might take a lock and may actually do an
+            // allocation on some systems (e.g. Brew).
+            if (capacity)
+                allocateBuffer(capacity);
         }
 
         ~VectorBuffer()
@@ -392,6 +391,7 @@ namespace WTF {
 
     template<typename T, size_t inlineCapacity>
     class VectorBuffer : private VectorBufferBase<T> {
+        WTF_MAKE_NONCOPYABLE(VectorBuffer);
     private:
         typedef VectorBufferBase<T> Base;
     public:
@@ -414,6 +414,7 @@ namespace WTF {
 
         void allocateBuffer(size_t newCapacity)
         {
+            // FIXME: This should ASSERT(!m_buffer) to catch misuse/leaks.
             if (newCapacity > inlineCapacity)
                 Base::allocateBuffer(newCapacity);
             else {
@@ -559,6 +560,7 @@ namespace WTF {
         T& last() { return at(size() - 1); }
         const T& last() const { return at(size() - 1); }
 
+        template<typename U> bool contains(const U&) const;
         template<typename U> size_t find(const U&) const;
         template<typename U> size_t reverseFind(const U&) const;
 
@@ -738,6 +740,13 @@ namespace WTF {
 
     template<typename T, size_t inlineCapacity>
     template<typename U>
+    bool Vector<T, inlineCapacity>::contains(const U& value) const
+    {
+        return find(value) != notFound;
+    }
+ 
+    template<typename T, size_t inlineCapacity>
+    template<typename U>
     size_t Vector<T, inlineCapacity>::find(const U& value) const
     {
         for (size_t i = 0; i < size(); ++i) {
diff --git a/Source/JavaScriptCore/wtf/VectorTraits.h b/Source/JavaScriptCore/wtf/VectorTraits.h
index 3f33b29..6777c9e 100644
--- a/Source/JavaScriptCore/wtf/VectorTraits.h
+++ b/Source/JavaScriptCore/wtf/VectorTraits.h
@@ -61,14 +61,10 @@ namespace WTF {
     template<typename T>
     struct VectorTraits : VectorTraitsBase<IsPod<T>::value, T> { };
 
-    struct SimpleClassVectorTraits
+    struct SimpleClassVectorTraits : VectorTraitsBase<false, void>
     {
-        static const bool needsDestruction = true;
-        static const bool needsInitialization = true;
         static const bool canInitializeWithMemset = true;
         static const bool canMoveWithMemcpy = true;
-        static const bool canCopyWithMemcpy = false;
-        static const bool canFillWithMemset = false;
         static const bool canCompareWithMemcmp = true;
     };
 
diff --git a/Source/JavaScriptCore/wtf/gobject/GOwnPtr.cpp b/Source/JavaScriptCore/wtf/gobject/GOwnPtr.cpp
index 8dcfb9e..7c51ee1 100644
--- a/Source/JavaScriptCore/wtf/gobject/GOwnPtr.cpp
+++ b/Source/JavaScriptCore/wtf/gobject/GOwnPtr.cpp
@@ -61,11 +61,6 @@ template <> void freeOwnedGPtr<GDir>(GDir* ptr)
         g_dir_close(ptr);
 }
 
-template <> void freeOwnedGPtr<GFile>(GFile* ptr)
-{
-    if (ptr)
-        g_object_unref(ptr);
-}
 } // namespace WTF
 
 #endif // ENABLE(GLIB_SUPPORT)
diff --git a/Source/JavaScriptCore/wtf/gobject/GOwnPtr.h b/Source/JavaScriptCore/wtf/gobject/GOwnPtr.h
index 4136f28..8c7e837 100644
--- a/Source/JavaScriptCore/wtf/gobject/GOwnPtr.h
+++ b/Source/JavaScriptCore/wtf/gobject/GOwnPtr.h
@@ -39,7 +39,6 @@ template<> void freeOwnedGPtr<GCond>(GCond*);
 template<> void freeOwnedGPtr<GMutex>(GMutex*);
 template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
 template<> void freeOwnedGPtr<GDir>(GDir*);
-template<> void freeOwnedGPtr<GFile>(GFile*);
 
 template <typename T> class GOwnPtr {
     WTF_MAKE_NONCOPYABLE(GOwnPtr);
diff --git a/Source/JavaScriptCore/wtf/gobject/GTypedefs.h b/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
index 8061e8a..c7f7ac4 100644
--- a/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
+++ b/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
@@ -61,7 +61,7 @@ typedef struct _GSource GSource;
 typedef struct _GVariant GVariant;
 typedef union _GdkEvent GdkEvent;
 
-#if PLATFORM(CAIRO)
+#if USE(CAIRO)
 typedef struct _cairo_surface cairo_surface_t;
 #endif
 
diff --git a/Source/JavaScriptCore/wtf/text/AtomicString.cpp b/Source/JavaScriptCore/wtf/text/AtomicString.cpp
index e0a866d..9dd655e 100644
--- a/Source/JavaScriptCore/wtf/text/AtomicString.cpp
+++ b/Source/JavaScriptCore/wtf/text/AtomicString.cpp
@@ -87,7 +87,7 @@ static inline PassRefPtr<StringImpl> addToStringTable(const T& value)
 struct CStringTranslator {
     static unsigned hash(const char* c)
     {
-        return StringImpl::computeHash(c);
+        return StringHasher::computeHash(c);
     }
 
     static bool equal(StringImpl* r, const char* s)
@@ -142,7 +142,7 @@ static inline bool equal(StringImpl* string, const UChar* characters, unsigned l
 
     // FIXME: perhaps we should have a more abstract macro that indicates when
     // going 4 bytes at a time is unsafe
-#if CPU(ARM) || CPU(SH4) || CPU(MIPS)
+#if CPU(ARM) || CPU(SH4) || CPU(MIPS) || CPU(SPARC)
     const UChar* stringCharacters = string->characters();
     for (unsigned i = 0; i != length; ++i) {
         if (*stringCharacters++ != *characters++)
@@ -176,7 +176,7 @@ bool operator==(const AtomicString& string, const Vector<UChar>& vector)
 struct UCharBufferTranslator {
     static unsigned hash(const UCharBuffer& buf)
     {
-        return StringImpl::computeHash(buf.s, buf.length);
+        return StringHasher::computeHash(buf.s, buf.length);
     }
 
     static bool equal(StringImpl* const& str, const UCharBuffer& buf)
@@ -201,7 +201,7 @@ struct HashAndCharacters {
 struct HashAndCharactersTranslator {
     static unsigned hash(const HashAndCharacters& buffer)
     {
-        ASSERT(buffer.hash == StringImpl::computeHash(buffer.characters, buffer.length));
+        ASSERT(buffer.hash == StringHasher::computeHash(buffer.characters, buffer.length));
         return buffer.hash;
     }
 
@@ -351,41 +351,14 @@ AtomicString AtomicString::lower() const
     return AtomicString(newImpl);
 }
 
-AtomicString AtomicString::fromUTF8(const char* characters, size_t length)
+AtomicString AtomicString::fromUTF8Internal(const char* charactersStart, const char* charactersEnd)
 {
-    if (!characters)
-        return AtomicString();
-
-    if (!length)
-        return emptyAtom;
-
-    HashAndUTF8Characters buffer;
-    buffer.characters = characters;
-    buffer.length = length;
-    buffer.hash = calculateStringHashFromUTF8(characters, characters + length, buffer.utf16Length);
-
-    if (!buffer.hash)
-        return AtomicString();
-
-    AtomicString atomicString;
-    atomicString.m_string = addToStringTable<HashAndUTF8Characters, HashAndUTF8CharactersTranslator>(buffer);
-    return atomicString;
-}
-
-AtomicString AtomicString::fromUTF8(const char* characters)
-{
-    if (!characters)
-        return AtomicString();
-
-    if (!*characters)
-        return emptyAtom;
-
     HashAndUTF8Characters buffer;
-    buffer.characters = characters;
-    buffer.hash = calculateStringHashAndLengthFromUTF8(characters, buffer.length, buffer.utf16Length);
+    buffer.characters = charactersStart;
+    buffer.hash = calculateStringHashAndLengthFromUTF8(charactersStart, charactersEnd, buffer.length, buffer.utf16Length);
 
     if (!buffer.hash)
-        return AtomicString();
+        return nullAtom;
 
     AtomicString atomicString;
     atomicString.m_string = addToStringTable<HashAndUTF8Characters, HashAndUTF8CharactersTranslator>(buffer);
diff --git a/Source/JavaScriptCore/wtf/text/AtomicString.h b/Source/JavaScriptCore/wtf/text/AtomicString.h
index ab5b366..440700c 100644
--- a/Source/JavaScriptCore/wtf/text/AtomicString.h
+++ b/Source/JavaScriptCore/wtf/text/AtomicString.h
@@ -95,7 +95,7 @@ public:
 
     static void remove(StringImpl*);
     
-#if PLATFORM(CF)
+#if USE(CF)
     AtomicString(CFStringRef s) :  m_string(add(String(s).impl())) { }
     CFStringRef createCFString() const { return m_string.createCFString(); }
 #endif    
@@ -127,6 +127,7 @@ private:
         return addSlowCase(r);
     }
     static PassRefPtr<StringImpl> addSlowCase(StringImpl*);
+    static AtomicString fromUTF8Internal(const char*, const char*);
 };
 
 inline bool operator==(const AtomicString& a, const AtomicString& b) { return a.impl() == b.impl(); }
@@ -154,20 +155,38 @@ inline bool equalIgnoringCase(const String& a, const AtomicString& b) { return e
 // Define external global variables for the commonly used atomic strings.
 // These are only usable from the main thread.
 #ifndef ATOMICSTRING_HIDE_GLOBALS
-    extern const JS_EXPORTDATA AtomicString nullAtom;
-    extern const JS_EXPORTDATA AtomicString emptyAtom;
-    extern const JS_EXPORTDATA AtomicString textAtom;
-    extern const JS_EXPORTDATA AtomicString commentAtom;
-    extern const JS_EXPORTDATA AtomicString starAtom;
-    extern const JS_EXPORTDATA AtomicString xmlAtom;
-    extern const JS_EXPORTDATA AtomicString xmlnsAtom;
+extern const JS_EXPORTDATA AtomicString nullAtom;
+extern const JS_EXPORTDATA AtomicString emptyAtom;
+extern const JS_EXPORTDATA AtomicString textAtom;
+extern const JS_EXPORTDATA AtomicString commentAtom;
+extern const JS_EXPORTDATA AtomicString starAtom;
+extern const JS_EXPORTDATA AtomicString xmlAtom;
+extern const JS_EXPORTDATA AtomicString xmlnsAtom;
+
+inline AtomicString AtomicString::fromUTF8(const char* characters, size_t length)
+{
+    if (!characters)
+        return nullAtom;
+    if (!length)
+        return emptyAtom;
+    return fromUTF8Internal(characters, characters + length);
+}
+
+inline AtomicString AtomicString::fromUTF8(const char* characters)
+{
+    if (!characters)
+        return nullAtom;
+    if (!*characters)
+        return emptyAtom;
+    return fromUTF8Internal(characters, 0);
+}
 #endif
 
-    // AtomicStringHash is the default hash for AtomicString
-    template<typename T> struct DefaultHash;
-    template<> struct DefaultHash<AtomicString> {
-        typedef AtomicStringHash Hash;
-    };
+// AtomicStringHash is the default hash for AtomicString
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<AtomicString> {
+    typedef AtomicStringHash Hash;
+};
 
 } // namespace WTF
 
diff --git a/Source/JavaScriptCore/wtf/text/StringConcatenate.h b/Source/JavaScriptCore/wtf/text/StringConcatenate.h
index 92a2d06..8500200 100644
--- a/Source/JavaScriptCore/wtf/text/StringConcatenate.h
+++ b/Source/JavaScriptCore/wtf/text/StringConcatenate.h
@@ -89,6 +89,34 @@ private:
 };
 
 template<>
+class StringTypeAdapter<const UChar*> {
+public:
+    StringTypeAdapter<const UChar*>(const UChar* buffer)
+        : m_buffer(buffer)
+    {
+        size_t len = 0;
+        while (m_buffer[len] != UChar(0))
+            len++;
+
+        if (len > std::numeric_limits<unsigned>::max())
+            CRASH();
+
+        m_length = len;
+    }
+
+    unsigned length() { return m_length; }
+
+    void writeTo(UChar* destination)
+    {
+        memcpy(destination, m_buffer, static_cast<size_t>(m_length) * sizeof(UChar));
+    }
+
+private:
+    const UChar* m_buffer;
+    unsigned m_length;
+};
+
+template<>
 class StringTypeAdapter<const char*> {
 public:
     StringTypeAdapter<const char*>(const char* buffer)
@@ -176,7 +204,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2)
     sumWithOverflow(length, adapter2.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -185,7 +213,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2)
     result += adapter1.length();
     adapter2.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3>
@@ -202,7 +230,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     sumWithOverflow(length, adapter3.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -213,7 +241,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     result += adapter2.length();
     adapter3.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
@@ -232,7 +260,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     sumWithOverflow(length, adapter4.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -245,7 +273,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     result += adapter3.length();
     adapter4.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
@@ -266,7 +294,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     sumWithOverflow(length, adapter5.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -281,7 +309,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     result += adapter4.length();
     adapter5.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
@@ -304,7 +332,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     sumWithOverflow(length, adapter6.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -321,7 +349,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     result += adapter5.length();
     adapter6.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
@@ -346,7 +374,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     sumWithOverflow(length, adapter7.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -365,7 +393,7 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     result += adapter6.length();
     adapter7.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
@@ -392,7 +420,57 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     sumWithOverflow(length, adapter8.length(), overflow);
     if (overflow)
         return 0;
-    PassRefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
+    if (!resultImpl)
+        return 0;
+
+    UChar* result = buffer;
+    adapter1.writeTo(result);
+    result += adapter1.length();
+    adapter2.writeTo(result);
+    result += adapter2.length();
+    adapter3.writeTo(result);
+    result += adapter3.length();
+    adapter4.writeTo(result);
+    result += adapter4.length();
+    adapter5.writeTo(result);
+    result += adapter5.length();
+    adapter6.writeTo(result);
+    result += adapter6.length();
+    adapter7.writeTo(result);
+    result += adapter7.length();
+    adapter8.writeTo(result);
+
+    return resultImpl.release();
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8, typename StringType9>
+PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8, StringType9 string9)
+{
+    StringTypeAdapter<StringType1> adapter1(string1);
+    StringTypeAdapter<StringType2> adapter2(string2);
+    StringTypeAdapter<StringType3> adapter3(string3);
+    StringTypeAdapter<StringType4> adapter4(string4);
+    StringTypeAdapter<StringType5> adapter5(string5);
+    StringTypeAdapter<StringType6> adapter6(string6);
+    StringTypeAdapter<StringType7> adapter7(string7);
+    StringTypeAdapter<StringType8> adapter8(string8);
+    StringTypeAdapter<StringType9> adapter9(string9);
+
+    UChar* buffer;
+    bool overflow = false;
+    unsigned length = adapter1.length();
+    sumWithOverflow(length, adapter2.length(), overflow);
+    sumWithOverflow(length, adapter3.length(), overflow);
+    sumWithOverflow(length, adapter4.length(), overflow);
+    sumWithOverflow(length, adapter5.length(), overflow);
+    sumWithOverflow(length, adapter6.length(), overflow);
+    sumWithOverflow(length, adapter7.length(), overflow);
+    sumWithOverflow(length, adapter8.length(), overflow);
+    sumWithOverflow(length, adapter9.length(), overflow);
+    if (overflow)
+        return 0;
+    RefPtr<StringImpl> resultImpl = StringImpl::tryCreateUninitialized(length, buffer);
     if (!resultImpl)
         return 0;
 
@@ -412,10 +490,13 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     adapter7.writeTo(result);
     result += adapter7.length();
     adapter8.writeTo(result);
+    result += adapter8.length();
+    adapter9.writeTo(result);
 
-    return resultImpl;
+    return resultImpl.release();
 }
 
+
 // Convenience only.
 template<typename StringType1>
 String makeString(StringType1 string1)
@@ -426,64 +507,73 @@ String makeString(StringType1 string1)
 template<typename StringType1, typename StringType2>
 String makeString(StringType1 string1, StringType2 string2)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3>
 String makeString(StringType1 string1, StringType2 string2, StringType3 string3)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
 String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
 String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
 String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
 String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
 String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8)
 {
-    PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7, string8);
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7, string8);
+    if (!resultImpl)
+        CRASH();
+    return resultImpl.release();
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8, typename StringType9>
+String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8, StringType9 string9)
+{
+    RefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7, string8, string9);
     if (!resultImpl)
         CRASH();
-    return resultImpl;
+    return resultImpl.release();
 }
 
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/text/StringHash.h b/Source/JavaScriptCore/wtf/text/StringHash.h
index d7aabdb..c47c1d8 100644
--- a/Source/JavaScriptCore/wtf/text/StringHash.h
+++ b/Source/JavaScriptCore/wtf/text/StringHash.h
@@ -104,7 +104,7 @@ namespace WTF {
 
         static unsigned hash(const UChar* data, unsigned length)
         {
-            return StringHasher::createHash<UChar, foldCase<UChar> >(data, length);
+            return StringHasher::computeHash<UChar, foldCase<UChar> >(data, length);
         }
 
         static unsigned hash(StringImpl* str)
@@ -114,7 +114,7 @@ namespace WTF {
 
         static unsigned hash(const char* data, unsigned length)
         {
-            return StringHasher::createHash<char, foldCase<char> >(data, length);
+            return StringHasher::computeHash<char, foldCase<char> >(data, length);
         }
 
         static bool equal(const StringImpl* a, const StringImpl* b)
@@ -179,11 +179,7 @@ namespace WTF {
         }
     };
 
-    template<> struct HashTraits<String> : GenericHashTraits<String> {
-        static const bool emptyValueIsZero = true;
-        static void constructDeletedValue(String& slot) { new (&slot) String(HashTableDeletedValue); }
-        static bool isDeletedValue(const String& slot) { return slot.isHashTableDeletedValue(); }
-    };
+    template<> struct HashTraits<String> : SimpleClassHashTraits<String> { };
 
 }
 
diff --git a/Source/JavaScriptCore/wtf/text/StringImpl.cpp b/Source/JavaScriptCore/wtf/text/StringImpl.cpp
index c83ec42..9afd1d2 100644
--- a/Source/JavaScriptCore/wtf/text/StringImpl.cpp
+++ b/Source/JavaScriptCore/wtf/text/StringImpl.cpp
@@ -458,14 +458,14 @@ intptr_t StringImpl::toIntPtr(bool* ok)
     return charactersToIntPtr(m_data, m_length, ok);
 }
 
-double StringImpl::toDouble(bool* ok)
+double StringImpl::toDouble(bool* ok, bool* didReadNumber)
 {
-    return charactersToDouble(m_data, m_length, ok);
+    return charactersToDouble(m_data, m_length, ok, didReadNumber);
 }
 
-float StringImpl::toFloat(bool* ok)
+float StringImpl::toFloat(bool* ok, bool* didReadNumber)
 {
-    return charactersToFloat(m_data, m_length, ok);
+    return charactersToFloat(m_data, m_length, ok, didReadNumber);
 }
 
 static bool equal(const UChar* a, const char* b, int length)
@@ -1005,15 +1005,23 @@ bool equalIgnoringNullity(StringImpl* a, StringImpl* b)
     return false;
 }
 
-WTF::Unicode::Direction StringImpl::defaultWritingDirection()
+WTF::Unicode::Direction StringImpl::defaultWritingDirection(bool* hasStrongDirectionality)
 {
     for (unsigned i = 0; i < m_length; ++i) {
         WTF::Unicode::Direction charDirection = WTF::Unicode::direction(m_data[i]);
-        if (charDirection == WTF::Unicode::LeftToRight)
+        if (charDirection == WTF::Unicode::LeftToRight) {
+            if (hasStrongDirectionality)
+                *hasStrongDirectionality = true;
             return WTF::Unicode::LeftToRight;
-        if (charDirection == WTF::Unicode::RightToLeft || charDirection == WTF::Unicode::RightToLeftArabic)
+        }
+        if (charDirection == WTF::Unicode::RightToLeft || charDirection == WTF::Unicode::RightToLeftArabic) {
+            if (hasStrongDirectionality)
+                *hasStrongDirectionality = true;
             return WTF::Unicode::RightToLeft;
+        }
     }
+    if (hasStrongDirectionality)
+        *hasStrongDirectionality = false;
     return WTF::Unicode::LeftToRight;
 }
 
diff --git a/Source/JavaScriptCore/wtf/text/StringImpl.h b/Source/JavaScriptCore/wtf/text/StringImpl.h
index 25411e1..81911b3 100644
--- a/Source/JavaScriptCore/wtf/text/StringImpl.h
+++ b/Source/JavaScriptCore/wtf/text/StringImpl.h
@@ -34,7 +34,7 @@
 #include <wtf/text/StringImplBase.h>
 #include <wtf/unicode/Unicode.h>
 
-#if PLATFORM(CF)
+#if USE(CF)
 typedef const struct __CFString * CFStringRef;
 #endif
 
@@ -136,7 +136,7 @@ private:
     {
         ASSERT(!isStatic());
         ASSERT(!m_hash);
-        ASSERT(hash == computeHash(m_data, m_length));
+        ASSERT(hash == StringHasher::computeHash(m_data, m_length));
         m_hash = hash;
     }
 
@@ -235,11 +235,8 @@ public:
             m_refCountAndFlags &= ~s_refCountFlagIsAtomic;
     }
 
-    unsigned hash() const { if (!m_hash) m_hash = computeHash(m_data, m_length); return m_hash; }
+    unsigned hash() const { if (!m_hash) m_hash = StringHasher::computeHash(m_data, m_length); return m_hash; }
     unsigned existingHash() const { ASSERT(m_hash); return m_hash; }
-    static unsigned computeHash(const UChar* data, unsigned length) { return WTF::StringHasher::createHash<UChar>(data, length); }
-    static unsigned computeHash(const char* data, unsigned length) { return WTF::StringHasher::createHash<char>(data, length); }
-    static unsigned computeHash(const char* data) { return WTF::StringHasher::createHash<char>(data); }
 
     ALWAYS_INLINE void deref() { m_refCountAndFlags -= s_refCountIncrement; if (!(m_refCountAndFlags & (s_refCountMask | s_refCountFlagStatic))) delete this; }
     ALWAYS_INLINE bool hasOneRef() const { return (m_refCountAndFlags & (s_refCountMask | s_refCountFlagStatic)) == s_refCountIncrement; }
@@ -281,8 +278,8 @@ public:
     uint64_t toUInt64(bool* ok = 0); // ignores trailing garbage
     intptr_t toIntPtr(bool* ok = 0); // ignores trailing garbage
 
-    double toDouble(bool* ok = 0);
-    float toFloat(bool* ok = 0);
+    double toDouble(bool* ok = 0, bool* didReadNumber = 0);
+    float toFloat(bool* ok = 0, bool* didReadNumber = 0);
 
     PassRefPtr<StringImpl> lower();
     PassRefPtr<StringImpl> upper();
@@ -316,9 +313,9 @@ public:
     PassRefPtr<StringImpl> replace(StringImpl*, StringImpl*);
     PassRefPtr<StringImpl> replace(unsigned index, unsigned len, StringImpl*);
 
-    WTF::Unicode::Direction defaultWritingDirection();
+    WTF::Unicode::Direction defaultWritingDirection(bool* hasStrongDirectionality = 0);
 
-#if PLATFORM(CF)
+#if USE(CF)
     CFStringRef createCFString();
 #endif
 #ifdef __OBJC__
diff --git a/Source/JavaScriptCore/wtf/text/StringStatics.cpp b/Source/JavaScriptCore/wtf/text/StringStatics.cpp
index 5654044..ce08728 100644
--- a/Source/JavaScriptCore/wtf/text/StringStatics.cpp
+++ b/Source/JavaScriptCore/wtf/text/StringStatics.cpp
@@ -30,6 +30,7 @@
 #endif
 
 #include "AtomicString.h"
+#include "DynamicAnnotations.h"
 #include "StaticConstructors.h"
 #include "StringImpl.h"
 
@@ -46,6 +47,7 @@ StringImpl* StringImpl::empty()
     // PCRE goes away.
     static UChar emptyUCharData = 0;
     DEFINE_STATIC_LOCAL(StringImpl, emptyString, (&emptyUCharData, 0, ConstructStaticString));
+    WTF_ANNOTATE_BENIGN_RACE(&emptyString, "Benign race on StringImpl::emptyString reference counter");
     return &emptyString;
 }
 
diff --git a/Source/JavaScriptCore/wtf/text/TextPosition.h b/Source/JavaScriptCore/wtf/text/TextPosition.h
index 9f426ea..bb3ffa4 100644
--- a/Source/JavaScriptCore/wtf/text/TextPosition.h
+++ b/Source/JavaScriptCore/wtf/text/TextPosition.h
@@ -89,7 +89,7 @@ public:
     ZeroBasedNumber() {}
 
     int zeroBasedInt() const { return m_value; }
-
+    int convertAsOneBasedInt() const { return m_value + 1; }
     OneBasedNumber convertToOneBased() const;
 
     bool operator==(ZeroBasedNumber other) { return m_value == other.m_value; }
diff --git a/Source/JavaScriptCore/wtf/text/WTFString.cpp b/Source/JavaScriptCore/wtf/text/WTFString.cpp
index b9b4e74..d862f96 100644
--- a/Source/JavaScriptCore/wtf/text/WTFString.cpp
+++ b/Source/JavaScriptCore/wtf/text/WTFString.cpp
@@ -561,24 +561,28 @@ intptr_t String::toIntPtr(bool* ok) const
     return m_impl->toIntPtr(ok);
 }
 
-double String::toDouble(bool* ok) const
+double String::toDouble(bool* ok, bool* didReadNumber) const
 {
     if (!m_impl) {
         if (ok)
             *ok = false;
+        if (didReadNumber)
+            *didReadNumber = false;
         return 0.0;
     }
-    return m_impl->toDouble(ok);
+    return m_impl->toDouble(ok, didReadNumber);
 }
 
-float String::toFloat(bool* ok) const
+float String::toFloat(bool* ok, bool* didReadNumber) const
 {
     if (!m_impl) {
         if (ok)
             *ok = false;
+        if (didReadNumber)
+            *didReadNumber = false;
         return 0.0f;
     }
-    return m_impl->toFloat(ok);
+    return m_impl->toFloat(ok, didReadNumber);
 }
 
 String String::threadsafeCopy() const
@@ -937,11 +941,13 @@ intptr_t charactersToIntPtr(const UChar* data, size_t length, bool* ok)
     return toIntegralType<intptr_t>(data, lengthOfCharactersAsInteger(data, length), ok, 10);
 }
 
-double charactersToDouble(const UChar* data, size_t length, bool* ok)
+double charactersToDouble(const UChar* data, size_t length, bool* ok, bool* didReadNumber)
 {
     if (!length) {
         if (ok)
             *ok = false;
+        if (didReadNumber)
+            *didReadNumber = false;
         return 0.0;
     }
 
@@ -949,17 +955,20 @@ double charactersToDouble(const UChar* data, size_t length, bool* ok)
     for (unsigned i = 0; i < length; ++i)
         bytes[i] = data[i] < 0x7F ? data[i] : '?';
     bytes[length] = '\0';
+    char* start = bytes.data();
     char* end;
-    double val = WTF::strtod(bytes.data(), &end);
+    double val = WTF::strtod(start, &end);
     if (ok)
         *ok = (end == 0 || *end == '\0');
+    if (didReadNumber)
+        *didReadNumber = end - start;
     return val;
 }
 
-float charactersToFloat(const UChar* data, size_t length, bool* ok)
+float charactersToFloat(const UChar* data, size_t length, bool* ok, bool* didReadNumber)
 {
     // FIXME: This will return ok even when the string fits into a double but not a float.
-    return static_cast<float>(charactersToDouble(data, length, ok));
+    return static_cast<float>(charactersToDouble(data, length, ok, didReadNumber));
 }
 
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/text/WTFString.h b/Source/JavaScriptCore/wtf/text/WTFString.h
index 0aee2ef..b593d20 100644
--- a/Source/JavaScriptCore/wtf/text/WTFString.h
+++ b/Source/JavaScriptCore/wtf/text/WTFString.h
@@ -31,7 +31,7 @@
 #include <objc/objc.h>
 #endif
 
-#if PLATFORM(CF)
+#if USE(CF)
 typedef const struct __CFString * CFStringRef;
 #endif
 
@@ -79,8 +79,8 @@ int64_t charactersToInt64(const UChar*, size_t, bool* ok = 0); // ignores traili
 uint64_t charactersToUInt64(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
 intptr_t charactersToIntPtr(const UChar*, size_t, bool* ok = 0); // ignores trailing garbage
 
-double charactersToDouble(const UChar*, size_t, bool* ok = 0);
-float charactersToFloat(const UChar*, size_t, bool* ok = 0);
+double charactersToDouble(const UChar*, size_t, bool* ok = 0, bool* didReadNumber = 0);
+float charactersToFloat(const UChar*, size_t, bool* ok = 0, bool* didReadNumber = 0);
 
 template<bool isSpecialCharacter(UChar)> bool isAllSpecialCharacters(const UChar*, size_t);
 
@@ -92,6 +92,11 @@ public:
     // Construct a string with UTF-16 data.
     String(const UChar* characters, unsigned length);
 
+    // Construct a string by copying the contents of a vector.  To avoid
+    // copying, consider using String::adopt instead.
+    template<size_t inlineCapacity>
+    explicit String(const Vector<UChar, inlineCapacity>&);
+
     // Construct a string with UTF-16 data, from a null-terminated source.
     String(const UChar*);
 
@@ -264,8 +269,8 @@ public:
     int64_t toInt64(bool* ok = 0) const;
     uint64_t toUInt64(bool* ok = 0) const;
     intptr_t toIntPtr(bool* ok = 0) const;
-    double toDouble(bool* ok = 0) const;
-    float toFloat(bool* ok = 0) const;
+    double toDouble(bool* ok = 0, bool* didReadNumber = 0) const;
+    float toFloat(bool* ok = 0, bool* didReadNumber = 0) const;
 
     bool percentage(int& percentage) const;
 
@@ -284,7 +289,7 @@ public:
     operator UnspecifiedBoolTypeA() const;
     operator UnspecifiedBoolTypeB() const;
 
-#if PLATFORM(CF)
+#if USE(CF)
     String(CFStringRef);
     CFStringRef createCFString() const;
 #endif
@@ -326,7 +331,14 @@ public:
     static String fromUTF8WithLatin1Fallback(const char*, size_t);
     
     // Determines the writing direction using the Unicode Bidi Algorithm rules P2 and P3.
-    WTF::Unicode::Direction defaultWritingDirection() const { return m_impl ? m_impl->defaultWritingDirection() : WTF::Unicode::LeftToRight; }
+    WTF::Unicode::Direction defaultWritingDirection(bool* hasStrongDirectionality = 0) const
+    {
+        if (m_impl)
+            return m_impl->defaultWritingDirection(hasStrongDirectionality);
+        if (hasStrongDirectionality)
+            *hasStrongDirectionality = false;
+        return WTF::Unicode::LeftToRight;
+    }
 
     bool containsOnlyASCII() const { return charactersAreAllASCII(characters(), length()); }
     bool containsOnlyLatin1() const { return charactersAreAllLatin1(characters(), length()); }
@@ -378,6 +390,12 @@ inline void swap(String& a, String& b) { a.swap(b); }
 
 // Definitions of string operations
 
+template<size_t inlineCapacity>
+String::String(const Vector<UChar, inlineCapacity>& vector)
+    : m_impl(vector.size() ? StringImpl::create(vector.data(), vector.size()) : 0)
+{
+}
+
 #ifdef __OBJC__
 // This is for situations in WebKit where the long standing behavior has been
 // "nil if empty", so we try to maintain longstanding behavior for the sake of
@@ -481,10 +499,7 @@ template<> struct DefaultHash<String> {
     typedef StringHash Hash;
 };
 
-template <> struct VectorTraits<String> : SimpleClassVectorTraits
-{
-    static const bool canInitializeWithMemset = true;
-};
+template <> struct VectorTraits<String> : SimpleClassVectorTraits { };
 
 }
 
diff --git a/Source/JavaScriptCore/wtf/unicode/CharacterNames.h b/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
index 3d093a6..10fdbf0 100644
--- a/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
+++ b/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
@@ -85,6 +85,7 @@ const UChar yenSign = 0x00A5;
 const UChar zeroWidthJoiner = 0x200D;
 const UChar zeroWidthNonJoiner = 0x200C;
 const UChar zeroWidthSpace = 0x200B;
+const UChar zeroWidthNoBreakSpace = 0xFEFF;
 
 } // namespace Unicode
 } // namespace WTF
@@ -138,5 +139,6 @@ using WTF::Unicode::yenSign;
 using WTF::Unicode::zeroWidthJoiner;
 using WTF::Unicode::zeroWidthNonJoiner;
 using WTF::Unicode::zeroWidthSpace;
+using WTF::Unicode::zeroWidthNoBreakSpace;
 
 #endif // CharacterNames_h
diff --git a/Source/JavaScriptCore/wtf/unicode/UTF8.cpp b/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
index 4c3738b..3a88906 100644
--- a/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
+++ b/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
@@ -314,12 +314,12 @@ ConversionResult convertUTF8ToUTF16(
     return result;
 }
 
-static inline unsigned calculateStringHashAndLengthFromUTF8Internal(const char* data, const char* dataEnd, unsigned& dataLength, unsigned& utf16Length)
+unsigned calculateStringHashAndLengthFromUTF8(const char* data, const char* dataEnd, unsigned& dataLength, unsigned& utf16Length)
 {
     if (!data)
         return 0;
 
-    WTF::StringHasher stringHasher;
+    StringHasher stringHasher;
     dataLength = 0;
     utf16Length = 0;
 
@@ -365,17 +365,6 @@ static inline unsigned calculateStringHashAndLengthFromUTF8Internal(const char*
     return stringHasher.hash();
 }
 
-unsigned calculateStringHashFromUTF8(const char* data, const char* dataEnd, unsigned& utf16Length)
-{
-    unsigned dataLength;
-    return calculateStringHashAndLengthFromUTF8Internal(data, dataEnd, dataLength, utf16Length);
-}
-
-unsigned calculateStringHashAndLengthFromUTF8(const char* data, unsigned& dataLength, unsigned& utf16Length)
-{
-    return calculateStringHashAndLengthFromUTF8Internal(data, 0, dataLength, utf16Length);
-}
-
 bool equalUTF16WithUTF8(const UChar* a, const UChar* aEnd, const char* b, const char* bEnd)
 {
     while (b < bEnd) {
diff --git a/Source/JavaScriptCore/wtf/unicode/UTF8.h b/Source/JavaScriptCore/wtf/unicode/UTF8.h
index bbfaa84..7b7b75d 100644
--- a/Source/JavaScriptCore/wtf/unicode/UTF8.h
+++ b/Source/JavaScriptCore/wtf/unicode/UTF8.h
@@ -70,8 +70,7 @@ namespace Unicode {
                     const UChar** sourceStart, const UChar* sourceEnd, 
                     char** targetStart, char* targetEnd, bool strict = true);
 
-    unsigned calculateStringHashFromUTF8(const char* data, const char* dataEnd, unsigned& utf16Length);
-    unsigned calculateStringHashAndLengthFromUTF8(const char* data, unsigned& dataLength, unsigned& utf16Length);
+    unsigned calculateStringHashAndLengthFromUTF8(const char* data, const char* dataEnd, unsigned& dataLength, unsigned& utf16Length);
 
     bool equalUTF16WithUTF8(const UChar* a, const UChar* aEnd, const char* b, const char* bEnd);
 
diff --git a/Source/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp b/Source/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp
index 805b114..ca27ba2 100644
--- a/Source/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp
+++ b/Source/JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp
@@ -59,7 +59,7 @@ Collator::Collator(const char* locale)
 
 PassOwnPtr<Collator> Collator::userDefault()
 {
-#if OS(DARWIN) && PLATFORM(CF)
+#if OS(DARWIN) && USE(CF)
     // Mac OS X doesn't set UNIX locale to match user-selected one, so ICU default doesn't work.
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !OS(IOS)
     RetainPtr<CFLocaleRef> currentLocale(AdoptCF, CFLocaleCopyCurrent());
diff --git a/Source/JavaScriptCore/wtf/wtf.pri b/Source/JavaScriptCore/wtf/wtf.pri
index 3be3b5f..5f15eb0 100644
--- a/Source/JavaScriptCore/wtf/wtf.pri
+++ b/Source/JavaScriptCore/wtf/wtf.pri
@@ -23,6 +23,7 @@ SOURCES += \
     wtf/PageBlock.cpp \
     wtf/RandomNumber.cpp \
     wtf/RefCountedLeakCounter.cpp \
+    wtf/SHA1.cpp \
     wtf/StackBounds.cpp \
     wtf/TCSystemAlloc.cpp \
     wtf/ThreadingNone.cpp \
diff --git a/Source/JavaScriptCore/wtf/wx/StringWx.cpp b/Source/JavaScriptCore/wtf/wx/StringWx.cpp
index fe0fd89..d5f6c57 100644
--- a/Source/JavaScriptCore/wtf/wx/StringWx.cpp
+++ b/Source/JavaScriptCore/wtf/wx/StringWx.cpp
@@ -25,12 +25,15 @@
 
 #include "config.h"
 
-#include <wtf/text/CString.h>
-#include <wtf/text/WTFString.h>
-
+// The wx headers must come first in this case, because the wtf/text headers
+// import windows.h, and we need to allow the wx headers to set its configuration
+// first.
 #include <wx/defs.h>
 #include <wx/string.h>
 
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
 namespace WTF {
 
 String::String(const wxString& wxstr)
@@ -39,9 +42,10 @@ String::String(const wxString& wxstr)
     #error "This code only works in Unicode build of wxWidgets"
 #endif
 
-#if SIZEOF_WCHAR_T == U_SIZEOF_UCHAR
+#if SIZEOF_WCHAR_T == 2
 
-    m_impl = StringImpl::create(wxstr.wc_str(), wxstr.length());
+    const UChar* str = wxstr.wc_str(); 
+    const size_t len = wxstr.length(); 
 
 #else // SIZEOF_WCHAR_T == 4
 
@@ -58,13 +62,18 @@ String::String(const wxString& wxstr)
 #endif
     size_t wideLength = wxstr.length();
 
-    UChar* data;
     wxMBConvUTF16 conv;
-    unsigned utf16Length = conv.FromWChar(0, 0, wideString, wideLength);
-    m_impl = StringImpl::createUninitialized(utf16Length, data);
-    conv.FromWChar((char*)data, utf16Length, wideString, wideLength);
 
-#endif // SIZEOF_WCHAR_T == 4
+    const size_t utf16bufLen = conv.FromWChar(0, 0, wideString, wideLength); 
+    wxCharBuffer utf16buf(utf16bufLen); 
+
+    const UChar* str = (const UChar*)utf16buf.data(); 
+    size_t len = conv.FromWChar(utf16buf.data(), utf16bufLen, wideString, wideLength) / 2; 
+
+#endif // SIZEOF_WCHAR_T == 2
+
+    m_impl = StringImpl::create(str, len);
+
 }
 
 String::operator wxString() const
diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
index 37d44f7..d8c5d27 100644
--- a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
+++ b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
@@ -1234,6 +1234,10 @@ public:
             if (input.checkInput(currentTerm().checkInputCount))
                 MATCH_NEXT();
             BACKTRACK();
+
+            case ByteTerm::TypeUncheckInput:
+                input.uncheckInput(currentTerm().checkInputCount);
+                MATCH_NEXT();
         }
 
         // We should never fall-through to here.
@@ -1354,6 +1358,10 @@ public:
             case ByteTerm::TypeCheckInput:
                 input.uncheckInput(currentTerm().checkInputCount);
                 BACKTRACK();
+
+            case ByteTerm::TypeUncheckInput:
+                input.checkInput(currentTerm().checkInputCount);
+                BACKTRACK();
         }
 
         ASSERT_NOT_REACHED();
@@ -1453,6 +1461,11 @@ public:
         m_bodyDisjunction->terms.append(ByteTerm::CheckInput(count));
     }
 
+    void uncheckInput(unsigned count)
+    {
+        m_bodyDisjunction->terms.append(ByteTerm::UncheckInput(count));
+    }
+    
     void assertionBOL(int inputPosition)
     {
         m_bodyDisjunction->terms.append(ByteTerm::BOL(inputPosition));
@@ -1849,10 +1862,21 @@ public:
 
                     ASSERT(currentCountAlreadyChecked >= static_cast<unsigned>(term.inputPosition));
                     int positiveInputOffset = currentCountAlreadyChecked - term.inputPosition;
+                    int uncheckAmount = positiveInputOffset - term.parentheses.disjunction->m_minimumSize;
+
+                    if (uncheckAmount > 0) {
+                        uncheckInput(uncheckAmount);
+                        currentCountAlreadyChecked -= uncheckAmount;
+                    } else
+                        uncheckAmount = 0;
 
                     atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invert(), term.frameLocation, alternativeFrameLocation);
                     emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, positiveInputOffset, true);
                     atomParentheticalAssertionEnd(0, term.frameLocation, term.quantityCount, term.quantityType);
+                    if (uncheckAmount) {
+                        checkInput(uncheckAmount);
+                        currentCountAlreadyChecked += uncheckAmount;
+                    }
                     break;
                 }
                 }
diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.h b/Source/JavaScriptCore/yarr/YarrInterpreter.h
index eea5266..a9f4d48 100644
--- a/Source/JavaScriptCore/yarr/YarrInterpreter.h
+++ b/Source/JavaScriptCore/yarr/YarrInterpreter.h
@@ -70,6 +70,7 @@ struct ByteTerm {
         TypeParentheticalAssertionBegin,
         TypeParentheticalAssertionEnd,
         TypeCheckInput,
+        TypeUncheckInput,
     } type;
     union {
         struct {
@@ -205,6 +206,13 @@ struct ByteTerm {
         return term;
     }
 
+    static ByteTerm UncheckInput(unsigned count)
+    {
+        ByteTerm term(TypeUncheckInput);
+        term.checkInputCount = count;
+        return term;
+    }
+    
     static ByteTerm EOL(int inputPos)
     {
         ByteTerm term(TypeAssertionEOL);
diff --git a/Source/JavaScriptCore/yarr/YarrJIT.cpp b/Source/JavaScriptCore/yarr/YarrJIT.cpp
index e34e6f4..f74107b 100644
--- a/Source/JavaScriptCore/yarr/YarrJIT.cpp
+++ b/Source/JavaScriptCore/yarr/YarrJIT.cpp
@@ -59,6 +59,16 @@ class YarrGenerator : private MacroAssembler {
     static const RegisterID regT1 = MIPSRegisters::t5;
 
     static const RegisterID returnRegister = MIPSRegisters::v0;
+#elif CPU(SH4)
+    static const RegisterID input = SH4Registers::r4;
+    static const RegisterID index = SH4Registers::r5;
+    static const RegisterID length = SH4Registers::r6;
+    static const RegisterID output = SH4Registers::r7;
+
+    static const RegisterID regT0 = SH4Registers::r0;
+    static const RegisterID regT1 = SH4Registers::r1;
+
+    static const RegisterID returnRegister = SH4Registers::r0;
 #elif CPU(X86)
     static const RegisterID input = X86Registers::eax;
     static const RegisterID index = X86Registers::edx;
@@ -157,7 +167,7 @@ class YarrGenerator : private MacroAssembler {
         }
         Jump unicodeFail;
         if (charClass->m_matchesUnicode.size() || charClass->m_rangesUnicode.size()) {
-            Jump isAscii = branch32(LessThanOrEqual, character, Imm32(0x7f));
+            Jump isAscii = branch32(LessThanOrEqual, character, TrustedImm32(0x7f));
 
             if (charClass->m_matchesUnicode.size()) {
                 for (unsigned i = 0; i < charClass->m_matchesUnicode.size(); ++i) {
@@ -207,9 +217,9 @@ class YarrGenerator : private MacroAssembler {
             }
 
             if (unsigned countAZaz = matchesAZaz.size()) {
-                or32(Imm32(32), character);
+                or32(TrustedImm32(32), character);
                 for (unsigned i = 0; i < countAZaz; ++i)
-                    matchDest.append(branch32(Equal, character, Imm32(matchesAZaz[i])));
+                    matchDest.append(branch32(Equal, character, TrustedImm32(matchesAZaz[i])));
             }
         }
 
@@ -265,14 +275,14 @@ class YarrGenerator : private MacroAssembler {
         poke(reg, frameLocation);
     }
 
-    void storeToFrame(Imm32 imm, unsigned frameLocation)
+    void storeToFrame(TrustedImm32 imm, unsigned frameLocation)
     {
         poke(imm, frameLocation);
     }
 
     DataLabelPtr storeToFrameWithPatch(unsigned frameLocation)
     {
-        return storePtrWithPatch(ImmPtr(0), Address(stackPointerRegister, frameLocation * sizeof(void*)));
+        return storePtrWithPatch(TrustedImmPtr(0), Address(stackPointerRegister, frameLocation * sizeof(void*)));
     }
 
     void loadFromFrame(unsigned frameLocation, RegisterID reg)
@@ -1109,11 +1119,11 @@ class YarrGenerator : private MacroAssembler {
             if (m_term.quantityType == QuantifierGreedy) {
                 // If this is -1 we have now tested with both with and without the parens.
                 generator->loadFromFrame(parenthesesFrameLocation, indexTemporary);
-                m_backtrack.jumpToBacktrack(generator, generator->branch32(Equal, indexTemporary, Imm32(-1)));
+                m_backtrack.jumpToBacktrack(generator, generator->branch32(Equal, indexTemporary, TrustedImm32(-1)));
             } else if (m_term.quantityType == QuantifierNonGreedy) {
                 // If this is -1 we have now tested with both with and without the parens.
                 generator->loadFromFrame(parenthesesFrameLocation, indexTemporary);
-                generator->branch32(Equal, indexTemporary, Imm32(-1)).linkTo(m_nonGreedyTryParentheses, generator);
+                generator->branch32(Equal, indexTemporary, TrustedImm32(-1)).linkTo(m_nonGreedyTryParentheses, generator);
             }
 
             if (!m_doDirectBacktrack)
@@ -1126,10 +1136,10 @@ class YarrGenerator : private MacroAssembler {
             m_withinBacktrackJumps.link(generator);
 
             if (m_term.capture())
-                generator->store32(Imm32(-1), Address(output, (m_term.parentheses.subpatternId << 1) * sizeof(int)));
+                generator->store32(TrustedImm32(-1), Address(output, (m_term.parentheses.subpatternId << 1) * sizeof(int)));
 
             if (m_term.quantityType == QuantifierGreedy) {
-                generator->storeToFrame(Imm32(-1), parenthesesFrameLocation);
+                generator->storeToFrame(TrustedImm32(-1), parenthesesFrameLocation);
                 generator->jump().linkTo(m_fallThrough, generator);
                 nextBacktrackFallThrough = false;
             } else if (!nextBacktrackFallThrough)
@@ -1271,7 +1281,7 @@ class YarrGenerator : private MacroAssembler {
 
         if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
             readCharacter(state.inputOffset(), character);
-            or32(Imm32(32), character);
+            or32(TrustedImm32(32), character);
             state.jumpToBacktrack(this, branch32(NotEqual, character, Imm32(Unicode::toLower(ch))));
         } else {
             ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
@@ -1316,13 +1326,13 @@ class YarrGenerator : private MacroAssembler {
         Label loop(this);
         if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
             load16(BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), character);
-            or32(Imm32(32), character);
+            or32(TrustedImm32(32), character);
             state.jumpToBacktrack(this, branch32(NotEqual, character, Imm32(Unicode::toLower(ch))));
         } else {
             ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
             state.jumpToBacktrack(this, branch16(NotEqual, BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), Imm32(ch)));
         }
-        add32(Imm32(1), countRegister);
+        add32(TrustedImm32(1), countRegister);
         branch32(NotEqual, countRegister, index).linkTo(loop, this);
     }
 
@@ -1333,22 +1343,22 @@ class YarrGenerator : private MacroAssembler {
         PatternTerm& term = state.term();
         UChar ch = term.patternCharacter;
 
-        move(Imm32(0), countRegister);
+        move(TrustedImm32(0), countRegister);
 
         JumpList failures;
         Label loop(this);
         failures.append(atEndOfInput());
         if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
             readCharacter(state.inputOffset(), character);
-            or32(Imm32(32), character);
+            or32(TrustedImm32(32), character);
             failures.append(branch32(NotEqual, character, Imm32(Unicode::toLower(ch))));
         } else {
             ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
             failures.append(jumpIfCharNotEquals(ch, state.inputOffset()));
         }
 
-        add32(Imm32(1), countRegister);
-        add32(Imm32(1), index);
+        add32(TrustedImm32(1), countRegister);
+        add32(TrustedImm32(1), index);
         if (term.quantityCount != quantifyInfinite) {
             branch32(NotEqual, countRegister, Imm32(term.quantityCount)).linkTo(loop, this);
             failures.append(jump());
@@ -1358,8 +1368,8 @@ class YarrGenerator : private MacroAssembler {
         Label backtrackBegin(this);
         loadFromFrame(term.frameLocation, countRegister);
         state.jumpToBacktrack(this, branchTest32(Zero, countRegister));
-        sub32(Imm32(1), countRegister);
-        sub32(Imm32(1), index);
+        sub32(TrustedImm32(1), countRegister);
+        sub32(TrustedImm32(1), index);
 
         failures.link(this);
 
@@ -1375,7 +1385,7 @@ class YarrGenerator : private MacroAssembler {
         PatternTerm& term = state.term();
         UChar ch = term.patternCharacter;
 
-        move(Imm32(0), countRegister);
+        move(TrustedImm32(0), countRegister);
 
         Jump firstTimeDoNothing = jump();
 
@@ -1391,15 +1401,15 @@ class YarrGenerator : private MacroAssembler {
             branch32(Equal, countRegister, Imm32(term.quantityCount), hardFail);
         if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
             readCharacter(state.inputOffset(), character);
-            or32(Imm32(32), character);
+            or32(TrustedImm32(32), character);
             branch32(NotEqual, character, Imm32(Unicode::toLower(ch))).linkTo(hardFail, this);
         } else {
             ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
             jumpIfCharNotEquals(ch, state.inputOffset()).linkTo(hardFail, this);
         }
 
-        add32(Imm32(1), countRegister);
-        add32(Imm32(1), index);
+        add32(TrustedImm32(1), countRegister);
+        add32(TrustedImm32(1), index);
 
         firstTimeDoNothing.link(this);
         storeToFrame(countRegister, term.frameLocation);
@@ -1445,7 +1455,7 @@ class YarrGenerator : private MacroAssembler {
             matchDest.link(this);
         }
 
-        add32(Imm32(1), countRegister);
+        add32(TrustedImm32(1), countRegister);
         branch32(NotEqual, countRegister, index).linkTo(loop, this);
     }
 
@@ -1455,7 +1465,7 @@ class YarrGenerator : private MacroAssembler {
         const RegisterID countRegister = regT1;
         PatternTerm& term = state.term();
 
-        move(Imm32(0), countRegister);
+        move(TrustedImm32(0), countRegister);
 
         JumpList failures;
         Label loop(this);
@@ -1472,8 +1482,8 @@ class YarrGenerator : private MacroAssembler {
             matchDest.link(this);
         }
 
-        add32(Imm32(1), countRegister);
-        add32(Imm32(1), index);
+        add32(TrustedImm32(1), countRegister);
+        add32(TrustedImm32(1), index);
         if (term.quantityCount != quantifyInfinite) {
             branch32(NotEqual, countRegister, Imm32(term.quantityCount)).linkTo(loop, this);
             failures.append(jump());
@@ -1483,8 +1493,8 @@ class YarrGenerator : private MacroAssembler {
         Label backtrackBegin(this);
         loadFromFrame(term.frameLocation, countRegister);
         state.jumpToBacktrack(this, branchTest32(Zero, countRegister));
-        sub32(Imm32(1), countRegister);
-        sub32(Imm32(1), index);
+        sub32(TrustedImm32(1), countRegister);
+        sub32(TrustedImm32(1), index);
 
         failures.link(this);
 
@@ -1499,7 +1509,7 @@ class YarrGenerator : private MacroAssembler {
         const RegisterID countRegister = regT1;
         PatternTerm& term = state.term();
 
-        move(Imm32(0), countRegister);
+        move(TrustedImm32(0), countRegister);
 
         Jump firstTimeDoNothing = jump();
 
@@ -1524,8 +1534,8 @@ class YarrGenerator : private MacroAssembler {
             matchDest.link(this);
         }
 
-        add32(Imm32(1), countRegister);
-        add32(Imm32(1), index);
+        add32(TrustedImm32(1), countRegister);
+        add32(TrustedImm32(1), index);
 
         firstTimeDoNothing.link(this);
         storeToFrame(countRegister, term.frameLocation);
@@ -1669,7 +1679,7 @@ class YarrGenerator : private MacroAssembler {
             if (term.quantityType == QuantifierGreedy)
                 storeToFrame(index, parenthesesFrameLocation);
             else if (term.quantityType == QuantifierNonGreedy) {
-                storeToFrame(Imm32(-1), parenthesesFrameLocation);
+                storeToFrame(TrustedImm32(-1), parenthesesFrameLocation);
                 nonGreedySkipParentheses = jump();
                 nonGreedyTryParentheses = label();
                 storeToFrame(index, parenthesesFrameLocation);
@@ -2140,7 +2150,7 @@ class YarrGenerator : private MacroAssembler {
         if (m_pattern.m_body->m_callFrameSize)
             addPtr(Imm32(m_pattern.m_body->m_callFrameSize * sizeof(void*)), stackPointerRegister);
 
-        move(Imm32(-1), returnRegister);
+        move(TrustedImm32(-1), returnRegister);
 
         generateReturn();
 
@@ -2179,6 +2189,9 @@ class YarrGenerator : private MacroAssembler {
         push(ARMRegisters::r8); // scratch register
 #endif
         move(ARMRegisters::r3, output);
+#elif CPU(SH4)
+        push(SH4Registers::r11);
+        push(SH4Registers::r13);
 #elif CPU(MIPS)
         // Do nothing.
 #endif
@@ -2201,6 +2214,9 @@ class YarrGenerator : private MacroAssembler {
         pop(ARMRegisters::r6);
         pop(ARMRegisters::r5);
         pop(ARMRegisters::r4);
+#elif CPU(SH4)
+        pop(SH4Registers::r13);
+        pop(SH4Registers::r11);
 #elif CPU(MIPS)
         // Do nothing
 #endif
diff --git a/Source/JavaScriptCore/yarr/YarrParser.h b/Source/JavaScriptCore/yarr/YarrParser.h
index c59310a..65fb41d 100644
--- a/Source/JavaScriptCore/yarr/YarrParser.h
+++ b/Source/JavaScriptCore/yarr/YarrParser.h
@@ -78,6 +78,7 @@ private:
             : m_delegate(delegate)
             , m_err(err)
             , m_state(Empty)
+            , m_character(0)
         {
         }
 
diff --git a/Source/JavaScriptCore/yarr/YarrPattern.cpp b/Source/JavaScriptCore/yarr/YarrPattern.cpp
index 3d6dbd3..5913f7e 100644
--- a/Source/JavaScriptCore/yarr/YarrPattern.cpp
+++ b/Source/JavaScriptCore/yarr/YarrPattern.cpp
@@ -495,7 +495,9 @@ public:
 
         for (unsigned i = 0; i < numParenAlternatives; i++) {
             if (!parenthesesDisjunction->m_alternatives[i]->m_terms.size() && numParenAlternatives > 1) {
+                PatternAlternative* altToRemove = parenthesesDisjunction->m_alternatives[i];
                 parenthesesDisjunction->m_alternatives.remove(i);
+                delete altToRemove;
                 --numParenAlternatives;
 
                 containsEmptyAlternative = true;
@@ -812,20 +814,6 @@ public:
         }
     }
 
-    bool addBeginTerm(PatternTerm term, Vector<TermChain>* beginTerms, PatternAlternative* alternative, unsigned numTerms, unsigned termIndex, unsigned depth)
-    {
-        if (term.quantityType == QuantifierFixedCount) {
-            beginTerms->append(TermChain(term));
-            if (depth < 2 && termIndex < numTerms - 1 && term.quantityCount == 1)
-                setupAlternativeBeginTerms(alternative, &beginTerms->last().hotTerms, termIndex + 1, depth + 1);
-        } else if (termIndex != numTerms - 1) {
-            beginTerms->append(TermChain(term));
-            return true;
-        }
-
-        return false;
-    }
-
     // This function collects the terms which are potentially matching the first number of depth characters in the result.
     // If this function returns false then it found at least one term which makes the beginning character
     // look-up optimization inefficient.
@@ -861,10 +849,17 @@ public:
                 return false;
 
             case PatternTerm::TypePatternCharacter:
-                if (addBeginTerm(term, beginTerms, alternative, numTerms, termIndex, depth)) {
+                if (termIndex != numTerms - 1) {
+                    beginTerms->append(TermChain(term));
                     termIndex++;
                     checkNext = true;
+                } else if (term.quantityType == QuantifierFixedCount) {
+                    beginTerms->append(TermChain(term));
+                    if (depth < 2 && termIndex < numTerms - 1 && term.quantityCount == 1)
+                        if (!setupAlternativeBeginTerms(alternative, &beginTerms->last().hotTerms, termIndex + 1, depth + 1))
+                            return false;
                 }
+
                 break;
 
             case PatternTerm::TypeCharacterClass:
@@ -881,7 +876,6 @@ public:
 
                     termIndex++;
                     checkNext = true;
-
                 }
 
                 if (!setupDisjunctionBeginTerms(term.parentheses.disjunction, beginTerms, depth))